mystic | 0bed3125d17d1e4ef0594d3558d33233cf1cfc95f8f0a0a6b9f205856be9708e

General

Target

NEAS.0bed3125d17d1e4ef0594d3558d33233cf1cfc95f8f0a0a6b9f205856be9708e_JC.exe
Size

378KB
MD5

31dd05be6327b99d57887dae243be7de
SHA1

c10bea15badb026222d609402100a4320cb25e10
SHA256

0bed3125d17d1e4ef0594d3558d33233cf1cfc95f8f0a0a6b9f205856be9708e
SHA512

6efb98283d6393894cb12e46fc3c553f8fb52e9270b749e8e4a162d2fa5ddf8e6346b33b069554353dd4603bf947ccc56672dd54a5e2bc08cf36b512c7e1003e
SSDEEP

6144:A4LSp92pCryG4kfjSGwEi56AOOGF7L0R0rFhc+VbiKH7KB0D:A4Lm2wryNSvx0R0JK+VbiKH7KqD

Score

10^/10

Malware Config

Signatures

Detect Mystic stealer payload 6 IoCs

resource	yara_rule
behavioral1/memory/2012-3-0x0000000000400000-0x0000000000428000-memory.dmp	family_mystic
behavioral1/memory/2012-4-0x0000000000400000-0x0000000000428000-memory.dmp	family_mystic
behavioral1/memory/2012-5-0x0000000000400000-0x0000000000428000-memory.dmp	family_mystic
behavioral1/memory/2012-7-0x0000000000400000-0x0000000000428000-memory.dmp	family_mystic
behavioral1/memory/2012-9-0x0000000000400000-0x0000000000428000-memory.dmp	family_mystic
behavioral1/memory/2012-11-0x0000000000400000-0x0000000000428000-memory.dmp	family_mystic

Mystic
Mystic is an infostealer written in C++.
stealer mystic

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1972 set thread context of 2012	1972	NEAS.0bed3125d17d1e4ef0594d3558d33233cf1cfc95f8f0a0a6b9f205856be9708e_JC.exe	29

Program crash 2 IoCs

pid	pid_target	Process	procid_target
3044	1972	WerFault.exe	27
2544	2012	WerFault.exe	29

Suspicious use of WriteProcessMemory 25 IoCs

description	pid	Process	procid_target
PID 1972 wrote to memory of 2012	1972	NEAS.0bed3125d17d1e4ef0594d3558d33233cf1cfc95f8f0a0a6b9f205856be9708e_JC.exe	29
PID 1972 wrote to memory of 2012	1972	NEAS.0bed3125d17d1e4ef0594d3558d33233cf1cfc95f8f0a0a6b9f205856be9708e_JC.exe	29
PID 1972 wrote to memory of 2012	1972	NEAS.0bed3125d17d1e4ef0594d3558d33233cf1cfc95f8f0a0a6b9f205856be9708e_JC.exe	29
PID 1972 wrote to memory of 2012	1972	NEAS.0bed3125d17d1e4ef0594d3558d33233cf1cfc95f8f0a0a6b9f205856be9708e_JC.exe	29
PID 1972 wrote to memory of 2012	1972	NEAS.0bed3125d17d1e4ef0594d3558d33233cf1cfc95f8f0a0a6b9f205856be9708e_JC.exe	29
PID 1972 wrote to memory of 2012	1972	NEAS.0bed3125d17d1e4ef0594d3558d33233cf1cfc95f8f0a0a6b9f205856be9708e_JC.exe	29
PID 1972 wrote to memory of 2012	1972	NEAS.0bed3125d17d1e4ef0594d3558d33233cf1cfc95f8f0a0a6b9f205856be9708e_JC.exe	29
PID 1972 wrote to memory of 2012	1972	NEAS.0bed3125d17d1e4ef0594d3558d33233cf1cfc95f8f0a0a6b9f205856be9708e_JC.exe	29
PID 1972 wrote to memory of 2012	1972	NEAS.0bed3125d17d1e4ef0594d3558d33233cf1cfc95f8f0a0a6b9f205856be9708e_JC.exe	29
PID 1972 wrote to memory of 2012	1972	NEAS.0bed3125d17d1e4ef0594d3558d33233cf1cfc95f8f0a0a6b9f205856be9708e_JC.exe	29
PID 1972 wrote to memory of 2012	1972	NEAS.0bed3125d17d1e4ef0594d3558d33233cf1cfc95f8f0a0a6b9f205856be9708e_JC.exe	29
PID 1972 wrote to memory of 2012	1972	NEAS.0bed3125d17d1e4ef0594d3558d33233cf1cfc95f8f0a0a6b9f205856be9708e_JC.exe	29
PID 1972 wrote to memory of 2012	1972	NEAS.0bed3125d17d1e4ef0594d3558d33233cf1cfc95f8f0a0a6b9f205856be9708e_JC.exe	29
PID 1972 wrote to memory of 2012	1972	NEAS.0bed3125d17d1e4ef0594d3558d33233cf1cfc95f8f0a0a6b9f205856be9708e_JC.exe	29
PID 1972 wrote to memory of 3044	1972	NEAS.0bed3125d17d1e4ef0594d3558d33233cf1cfc95f8f0a0a6b9f205856be9708e_JC.exe	30
PID 1972 wrote to memory of 3044	1972	NEAS.0bed3125d17d1e4ef0594d3558d33233cf1cfc95f8f0a0a6b9f205856be9708e_JC.exe	30
PID 1972 wrote to memory of 3044	1972	NEAS.0bed3125d17d1e4ef0594d3558d33233cf1cfc95f8f0a0a6b9f205856be9708e_JC.exe	30
PID 1972 wrote to memory of 3044	1972	NEAS.0bed3125d17d1e4ef0594d3558d33233cf1cfc95f8f0a0a6b9f205856be9708e_JC.exe	30
PID 2012 wrote to memory of 2544	2012	AppLaunch.exe	31
PID 2012 wrote to memory of 2544	2012	AppLaunch.exe	31
PID 2012 wrote to memory of 2544	2012	AppLaunch.exe	31
PID 2012 wrote to memory of 2544	2012	AppLaunch.exe	31
PID 2012 wrote to memory of 2544	2012	AppLaunch.exe	31
PID 2012 wrote to memory of 2544	2012	AppLaunch.exe	31
PID 2012 wrote to memory of 2544	2012	AppLaunch.exe	31

C:\Users\Admin\AppData\Local\Temp\NEAS.0bed3125d17d1e4ef0594d3558d33233cf1cfc95f8f0a0a6b9f205856be9708e_JC.exe
"C:\Users\Admin\AppData\Local\Temp\NEAS.0bed3125d17d1e4ef0594d3558d33233cf1cfc95f8f0a0a6b9f205856be9708e_JC.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1972
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2012
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2012 -s 196
    3⤵
    - Program crash
    PID:2544
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1972 -s 136
  2⤵
  - Program crash
  PID:3044

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2012-3-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/2012-4-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/2012-2-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/2012-1-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/2012-0-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/2012-5-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/2012-7-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/2012-6-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmp

Filesize
4KB

Download
memory/2012-9-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/2012-11-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads