mystic | 761dfbeb1336a58ac2fca66ee5e28faf48817ecfe6fb3912159a950d30c24d47

General

Target

NEAS.761dfbeb1336a58ac2fca66ee5e28faf48817ecfe6fb3912159a950d30c24d47_JC.exe
Size

378KB
MD5

0442b7a9e592b1ed245f00b49c5d00e8
SHA1

5173c21fa23ba972e78802958260fca79bd52380
SHA256

761dfbeb1336a58ac2fca66ee5e28faf48817ecfe6fb3912159a950d30c24d47
SHA512

aa5185b7f1bb8c381e5ed4b00456cbb2270e812e9aed83772f4e05a27b823c8bb177dd34b6d42fa2ca9d0f563d7150bfd792f7fdef0624431e03a674025fbaf3
SSDEEP

6144:R4kS292pCryG4kfjSGwEi56AOFGg9bwglT3S5FFNDnUfl0D:R4k72wryNSygZwEW3nUf+D

Score

10^/10

Malware Config

Signatures

Detect Mystic stealer payload 6 IoCs

resource	yara_rule
behavioral1/memory/3000-7-0x0000000000400000-0x0000000000428000-memory.dmp	family_mystic
behavioral1/memory/3000-5-0x0000000000400000-0x0000000000428000-memory.dmp	family_mystic
behavioral1/memory/3000-4-0x0000000000400000-0x0000000000428000-memory.dmp	family_mystic
behavioral1/memory/3000-3-0x0000000000400000-0x0000000000428000-memory.dmp	family_mystic
behavioral1/memory/3000-9-0x0000000000400000-0x0000000000428000-memory.dmp	family_mystic
behavioral1/memory/3000-11-0x0000000000400000-0x0000000000428000-memory.dmp	family_mystic

Mystic
Mystic is an infostealer written in C++.
stealer mystic

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2228 set thread context of 3000	2228	NEAS.761dfbeb1336a58ac2fca66ee5e28faf48817ecfe6fb3912159a950d30c24d47_JC.exe	29

Program crash 2 IoCs

pid	pid_target	Process	procid_target
3068	2228	WerFault.exe	8
2272	3000	WerFault.exe	29

Suspicious use of WriteProcessMemory 25 IoCs

description	pid	Process	procid_target
PID 2228 wrote to memory of 3000	2228	NEAS.761dfbeb1336a58ac2fca66ee5e28faf48817ecfe6fb3912159a950d30c24d47_JC.exe	29
PID 2228 wrote to memory of 3000	2228	NEAS.761dfbeb1336a58ac2fca66ee5e28faf48817ecfe6fb3912159a950d30c24d47_JC.exe	29
PID 2228 wrote to memory of 3000	2228	NEAS.761dfbeb1336a58ac2fca66ee5e28faf48817ecfe6fb3912159a950d30c24d47_JC.exe	29
PID 2228 wrote to memory of 3000	2228	NEAS.761dfbeb1336a58ac2fca66ee5e28faf48817ecfe6fb3912159a950d30c24d47_JC.exe	29
PID 2228 wrote to memory of 3000	2228	NEAS.761dfbeb1336a58ac2fca66ee5e28faf48817ecfe6fb3912159a950d30c24d47_JC.exe	29
PID 2228 wrote to memory of 3000	2228	NEAS.761dfbeb1336a58ac2fca66ee5e28faf48817ecfe6fb3912159a950d30c24d47_JC.exe	29
PID 2228 wrote to memory of 3000	2228	NEAS.761dfbeb1336a58ac2fca66ee5e28faf48817ecfe6fb3912159a950d30c24d47_JC.exe	29
PID 2228 wrote to memory of 3000	2228	NEAS.761dfbeb1336a58ac2fca66ee5e28faf48817ecfe6fb3912159a950d30c24d47_JC.exe	29
PID 2228 wrote to memory of 3000	2228	NEAS.761dfbeb1336a58ac2fca66ee5e28faf48817ecfe6fb3912159a950d30c24d47_JC.exe	29
PID 2228 wrote to memory of 3000	2228	NEAS.761dfbeb1336a58ac2fca66ee5e28faf48817ecfe6fb3912159a950d30c24d47_JC.exe	29
PID 2228 wrote to memory of 3000	2228	NEAS.761dfbeb1336a58ac2fca66ee5e28faf48817ecfe6fb3912159a950d30c24d47_JC.exe	29
PID 2228 wrote to memory of 3000	2228	NEAS.761dfbeb1336a58ac2fca66ee5e28faf48817ecfe6fb3912159a950d30c24d47_JC.exe	29
PID 2228 wrote to memory of 3000	2228	NEAS.761dfbeb1336a58ac2fca66ee5e28faf48817ecfe6fb3912159a950d30c24d47_JC.exe	29
PID 2228 wrote to memory of 3000	2228	NEAS.761dfbeb1336a58ac2fca66ee5e28faf48817ecfe6fb3912159a950d30c24d47_JC.exe	29
PID 2228 wrote to memory of 3068	2228	NEAS.761dfbeb1336a58ac2fca66ee5e28faf48817ecfe6fb3912159a950d30c24d47_JC.exe	30
PID 2228 wrote to memory of 3068	2228	NEAS.761dfbeb1336a58ac2fca66ee5e28faf48817ecfe6fb3912159a950d30c24d47_JC.exe	30
PID 2228 wrote to memory of 3068	2228	NEAS.761dfbeb1336a58ac2fca66ee5e28faf48817ecfe6fb3912159a950d30c24d47_JC.exe	30
PID 2228 wrote to memory of 3068	2228	NEAS.761dfbeb1336a58ac2fca66ee5e28faf48817ecfe6fb3912159a950d30c24d47_JC.exe	30
PID 3000 wrote to memory of 2272	3000	AppLaunch.exe	31
PID 3000 wrote to memory of 2272	3000	AppLaunch.exe	31
PID 3000 wrote to memory of 2272	3000	AppLaunch.exe	31
PID 3000 wrote to memory of 2272	3000	AppLaunch.exe	31
PID 3000 wrote to memory of 2272	3000	AppLaunch.exe	31
PID 3000 wrote to memory of 2272	3000	AppLaunch.exe	31
PID 3000 wrote to memory of 2272	3000	AppLaunch.exe	31

C:\Users\Admin\AppData\Local\Temp\NEAS.761dfbeb1336a58ac2fca66ee5e28faf48817ecfe6fb3912159a950d30c24d47_JC.exe
"C:\Users\Admin\AppData\Local\Temp\NEAS.761dfbeb1336a58ac2fca66ee5e28faf48817ecfe6fb3912159a950d30c24d47_JC.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2228
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3000
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3000 -s 196
    3⤵
    - Program crash
    PID:2272
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2228 -s 136
  2⤵
  - Program crash
  PID:3068

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3000-1-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/3000-6-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmp

Filesize
4KB

Download
memory/3000-7-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/3000-5-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/3000-4-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/3000-3-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/3000-2-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/3000-0-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/3000-9-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/3000-11-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads