mystic | a23409f579deb1d68ab914ea800df4a80cfded68e12c9205b9d6f3234c26b47d

General

Target

NEAS.a23409f579deb1d68ab914ea800df4a80cfded68e12c9205b9d6f3234c26b47dexe_JC.exe
Size

1.4MB
MD5

221610ece0649f15926ff8c700894a4b
SHA1

f05152abf9de6bb2fe185ff69ff75ec10ea6b411
SHA256

a23409f579deb1d68ab914ea800df4a80cfded68e12c9205b9d6f3234c26b47d
SHA512

8ef9223fef92373b356154495706685310c7ed32347788bf9829cc021e142b291639e505202ef280d559fc0f8e428120e719b879d355c524abb687c16c984e77
SSDEEP

12288:jaWs3sJwo00rnuOVD9X6a9DhvhNf9H/7Fc0Y6Diiebj:jmsJw8T6a9DhvhnziOBe

Score

10^/10

Malware Config

Signatures

Detect Mystic stealer payload 6 IoCs

resource	yara_rule
behavioral1/memory/2940-3-0x0000000000400000-0x0000000000428000-memory.dmp	family_mystic
behavioral1/memory/2940-7-0x0000000000400000-0x0000000000428000-memory.dmp	family_mystic
behavioral1/memory/2940-5-0x0000000000400000-0x0000000000428000-memory.dmp	family_mystic
behavioral1/memory/2940-4-0x0000000000400000-0x0000000000428000-memory.dmp	family_mystic
behavioral1/memory/2940-9-0x0000000000400000-0x0000000000428000-memory.dmp	family_mystic
behavioral1/memory/2940-11-0x0000000000400000-0x0000000000428000-memory.dmp	family_mystic

Mystic
Mystic is an infostealer written in C++.
stealer mystic

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1764 set thread context of 2940	1764	NEAS.a23409f579deb1d68ab914ea800df4a80cfded68e12c9205b9d6f3234c26b47dexe_JC.exe	29

Program crash 2 IoCs

pid	pid_target	Process	procid_target
2884	1764	WerFault.exe	23
2316	2940	WerFault.exe	29

Suspicious use of WriteProcessMemory 25 IoCs

description	pid	Process	procid_target
PID 1764 wrote to memory of 2940	1764	NEAS.a23409f579deb1d68ab914ea800df4a80cfded68e12c9205b9d6f3234c26b47dexe_JC.exe	29
PID 1764 wrote to memory of 2940	1764	NEAS.a23409f579deb1d68ab914ea800df4a80cfded68e12c9205b9d6f3234c26b47dexe_JC.exe	29
PID 1764 wrote to memory of 2940	1764	NEAS.a23409f579deb1d68ab914ea800df4a80cfded68e12c9205b9d6f3234c26b47dexe_JC.exe	29
PID 1764 wrote to memory of 2940	1764	NEAS.a23409f579deb1d68ab914ea800df4a80cfded68e12c9205b9d6f3234c26b47dexe_JC.exe	29
PID 1764 wrote to memory of 2940	1764	NEAS.a23409f579deb1d68ab914ea800df4a80cfded68e12c9205b9d6f3234c26b47dexe_JC.exe	29
PID 1764 wrote to memory of 2940	1764	NEAS.a23409f579deb1d68ab914ea800df4a80cfded68e12c9205b9d6f3234c26b47dexe_JC.exe	29
PID 1764 wrote to memory of 2940	1764	NEAS.a23409f579deb1d68ab914ea800df4a80cfded68e12c9205b9d6f3234c26b47dexe_JC.exe	29
PID 1764 wrote to memory of 2940	1764	NEAS.a23409f579deb1d68ab914ea800df4a80cfded68e12c9205b9d6f3234c26b47dexe_JC.exe	29
PID 1764 wrote to memory of 2940	1764	NEAS.a23409f579deb1d68ab914ea800df4a80cfded68e12c9205b9d6f3234c26b47dexe_JC.exe	29
PID 1764 wrote to memory of 2940	1764	NEAS.a23409f579deb1d68ab914ea800df4a80cfded68e12c9205b9d6f3234c26b47dexe_JC.exe	29
PID 1764 wrote to memory of 2940	1764	NEAS.a23409f579deb1d68ab914ea800df4a80cfded68e12c9205b9d6f3234c26b47dexe_JC.exe	29
PID 1764 wrote to memory of 2940	1764	NEAS.a23409f579deb1d68ab914ea800df4a80cfded68e12c9205b9d6f3234c26b47dexe_JC.exe	29
PID 1764 wrote to memory of 2940	1764	NEAS.a23409f579deb1d68ab914ea800df4a80cfded68e12c9205b9d6f3234c26b47dexe_JC.exe	29
PID 1764 wrote to memory of 2940	1764	NEAS.a23409f579deb1d68ab914ea800df4a80cfded68e12c9205b9d6f3234c26b47dexe_JC.exe	29
PID 1764 wrote to memory of 2884	1764	NEAS.a23409f579deb1d68ab914ea800df4a80cfded68e12c9205b9d6f3234c26b47dexe_JC.exe	30
PID 1764 wrote to memory of 2884	1764	NEAS.a23409f579deb1d68ab914ea800df4a80cfded68e12c9205b9d6f3234c26b47dexe_JC.exe	30
PID 1764 wrote to memory of 2884	1764	NEAS.a23409f579deb1d68ab914ea800df4a80cfded68e12c9205b9d6f3234c26b47dexe_JC.exe	30
PID 1764 wrote to memory of 2884	1764	NEAS.a23409f579deb1d68ab914ea800df4a80cfded68e12c9205b9d6f3234c26b47dexe_JC.exe	30
PID 2940 wrote to memory of 2316	2940	AppLaunch.exe	31
PID 2940 wrote to memory of 2316	2940	AppLaunch.exe	31
PID 2940 wrote to memory of 2316	2940	AppLaunch.exe	31
PID 2940 wrote to memory of 2316	2940	AppLaunch.exe	31
PID 2940 wrote to memory of 2316	2940	AppLaunch.exe	31
PID 2940 wrote to memory of 2316	2940	AppLaunch.exe	31
PID 2940 wrote to memory of 2316	2940	AppLaunch.exe	31

C:\Users\Admin\AppData\Local\Temp\NEAS.a23409f579deb1d68ab914ea800df4a80cfded68e12c9205b9d6f3234c26b47dexe_JC.exe
"C:\Users\Admin\AppData\Local\Temp\NEAS.a23409f579deb1d68ab914ea800df4a80cfded68e12c9205b9d6f3234c26b47dexe_JC.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1764
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2940
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2940 -s 196
    3⤵
    - Program crash
    PID:2316
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1764 -s 136
  2⤵
  - Program crash
  PID:2884

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2940-3-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/2940-2-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/2940-7-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/2940-6-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmp

Filesize
4KB

Download
memory/2940-5-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/2940-4-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/2940-1-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/2940-9-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/2940-0-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/2940-11-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads