mystic | e96dc95025fa52c1bae82541849c3f3673202bbe6f3a2f7060e4bdab597c32b5

Analysis

max time kernel
70s
max time network
79s
platform
windows10-1703_x64
resource
win10-20230915-en
resource tags

arch:x64arch:x86image:win10-20230915-enlocale:en-usos:windows10-1703-x64system
submitted
07/10/2023, 07:37

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
e96dc95025fa52c1bae82541849c3f3673202bbe6f3a2f7060e4bdab597c32b5.exe
Size 1.2MB
Sample231007-jf7meacb65
SHA256 e96dc95025fa52c1bae82541849c3f3673202bbe6f3a2f7060e4bdab597c32b5
MD5 24e91e9fceebc0e666be7d3205071aaa
SHA1 5a95aa8a5ff40cd34eae8b5bb75ca684e5757bf5
SHA512 041688a0525c708666ec483804c8cbc21ef21eb05f1b4909789420e1029b39e82e86aebe3ffc81e431cd23b3f45eb7f99ba6aae1338aab5dcd99118d51f1e328
SSDEEP 24576:kyzkwomNFn+JqPpv1G+MAzjaxQGTLAnhuggNhgIbL4HfiQ:zzkDm7hvYeyxQGon4gUhN
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

mystic persistence stealer

Malware Config

Signatures

Detect Mystic stealer payload 4 IoCs

resource	yara_rule
behavioral1/memory/4240-35-0x0000000000400000-0x0000000000428000-memory.dmp	family_mystic
behavioral1/memory/4240-38-0x0000000000400000-0x0000000000428000-memory.dmp	family_mystic
behavioral1/memory/4240-39-0x0000000000400000-0x0000000000428000-memory.dmp	family_mystic
behavioral1/memory/4240-41-0x0000000000400000-0x0000000000428000-memory.dmp	family_mystic

Mystic
Mystic is an infostealer written in C++.
stealer mystic

Executes dropped EXE 5 IoCs

pid	Process
1860	Im8XK3pr.exe
2092	Fg3VW6yQ.exe
3912	Ob2Ry3Kt.exe
4248	Ua1Of3ka.exe
3112	1uc05QX0.exe

Adds Run key to start application 2 TTPs 5 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	Im8XK3pr.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\""	Fg3VW6yQ.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup3 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP003.TMP\\\""	Ob2Ry3Kt.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup4 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP004.TMP\\\""	Ua1Of3ka.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	e96dc95025fa52c1bae82541849c3f3673202bbe6f3a2f7060e4bdab597c32b5.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3112 set thread context of 4240	3112	1uc05QX0.exe	75

Program crash 2 IoCs

pid	pid_target	Process	procid_target
60	3112	WerFault.exe	73
4200	4240	WerFault.exe	75

Suspicious use of WriteProcessMemory 25 IoCs

description	pid	Process	procid_target
PID 520 wrote to memory of 1860	520	e96dc95025fa52c1bae82541849c3f3673202bbe6f3a2f7060e4bdab597c32b5.exe	69
PID 520 wrote to memory of 1860	520	e96dc95025fa52c1bae82541849c3f3673202bbe6f3a2f7060e4bdab597c32b5.exe	69
PID 520 wrote to memory of 1860	520	e96dc95025fa52c1bae82541849c3f3673202bbe6f3a2f7060e4bdab597c32b5.exe	69
PID 1860 wrote to memory of 2092	1860	Im8XK3pr.exe	70
PID 1860 wrote to memory of 2092	1860	Im8XK3pr.exe	70
PID 1860 wrote to memory of 2092	1860	Im8XK3pr.exe	70
PID 2092 wrote to memory of 3912	2092	Fg3VW6yQ.exe	71
PID 2092 wrote to memory of 3912	2092	Fg3VW6yQ.exe	71
PID 2092 wrote to memory of 3912	2092	Fg3VW6yQ.exe	71
PID 3912 wrote to memory of 4248	3912	Ob2Ry3Kt.exe	72
PID 3912 wrote to memory of 4248	3912	Ob2Ry3Kt.exe	72
PID 3912 wrote to memory of 4248	3912	Ob2Ry3Kt.exe	72
PID 4248 wrote to memory of 3112	4248	Ua1Of3ka.exe	73
PID 4248 wrote to memory of 3112	4248	Ua1Of3ka.exe	73
PID 4248 wrote to memory of 3112	4248	Ua1Of3ka.exe	73
PID 3112 wrote to memory of 4240	3112	1uc05QX0.exe	75
PID 3112 wrote to memory of 4240	3112	1uc05QX0.exe	75
PID 3112 wrote to memory of 4240	3112	1uc05QX0.exe	75
PID 3112 wrote to memory of 4240	3112	1uc05QX0.exe	75
PID 3112 wrote to memory of 4240	3112	1uc05QX0.exe	75
PID 3112 wrote to memory of 4240	3112	1uc05QX0.exe	75
PID 3112 wrote to memory of 4240	3112	1uc05QX0.exe	75
PID 3112 wrote to memory of 4240	3112	1uc05QX0.exe	75
PID 3112 wrote to memory of 4240	3112	1uc05QX0.exe	75
PID 3112 wrote to memory of 4240	3112	1uc05QX0.exe	75

C:\Users\Admin\AppData\Local\Temp\e96dc95025fa52c1bae82541849c3f3673202bbe6f3a2f7060e4bdab597c32b5.exe
"C:\Users\Admin\AppData\Local\Temp\e96dc95025fa52c1bae82541849c3f3673202bbe6f3a2f7060e4bdab597c32b5.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:520
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Im8XK3pr.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Im8XK3pr.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:1860
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\Fg3VW6yQ.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\Fg3VW6yQ.exe
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Suspicious use of WriteProcessMemory
    PID:2092
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\Ob2Ry3Kt.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\Ob2Ry3Kt.exe
      4⤵
      Executes dropped EXE
      Adds Run key to start application
      Suspicious use of WriteProcessMemory
      PID:3912
    - - C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\Ua1Of3ka.exe
        
        C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\Ua1Of3ka.exe
        5⤵
        Executes dropped EXE
        Adds Run key to start application
        Suspicious use of WriteProcessMemory
        
        PID:4248
      - C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\1uc05QX0.exe
        
        C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\1uc05QX0.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Suspicious use of WriteProcessMemory
        
        PID:3112
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
        7⤵
        
        PID:4240
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4240 -s 568
        8⤵
        Program crash
        
        PID:4200
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3112 -s 584
        7⤵
        Program crash
        
        PID:60

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Im8XK3pr.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Im8XK3pr.exe
Size 1.0MB
SHA256 25411d508ec5124eaeb5f2cb705eb5fb60c09a6567be031f7575638dc4384225
MD5 2a3d9cd8e274d52f8240662cd5fd5350
SHA1 74af9e3bd9d20cbc4c909fa86be2d14c23022573
SHA512 d78ebaf21bb99394c91c589670331a20e78cc218e7f7bfd1a128afaee465443beb1f68bdd1e2a6bdf59ed0274bf35b0e3c3edbe72c91f4579fea762d048325ad
SSDEEP 24576:+ymRmNr0+UC7qP3v3z+tgnjiDQtHDK9ww94NHgIguS2:NMmajPvDlODQtO9T9cHW
MD5 SHA1 SHA512 SSDEEP

Submit Download

Im8XK3pr.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Im8XK3pr.exe
Size 1.0MB
SHA256 25411d508ec5124eaeb5f2cb705eb5fb60c09a6567be031f7575638dc4384225
MD5 2a3d9cd8e274d52f8240662cd5fd5350
SHA1 74af9e3bd9d20cbc4c909fa86be2d14c23022573
SHA512 d78ebaf21bb99394c91c589670331a20e78cc218e7f7bfd1a128afaee465443beb1f68bdd1e2a6bdf59ed0274bf35b0e3c3edbe72c91f4579fea762d048325ad
SSDEEP 24576:+ymRmNr0+UC7qP3v3z+tgnjiDQtHDK9ww94NHgIguS2:NMmajPvDlODQtO9T9cHW
MD5 SHA1 SHA512 SSDEEP

Submit Download

Fg3VW6yQ.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\Fg3VW6yQ.exe
Size 884KB
SHA256 2fe9a84781429606d73cae0dbb4db2859536f1506860c619bf2a08f0b55fc007
MD5 1255fa50845e549798a9687b653eabbb
SHA1 9f04249a8833ff7429da4b8cf3e758827454eeee
SHA512 9d258170870bab2bc8875f46b5d51b5c4c8d45eb619a0236b5df9215646ac79238f6db2c7025f330ebd87562d9ddc28967c5635de328977c6eead48350b4e13e
SSDEEP 24576:8yfnKA7q9PBdIdG/0+YAl5ixQeHVK9Vs9Bj/:rfnKNpBdIdG8W2xQeU9S99
MD5 SHA1 SHA512 SSDEEP

Submit Download

Fg3VW6yQ.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\Fg3VW6yQ.exe
Size 884KB
SHA256 2fe9a84781429606d73cae0dbb4db2859536f1506860c619bf2a08f0b55fc007
MD5 1255fa50845e549798a9687b653eabbb
SHA1 9f04249a8833ff7429da4b8cf3e758827454eeee
SHA512 9d258170870bab2bc8875f46b5d51b5c4c8d45eb619a0236b5df9215646ac79238f6db2c7025f330ebd87562d9ddc28967c5635de328977c6eead48350b4e13e
SSDEEP 24576:8yfnKA7q9PBdIdG/0+YAl5ixQeHVK9Vs9Bj/:rfnKNpBdIdG8W2xQeU9S99
MD5 SHA1 SHA512 SSDEEP

Submit Download

Ob2Ry3Kt.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\Ob2Ry3Kt.exe
Size 590KB
SHA256 9f0bd960f313ab8ce9da3b5fe94c6f9204554130e13dc953e55df8668d8cc9c7
MD5 5a121f586a75a6edca42d79451fb3360
SHA1 f33ba220f729b315d9e1845a7424ed4004c9d439
SHA512 04ee79e11e4e1fb2ae62eb8563972d11c4bd2c848edd739f0856af14ecedc49f14eb1eae0da23730dbb9c887a53bcb2657b714eb26fdcbf0478088841d84e7bb
SSDEEP 12288:BMrdy90fSNOubdQveU/V+VmHiErn6CLUD7F:YyKAdQGU/V+zyw
MD5 SHA1 SHA512 SSDEEP

Submit Download

Ob2Ry3Kt.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\Ob2Ry3Kt.exe
Size 590KB
SHA256 9f0bd960f313ab8ce9da3b5fe94c6f9204554130e13dc953e55df8668d8cc9c7
MD5 5a121f586a75a6edca42d79451fb3360
SHA1 f33ba220f729b315d9e1845a7424ed4004c9d439
SHA512 04ee79e11e4e1fb2ae62eb8563972d11c4bd2c848edd739f0856af14ecedc49f14eb1eae0da23730dbb9c887a53bcb2657b714eb26fdcbf0478088841d84e7bb
SSDEEP 12288:BMrdy90fSNOubdQveU/V+VmHiErn6CLUD7F:YyKAdQGU/V+zyw
MD5 SHA1 SHA512 SSDEEP

Submit Download

Ua1Of3ka.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\Ua1Of3ka.exe
Size 417KB
SHA256 a1b0471051ebff1d5687b86a670d419859f859a6bbabbc5fd3d20363e8e39c1c
MD5 6bbd597cdfdfc0d9b44c0f995d2d3e04
SHA1 28bc0d402e6e443f1ffadceba8bbb03d7de89c70
SHA512 72003318cfd8505dafe4fb27627aab9d7033973a048726172d4a89f5e49cc8ac47cd34fbe14615be2205508cbbae89c83d66cd07f824d4a4fecad53998605d2d
SSDEEP 6144:Kky+bnr+Cp0yN90QEY6uFCuzf8i/mEPtm+aiGEaC9c2fqLUk:EMriy906jCuLl/mEVm1iVrT6v
MD5 SHA1 SHA512 SSDEEP

Submit Download

Ua1Of3ka.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\Ua1Of3ka.exe
Size 417KB
SHA256 a1b0471051ebff1d5687b86a670d419859f859a6bbabbc5fd3d20363e8e39c1c
MD5 6bbd597cdfdfc0d9b44c0f995d2d3e04
SHA1 28bc0d402e6e443f1ffadceba8bbb03d7de89c70
SHA512 72003318cfd8505dafe4fb27627aab9d7033973a048726172d4a89f5e49cc8ac47cd34fbe14615be2205508cbbae89c83d66cd07f824d4a4fecad53998605d2d
SSDEEP 6144:Kky+bnr+Cp0yN90QEY6uFCuzf8i/mEPtm+aiGEaC9c2fqLUk:EMriy906jCuLl/mEVm1iVrT6v
MD5 SHA1 SHA512 SSDEEP

Submit Download

1uc05QX0.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\1uc05QX0.exe
Size 378KB
SHA256 8b00f9dce8ceb2123fba3bc9f88419960d1e661b6287eafeba4f0a2ee4be3d27
MD5 f0831f173733de08511f3a0739f278a6
SHA1 06dc809d653c5d2c97386084ae13b50a73eb5b60
SHA512 19e3176ce1f154758f685cc4582e93587aa534a251de315473e35758dcd6ff6315880be7602097308dc89c355742be4729bad81de597e8d430a8e868082314e3
SSDEEP 6144:u4nS392pCryG4kfjSGwEi56AO0GzrdyO78RanL1uOBKtFOqSjcQMjdpL0D:u4nk2wryNStHboR4/1tMj7oD
MD5 SHA1 SHA512 SSDEEP

Submit Download

1uc05QX0.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\1uc05QX0.exe
Size 378KB
SHA256 8b00f9dce8ceb2123fba3bc9f88419960d1e661b6287eafeba4f0a2ee4be3d27
MD5 f0831f173733de08511f3a0739f278a6
SHA1 06dc809d653c5d2c97386084ae13b50a73eb5b60
SHA512 19e3176ce1f154758f685cc4582e93587aa534a251de315473e35758dcd6ff6315880be7602097308dc89c355742be4729bad81de597e8d430a8e868082314e3
SSDEEP 6144:u4nS392pCryG4kfjSGwEi56AO0GzrdyO78RanL1uOBKtFOqSjcQMjdpL0D:u4nk2wryNStHboR4/1tMj7oD
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/4240-35-0x0000000000400000-0x0000000000428000-memory.dmp

Download

memory/4240-38-0x0000000000400000-0x0000000000428000-memory.dmp

Download

memory/4240-39-0x0000000000400000-0x0000000000428000-memory.dmp

Download

memory/4240-41-0x0000000000400000-0x0000000000428000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads