mystic | 73ef1eb641eef7764d386032b6576ac92c2fcab8c790b801d8057e14e8618ec8

General

Target

73ef1eb641eef7764d386032b6576ac92c2fcab8c790b801d8057e14e8618ec8.exe
Size

1.7MB
MD5

c5fbbab507b6f3ae31406ab9f8e3b61e
SHA1

6b99871f7a812ed6c806f53eaea9decf99c4a437
SHA256

73ef1eb641eef7764d386032b6576ac92c2fcab8c790b801d8057e14e8618ec8
SHA512

308fd36231ba656dbe779673f5a9652110fabeb760baeed6309561fbb7deffddf9c4c6f3ebe57b31672bf0244df69e75d6f36ff6d1e2e72e533b144f1de0d983
SSDEEP

24576:tUxY5A0vimILMPcVZT6gH/A2Z46a9DhvhCw3+0wpef:t60vimILMP4l6SAO46a3vGIf

Score

10^/10

mystic stealer

Malware Config

Extracted

Family

mystic

C2

http://5.42.92.211/loghub/master

Signatures

Detect Mystic stealer payload 5 IoCs

resource	yara_rule
behavioral1/memory/2420-1-0x0000000000400000-0x0000000000428000-memory.dmp	family_mystic
behavioral1/memory/2420-2-0x0000000000400000-0x0000000000428000-memory.dmp	family_mystic
behavioral1/memory/2420-0-0x0000000000400000-0x0000000000428000-memory.dmp	family_mystic
behavioral1/memory/2420-3-0x0000000000400000-0x0000000000428000-memory.dmp	family_mystic
behavioral1/memory/2420-4-0x0000000000400000-0x0000000000428000-memory.dmp	family_mystic

Mystic
Mystic is an infostealer written in C++.
stealer mystic

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 404 set thread context of 2420	404	73ef1eb641eef7764d386032b6576ac92c2fcab8c790b801d8057e14e8618ec8.exe	86

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1320	404	WerFault.exe	84

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeManageVolumePrivilege	412	svchost.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 404 wrote to memory of 2420	404	73ef1eb641eef7764d386032b6576ac92c2fcab8c790b801d8057e14e8618ec8.exe	86
PID 404 wrote to memory of 2420	404	73ef1eb641eef7764d386032b6576ac92c2fcab8c790b801d8057e14e8618ec8.exe	86
PID 404 wrote to memory of 2420	404	73ef1eb641eef7764d386032b6576ac92c2fcab8c790b801d8057e14e8618ec8.exe	86
PID 404 wrote to memory of 2420	404	73ef1eb641eef7764d386032b6576ac92c2fcab8c790b801d8057e14e8618ec8.exe	86
PID 404 wrote to memory of 2420	404	73ef1eb641eef7764d386032b6576ac92c2fcab8c790b801d8057e14e8618ec8.exe	86
PID 404 wrote to memory of 2420	404	73ef1eb641eef7764d386032b6576ac92c2fcab8c790b801d8057e14e8618ec8.exe	86
PID 404 wrote to memory of 2420	404	73ef1eb641eef7764d386032b6576ac92c2fcab8c790b801d8057e14e8618ec8.exe	86
PID 404 wrote to memory of 2420	404	73ef1eb641eef7764d386032b6576ac92c2fcab8c790b801d8057e14e8618ec8.exe	86
PID 404 wrote to memory of 2420	404	73ef1eb641eef7764d386032b6576ac92c2fcab8c790b801d8057e14e8618ec8.exe	86
PID 404 wrote to memory of 2420	404	73ef1eb641eef7764d386032b6576ac92c2fcab8c790b801d8057e14e8618ec8.exe	86

C:\Users\Admin\AppData\Local\Temp\73ef1eb641eef7764d386032b6576ac92c2fcab8c790b801d8057e14e8618ec8.exe
"C:\Users\Admin\AppData\Local\Temp\73ef1eb641eef7764d386032b6576ac92c2fcab8c790b801d8057e14e8618ec8.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:404
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
  2⤵
  PID:2420
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 404 -s 412
  2⤵
  - Program crash
  PID:1320

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 404 -ip 404
1⤵
PID:1208

C:\Windows\system32\rundll32.exe
"C:\Windows\system32\rundll32.exe" "C:\Windows\SYSTEM32\EDGEHTML.dll",#141 Microsoft.VCLibs.140.00_8wekyb3d8bbwe
1⤵
PID:368

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k UnistackSvcGroup
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:412

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/412-42-0x00000279CEB00000-0x00000279CEB01000-memory.dmp

Filesize
4KB

Download
memory/412-71-0x00000279CE860000-0x00000279CE861000-memory.dmp

Filesize
4KB

Download
memory/412-73-0x00000279CE970000-0x00000279CE971000-memory.dmp

Filesize
4KB

Download
memory/412-72-0x00000279CE860000-0x00000279CE861000-memory.dmp

Filesize
4KB

Download
memory/412-43-0x00000279CEB00000-0x00000279CEB01000-memory.dmp

Filesize
4KB

Download
memory/412-5-0x00000279C6440000-0x00000279C6450000-memory.dmp

Filesize
64KB

Download
memory/412-21-0x00000279C6540000-0x00000279C6550000-memory.dmp

Filesize
64KB

Download
memory/412-37-0x00000279CEAD0000-0x00000279CEAD1000-memory.dmp

Filesize
4KB

Download
memory/412-38-0x00000279CEB00000-0x00000279CEB01000-memory.dmp

Filesize
4KB

Download
memory/412-39-0x00000279CEB00000-0x00000279CEB01000-memory.dmp

Filesize
4KB

Download
memory/412-40-0x00000279CEB00000-0x00000279CEB01000-memory.dmp

Filesize
4KB

Download
memory/412-44-0x00000279CEB00000-0x00000279CEB01000-memory.dmp

Filesize
4KB

Download
memory/412-69-0x00000279CE850000-0x00000279CE851000-memory.dmp

Filesize
4KB

Download
memory/412-57-0x00000279CE650000-0x00000279CE651000-memory.dmp

Filesize
4KB

Download
memory/412-41-0x00000279CEB00000-0x00000279CEB01000-memory.dmp

Filesize
4KB

Download
memory/412-45-0x00000279CEB00000-0x00000279CEB01000-memory.dmp

Filesize
4KB

Download
memory/412-46-0x00000279CEB00000-0x00000279CEB01000-memory.dmp

Filesize
4KB

Download
memory/412-47-0x00000279CEB00000-0x00000279CEB01000-memory.dmp

Filesize
4KB

Download
memory/412-48-0x00000279CE720000-0x00000279CE721000-memory.dmp

Filesize
4KB

Download
memory/412-49-0x00000279CE710000-0x00000279CE711000-memory.dmp

Filesize
4KB

Download
memory/412-51-0x00000279CE720000-0x00000279CE721000-memory.dmp

Filesize
4KB

Download
memory/412-54-0x00000279CE710000-0x00000279CE711000-memory.dmp

Filesize
4KB

Download
memory/2420-1-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/2420-2-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/2420-4-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/2420-3-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/2420-0-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download

Analysis

Sharing