mystic | ed16df77dfe2ca81b73245b451c2f43f1220229215d955e7178c9580a659de6b

General

Target

ed16df77dfe2ca81b73245b451c2f43f1220229215d955e7178c9580a659de6b_JC.exe
Size

1.7MB
MD5

47e604c8c4b5d80e4f51d12153554ea7
SHA1

96a1d57a91084947d8fe82d39efd1ecfa58c0b0e
SHA256

ed16df77dfe2ca81b73245b451c2f43f1220229215d955e7178c9580a659de6b
SHA512

c2594f818f8c96fbca6e549c45884b945b8c0397e198ee9e40105029dcb045039df510022462b41507a8a6795d598cda96cd3d3b2824c486067de9a860036445
SSDEEP

24576:+/xY5A0vimILMPcVZT6gH/A2Z46a9Dhvht5Z/cf:+F0vimILMP4l6SAO46a3vbcf

Score

10^/10

Malware Config

Signatures

Detect Mystic stealer payload 6 IoCs

resource	yara_rule
behavioral1/memory/2436-3-0x0000000000400000-0x0000000000428000-memory.dmp	family_mystic
behavioral1/memory/2436-4-0x0000000000400000-0x0000000000428000-memory.dmp	family_mystic
behavioral1/memory/2436-5-0x0000000000400000-0x0000000000428000-memory.dmp	family_mystic
behavioral1/memory/2436-7-0x0000000000400000-0x0000000000428000-memory.dmp	family_mystic
behavioral1/memory/2436-9-0x0000000000400000-0x0000000000428000-memory.dmp	family_mystic
behavioral1/memory/2436-11-0x0000000000400000-0x0000000000428000-memory.dmp	family_mystic

Mystic
Mystic is an infostealer written in C++.
stealer mystic

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1708 set thread context of 2436	1708	ed16df77dfe2ca81b73245b451c2f43f1220229215d955e7178c9580a659de6b_JC.exe	28

Program crash 2 IoCs

pid	pid_target	Process	procid_target
2396	1708	WerFault.exe	27
2656	2436	WerFault.exe	28

Suspicious use of WriteProcessMemory 25 IoCs

description	pid	Process	procid_target
PID 1708 wrote to memory of 2436	1708	ed16df77dfe2ca81b73245b451c2f43f1220229215d955e7178c9580a659de6b_JC.exe	28
PID 1708 wrote to memory of 2436	1708	ed16df77dfe2ca81b73245b451c2f43f1220229215d955e7178c9580a659de6b_JC.exe	28
PID 1708 wrote to memory of 2436	1708	ed16df77dfe2ca81b73245b451c2f43f1220229215d955e7178c9580a659de6b_JC.exe	28
PID 1708 wrote to memory of 2436	1708	ed16df77dfe2ca81b73245b451c2f43f1220229215d955e7178c9580a659de6b_JC.exe	28
PID 1708 wrote to memory of 2436	1708	ed16df77dfe2ca81b73245b451c2f43f1220229215d955e7178c9580a659de6b_JC.exe	28
PID 1708 wrote to memory of 2436	1708	ed16df77dfe2ca81b73245b451c2f43f1220229215d955e7178c9580a659de6b_JC.exe	28
PID 1708 wrote to memory of 2436	1708	ed16df77dfe2ca81b73245b451c2f43f1220229215d955e7178c9580a659de6b_JC.exe	28
PID 1708 wrote to memory of 2436	1708	ed16df77dfe2ca81b73245b451c2f43f1220229215d955e7178c9580a659de6b_JC.exe	28
PID 1708 wrote to memory of 2436	1708	ed16df77dfe2ca81b73245b451c2f43f1220229215d955e7178c9580a659de6b_JC.exe	28
PID 1708 wrote to memory of 2436	1708	ed16df77dfe2ca81b73245b451c2f43f1220229215d955e7178c9580a659de6b_JC.exe	28
PID 1708 wrote to memory of 2436	1708	ed16df77dfe2ca81b73245b451c2f43f1220229215d955e7178c9580a659de6b_JC.exe	28
PID 1708 wrote to memory of 2436	1708	ed16df77dfe2ca81b73245b451c2f43f1220229215d955e7178c9580a659de6b_JC.exe	28
PID 1708 wrote to memory of 2436	1708	ed16df77dfe2ca81b73245b451c2f43f1220229215d955e7178c9580a659de6b_JC.exe	28
PID 1708 wrote to memory of 2436	1708	ed16df77dfe2ca81b73245b451c2f43f1220229215d955e7178c9580a659de6b_JC.exe	28
PID 1708 wrote to memory of 2396	1708	ed16df77dfe2ca81b73245b451c2f43f1220229215d955e7178c9580a659de6b_JC.exe	29
PID 1708 wrote to memory of 2396	1708	ed16df77dfe2ca81b73245b451c2f43f1220229215d955e7178c9580a659de6b_JC.exe	29
PID 1708 wrote to memory of 2396	1708	ed16df77dfe2ca81b73245b451c2f43f1220229215d955e7178c9580a659de6b_JC.exe	29
PID 1708 wrote to memory of 2396	1708	ed16df77dfe2ca81b73245b451c2f43f1220229215d955e7178c9580a659de6b_JC.exe	29
PID 2436 wrote to memory of 2656	2436	AppLaunch.exe	30
PID 2436 wrote to memory of 2656	2436	AppLaunch.exe	30
PID 2436 wrote to memory of 2656	2436	AppLaunch.exe	30
PID 2436 wrote to memory of 2656	2436	AppLaunch.exe	30
PID 2436 wrote to memory of 2656	2436	AppLaunch.exe	30
PID 2436 wrote to memory of 2656	2436	AppLaunch.exe	30
PID 2436 wrote to memory of 2656	2436	AppLaunch.exe	30

C:\Users\Admin\AppData\Local\Temp\ed16df77dfe2ca81b73245b451c2f43f1220229215d955e7178c9580a659de6b_JC.exe
"C:\Users\Admin\AppData\Local\Temp\ed16df77dfe2ca81b73245b451c2f43f1220229215d955e7178c9580a659de6b_JC.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1708
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2436
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2436 -s 196
    3⤵
    - Program crash
    PID:2656
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1708 -s 136
  2⤵
  - Program crash
  PID:2396

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2436-0-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/2436-2-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/2436-1-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/2436-3-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/2436-4-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/2436-6-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmp

Filesize
4KB

Download
memory/2436-5-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/2436-7-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/2436-9-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/2436-11-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads