mystic | 999d43ee4c9a1ec38c0b00fc38abe0b29b13cc83983c6ee895cbb2768b29022d

Analysis

max time kernel
122s
max time network
130s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
07-10-2023 08:33

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

e3a0367cf2ebe9a41c5972ce3e53c1eb89d81fa01d1fe3e29ecca89af8f5a802.exe
Size

356KB
MD5

eee483531e1ad411935f8d345d9492c8
SHA1

c7f69aade6bce67a54c768b6ee078fb3b294ce5c
SHA256

e3a0367cf2ebe9a41c5972ce3e53c1eb89d81fa01d1fe3e29ecca89af8f5a802
SHA512

a5fdff2635a23b4c75b25e4c65873fbf7a15f54ebee6f258066f6d958dc308760c55a2f8803bcb4c3ccbc375d123c40598a2dbb82e197b91b3ad6941dd1fbca2
SSDEEP

6144:UETeW/s5GqrO5aXnfEGIXWPvZAOXyftjXQTUr5cA72b857mML2GVs0BC+:cmcGqrOk86xutjXQTDjb8D/s0BC+

Score

10^/10

mystic stealer

Malware Config

Signatures

Detect Mystic stealer payload 6 IoCs

Processes:

resource	yara_rule
behavioral30/memory/2832-3-0x0000000000400000-0x0000000000428000-memory.dmp	family_mystic
behavioral30/memory/2832-4-0x0000000000400000-0x0000000000428000-memory.dmp	family_mystic
behavioral30/memory/2832-5-0x0000000000400000-0x0000000000428000-memory.dmp	family_mystic
behavioral30/memory/2832-7-0x0000000000400000-0x0000000000428000-memory.dmp	family_mystic
behavioral30/memory/2832-9-0x0000000000400000-0x0000000000428000-memory.dmp	family_mystic
behavioral30/memory/2832-11-0x0000000000400000-0x0000000000428000-memory.dmp	family_mystic

Mystic
Mystic is an infostealer written in C++.
stealer mystic

Suspicious use of SetThreadContext 1 IoCs

Processes:

e3a0367cf2ebe9a41c5972ce3e53c1eb89d81fa01d1fe3e29ecca89af8f5a802.exe

description	pid	process	target process
PID 2120 set thread context of 2832	2120	e3a0367cf2ebe9a41c5972ce3e53c1eb89d81fa01d1fe3e29ecca89af8f5a802.exe	AppLaunch.exe

Program crash 2 IoCs

Processes:

WerFault.exeWerFault.exe

pid	pid_target	process	target process
2840	2120	WerFault.exe	e3a0367cf2ebe9a41c5972ce3e53c1eb89d81fa01d1fe3e29ecca89af8f5a802.exe
2700	2832	WerFault.exe	AppLaunch.exe

Suspicious use of WriteProcessMemory 25 IoCs

Processes:

e3a0367cf2ebe9a41c5972ce3e53c1eb89d81fa01d1fe3e29ecca89af8f5a802.exeAppLaunch.exe

description	pid	process	target process
PID 2120 wrote to memory of 2832	2120	e3a0367cf2ebe9a41c5972ce3e53c1eb89d81fa01d1fe3e29ecca89af8f5a802.exe	AppLaunch.exe
PID 2120 wrote to memory of 2832	2120	e3a0367cf2ebe9a41c5972ce3e53c1eb89d81fa01d1fe3e29ecca89af8f5a802.exe	AppLaunch.exe
PID 2120 wrote to memory of 2832	2120	e3a0367cf2ebe9a41c5972ce3e53c1eb89d81fa01d1fe3e29ecca89af8f5a802.exe	AppLaunch.exe
PID 2120 wrote to memory of 2832	2120	e3a0367cf2ebe9a41c5972ce3e53c1eb89d81fa01d1fe3e29ecca89af8f5a802.exe	AppLaunch.exe
PID 2120 wrote to memory of 2832	2120	e3a0367cf2ebe9a41c5972ce3e53c1eb89d81fa01d1fe3e29ecca89af8f5a802.exe	AppLaunch.exe
PID 2120 wrote to memory of 2832	2120	e3a0367cf2ebe9a41c5972ce3e53c1eb89d81fa01d1fe3e29ecca89af8f5a802.exe	AppLaunch.exe
PID 2120 wrote to memory of 2832	2120	e3a0367cf2ebe9a41c5972ce3e53c1eb89d81fa01d1fe3e29ecca89af8f5a802.exe	AppLaunch.exe
PID 2120 wrote to memory of 2832	2120	e3a0367cf2ebe9a41c5972ce3e53c1eb89d81fa01d1fe3e29ecca89af8f5a802.exe	AppLaunch.exe
PID 2120 wrote to memory of 2832	2120	e3a0367cf2ebe9a41c5972ce3e53c1eb89d81fa01d1fe3e29ecca89af8f5a802.exe	AppLaunch.exe
PID 2120 wrote to memory of 2832	2120	e3a0367cf2ebe9a41c5972ce3e53c1eb89d81fa01d1fe3e29ecca89af8f5a802.exe	AppLaunch.exe
PID 2120 wrote to memory of 2832	2120	e3a0367cf2ebe9a41c5972ce3e53c1eb89d81fa01d1fe3e29ecca89af8f5a802.exe	AppLaunch.exe
PID 2120 wrote to memory of 2832	2120	e3a0367cf2ebe9a41c5972ce3e53c1eb89d81fa01d1fe3e29ecca89af8f5a802.exe	AppLaunch.exe
PID 2120 wrote to memory of 2832	2120	e3a0367cf2ebe9a41c5972ce3e53c1eb89d81fa01d1fe3e29ecca89af8f5a802.exe	AppLaunch.exe
PID 2120 wrote to memory of 2832	2120	e3a0367cf2ebe9a41c5972ce3e53c1eb89d81fa01d1fe3e29ecca89af8f5a802.exe	AppLaunch.exe
PID 2120 wrote to memory of 2840	2120	e3a0367cf2ebe9a41c5972ce3e53c1eb89d81fa01d1fe3e29ecca89af8f5a802.exe	WerFault.exe
PID 2120 wrote to memory of 2840	2120	e3a0367cf2ebe9a41c5972ce3e53c1eb89d81fa01d1fe3e29ecca89af8f5a802.exe	WerFault.exe
PID 2120 wrote to memory of 2840	2120	e3a0367cf2ebe9a41c5972ce3e53c1eb89d81fa01d1fe3e29ecca89af8f5a802.exe	WerFault.exe
PID 2120 wrote to memory of 2840	2120	e3a0367cf2ebe9a41c5972ce3e53c1eb89d81fa01d1fe3e29ecca89af8f5a802.exe	WerFault.exe
PID 2832 wrote to memory of 2700	2832	AppLaunch.exe	WerFault.exe
PID 2832 wrote to memory of 2700	2832	AppLaunch.exe	WerFault.exe
PID 2832 wrote to memory of 2700	2832	AppLaunch.exe	WerFault.exe
PID 2832 wrote to memory of 2700	2832	AppLaunch.exe	WerFault.exe
PID 2832 wrote to memory of 2700	2832	AppLaunch.exe	WerFault.exe
PID 2832 wrote to memory of 2700	2832	AppLaunch.exe	WerFault.exe
PID 2832 wrote to memory of 2700	2832	AppLaunch.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\e3a0367cf2ebe9a41c5972ce3e53c1eb89d81fa01d1fe3e29ecca89af8f5a802.exe
"C:\Users\Admin\AppData\Local\Temp\e3a0367cf2ebe9a41c5972ce3e53c1eb89d81fa01d1fe3e29ecca89af8f5a802.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2120

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
2⤵
- Suspicious use of WriteProcessMemory
PID:2832

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2832 -s 196
3⤵
- Program crash
PID:2700

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2120 -s 76
2⤵
- Program crash
PID:2840

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2832-0-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/2832-1-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/2832-2-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/2832-3-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/2832-4-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/2832-5-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/2832-6-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmp

Filesize
4KB

Download
memory/2832-7-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/2832-9-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/2832-11-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads