mystic | df0b9492299708ab0be01adba36a7a6528172c0599a830ecd965189538d0d4b6

Analysis

max time kernel
145s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20230915-en
resource tags

arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
submitted
07/10/2023, 07:31

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
c16cab1c845d4f73318c21821b3b3337.exe
Size 378KB
Sample231007-jcdvxshg8z
SHA256 df0b9492299708ab0be01adba36a7a6528172c0599a830ecd965189538d0d4b6
MD5 c16cab1c845d4f73318c21821b3b3337
SHA1 01660d42de619ab5497cd40dda2cf79d7b9684c7
SHA512 cfce119c96d33e26d16f5aae875af045a28d8bc150502c4786d2d8402172c890e43871b1f1f2a21ca62d7713aaf745b2eadf0e7581d7d662c06b4c8c2434a303
SSDEEP 6144:CLCFCH557yGY/fjBximSLB5aAOniJvJuL6z6O2NqT0Kbw9FRfhPzhMm3tNj:CLZHr7yV3OWk9AL6mAgvb1jj
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

mystic stealer

Malware Config

Extracted

Family

mystic

http://5.42.92.211/loghub/master

Signatures

Detect Mystic stealer payload 5 IoCs

resource	yara_rule
behavioral2/memory/432-0-0x0000000000400000-0x0000000000428000-memory.dmp	family_mystic
behavioral2/memory/432-1-0x0000000000400000-0x0000000000428000-memory.dmp	family_mystic
behavioral2/memory/432-2-0x0000000000400000-0x0000000000428000-memory.dmp	family_mystic
behavioral2/memory/432-3-0x0000000000400000-0x0000000000428000-memory.dmp	family_mystic
behavioral2/memory/432-4-0x0000000000400000-0x0000000000428000-memory.dmp	family_mystic

Mystic
Mystic is an infostealer written in C++.
stealer mystic

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3432 set thread context of 432	3432	c16cab1c845d4f73318c21821b3b3337.exe	87

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4972	3432	WerFault.exe	80

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeManageVolumePrivilege	4956	svchost.exe

Suspicious use of WriteProcessMemory 13 IoCs

description	pid	Process	procid_target
PID 3432 wrote to memory of 2780	3432	c16cab1c845d4f73318c21821b3b3337.exe	86
PID 3432 wrote to memory of 2780	3432	c16cab1c845d4f73318c21821b3b3337.exe	86
PID 3432 wrote to memory of 2780	3432	c16cab1c845d4f73318c21821b3b3337.exe	86
PID 3432 wrote to memory of 432	3432	c16cab1c845d4f73318c21821b3b3337.exe	87
PID 3432 wrote to memory of 432	3432	c16cab1c845d4f73318c21821b3b3337.exe	87
PID 3432 wrote to memory of 432	3432	c16cab1c845d4f73318c21821b3b3337.exe	87
PID 3432 wrote to memory of 432	3432	c16cab1c845d4f73318c21821b3b3337.exe	87
PID 3432 wrote to memory of 432	3432	c16cab1c845d4f73318c21821b3b3337.exe	87
PID 3432 wrote to memory of 432	3432	c16cab1c845d4f73318c21821b3b3337.exe	87
PID 3432 wrote to memory of 432	3432	c16cab1c845d4f73318c21821b3b3337.exe	87
PID 3432 wrote to memory of 432	3432	c16cab1c845d4f73318c21821b3b3337.exe	87
PID 3432 wrote to memory of 432	3432	c16cab1c845d4f73318c21821b3b3337.exe	87
PID 3432 wrote to memory of 432	3432	c16cab1c845d4f73318c21821b3b3337.exe	87

C:\Users\Admin\AppData\Local\Temp\c16cab1c845d4f73318c21821b3b3337.exe
"C:\Users\Admin\AppData\Local\Temp\c16cab1c845d4f73318c21821b3b3337.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3432
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
  2⤵
  PID:2780
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
  2⤵
  PID:432
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3432 -s 412
  2⤵
  - Program crash
  PID:4972

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 3432 -ip 3432
1⤵
PID:1944

C:\Windows\system32\rundll32.exe
"C:\Windows\system32\rundll32.exe" "C:\Windows\SYSTEM32\EDGEHTML.dll",#141 Microsoft.VCLibs.140.00_8wekyb3d8bbwe
1⤵
PID:5092

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k UnistackSvcGroup
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4956

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/432-0-0x0000000000400000-0x0000000000428000-memory.dmp

Download

memory/432-1-0x0000000000400000-0x0000000000428000-memory.dmp

Download

memory/432-2-0x0000000000400000-0x0000000000428000-memory.dmp

Download

memory/432-3-0x0000000000400000-0x0000000000428000-memory.dmp

Download

memory/432-4-0x0000000000400000-0x0000000000428000-memory.dmp

Download

memory/4956-5-0x00000271E4A50000-0x00000271E4A60000-memory.dmp

Download

memory/4956-21-0x00000271E4B50000-0x00000271E4B60000-memory.dmp

Download

memory/4956-37-0x00000271ECEC0000-0x00000271ECEC1000-memory.dmp

Download

memory/4956-39-0x00000271ECEF0000-0x00000271ECEF1000-memory.dmp

Download

memory/4956-40-0x00000271ECEF0000-0x00000271ECEF1000-memory.dmp

Download

memory/4956-41-0x00000271ED000000-0x00000271ED001000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads