mystic | fd7565a625d52cfe43b6fa6391939d2dcf996d0b4f7174d32d6153e677bc4fbd

Analysis

max time kernel
125s
max time network
132s
platform
windows10-1703_x64
resource
win10-20230915-en
resource tags

arch:x64arch:x86image:win10-20230915-enlocale:en-usos:windows10-1703-x64system
submitted
07/10/2023, 18:40

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
fd7565a625d52cfe43b6fa6391939d2dcf996d0b4f7174d32d6153e677bc4fbd.exe
Size 1.2MB
Sample231007-xbbwtsed7y
SHA256 fd7565a625d52cfe43b6fa6391939d2dcf996d0b4f7174d32d6153e677bc4fbd
MD5 51617d0252f2293779dcb442d2c18da9
SHA1 448cfad02a3f8e6802c07723d12d7673e7b29242
SHA512 7e20900b5419e89879713df45f4374f31f538c9d319a7a1dc997b3a11978fe735504f12432a592716ef76115e98d93c9f27cc35a465170c0587ff6dd51b547f6
SSDEEP 24576:8yxwKTfgY0ZBN9mnOM9mYAcr/HTmfM8AjTBdnOg4DQmOg/+7rKIUSIUlGIjTpZrt:ray/0vNo8YLr/z/dnOPdOyQrKIt/l
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

mystic persistence stealer

Malware Config

Signatures

Detect Mystic stealer payload 4 IoCs

resource	yara_rule
behavioral1/memory/4356-35-0x0000000000400000-0x0000000000428000-memory.dmp	family_mystic
behavioral1/memory/4356-38-0x0000000000400000-0x0000000000428000-memory.dmp	family_mystic
behavioral1/memory/4356-39-0x0000000000400000-0x0000000000428000-memory.dmp	family_mystic
behavioral1/memory/4356-41-0x0000000000400000-0x0000000000428000-memory.dmp	family_mystic

Mystic
Mystic is an infostealer written in C++.
stealer mystic

Executes dropped EXE 5 IoCs

pid	Process
3632	LA0Hq6wP.exe
4200	np4Ap8OW.exe
4652	Kk1qb4KP.exe
4472	zk2NL4qW.exe
2832	1wx18Oy0.exe

Adds Run key to start application 2 TTPs 5 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	fd7565a625d52cfe43b6fa6391939d2dcf996d0b4f7174d32d6153e677bc4fbd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	LA0Hq6wP.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\""	np4Ap8OW.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup3 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP003.TMP\\\""	Kk1qb4KP.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup4 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP004.TMP\\\""	zk2NL4qW.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2832 set thread context of 4356	2832	1wx18Oy0.exe	78

Program crash 2 IoCs

pid	pid_target	Process	procid_target
5008	2832	WerFault.exe	74
3640	4356	WerFault.exe	78

Suspicious use of WriteProcessMemory 31 IoCs

description	pid	Process	procid_target
PID 4460 wrote to memory of 3632	4460	fd7565a625d52cfe43b6fa6391939d2dcf996d0b4f7174d32d6153e677bc4fbd.exe	70
PID 4460 wrote to memory of 3632	4460	fd7565a625d52cfe43b6fa6391939d2dcf996d0b4f7174d32d6153e677bc4fbd.exe	70
PID 4460 wrote to memory of 3632	4460	fd7565a625d52cfe43b6fa6391939d2dcf996d0b4f7174d32d6153e677bc4fbd.exe	70
PID 3632 wrote to memory of 4200	3632	LA0Hq6wP.exe	71
PID 3632 wrote to memory of 4200	3632	LA0Hq6wP.exe	71
PID 3632 wrote to memory of 4200	3632	LA0Hq6wP.exe	71
PID 4200 wrote to memory of 4652	4200	np4Ap8OW.exe	72
PID 4200 wrote to memory of 4652	4200	np4Ap8OW.exe	72
PID 4200 wrote to memory of 4652	4200	np4Ap8OW.exe	72
PID 4652 wrote to memory of 4472	4652	Kk1qb4KP.exe	73
PID 4652 wrote to memory of 4472	4652	Kk1qb4KP.exe	73
PID 4652 wrote to memory of 4472	4652	Kk1qb4KP.exe	73
PID 4472 wrote to memory of 2832	4472	zk2NL4qW.exe	74
PID 4472 wrote to memory of 2832	4472	zk2NL4qW.exe	74
PID 4472 wrote to memory of 2832	4472	zk2NL4qW.exe	74
PID 2832 wrote to memory of 3528	2832	1wx18Oy0.exe	76
PID 2832 wrote to memory of 3528	2832	1wx18Oy0.exe	76
PID 2832 wrote to memory of 3528	2832	1wx18Oy0.exe	76
PID 2832 wrote to memory of 1740	2832	1wx18Oy0.exe	77
PID 2832 wrote to memory of 1740	2832	1wx18Oy0.exe	77
PID 2832 wrote to memory of 1740	2832	1wx18Oy0.exe	77
PID 2832 wrote to memory of 4356	2832	1wx18Oy0.exe	78
PID 2832 wrote to memory of 4356	2832	1wx18Oy0.exe	78
PID 2832 wrote to memory of 4356	2832	1wx18Oy0.exe	78
PID 2832 wrote to memory of 4356	2832	1wx18Oy0.exe	78
PID 2832 wrote to memory of 4356	2832	1wx18Oy0.exe	78
PID 2832 wrote to memory of 4356	2832	1wx18Oy0.exe	78
PID 2832 wrote to memory of 4356	2832	1wx18Oy0.exe	78
PID 2832 wrote to memory of 4356	2832	1wx18Oy0.exe	78
PID 2832 wrote to memory of 4356	2832	1wx18Oy0.exe	78
PID 2832 wrote to memory of 4356	2832	1wx18Oy0.exe	78

C:\Users\Admin\AppData\Local\Temp\fd7565a625d52cfe43b6fa6391939d2dcf996d0b4f7174d32d6153e677bc4fbd.exe
"C:\Users\Admin\AppData\Local\Temp\fd7565a625d52cfe43b6fa6391939d2dcf996d0b4f7174d32d6153e677bc4fbd.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4460
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\LA0Hq6wP.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\LA0Hq6wP.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:3632
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\np4Ap8OW.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\np4Ap8OW.exe
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Suspicious use of WriteProcessMemory
    PID:4200
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\Kk1qb4KP.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\Kk1qb4KP.exe
      4⤵
      Executes dropped EXE
      Adds Run key to start application
      Suspicious use of WriteProcessMemory
      PID:4652
    - - C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\zk2NL4qW.exe
        
        C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\zk2NL4qW.exe
        5⤵
        Executes dropped EXE
        Adds Run key to start application
        Suspicious use of WriteProcessMemory
        
        PID:4472
      - C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\1wx18Oy0.exe
        
        C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\1wx18Oy0.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Suspicious use of WriteProcessMemory
        
        PID:2832
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
        7⤵
        
        PID:3528
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
        7⤵
        
        PID:1740
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
        7⤵
        
        PID:4356
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4356 -s 568
        8⤵
        Program crash
        
        PID:3640
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2832 -s 604
        7⤵
        Program crash
        
        PID:5008

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

LA0Hq6wP.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\LA0Hq6wP.exe
Size 1.0MB
SHA256 2c3cbe932f684a512c508e6be20518635d67ed0605618c50120c2349ce8d1053
MD5 1b198bc20a9ad01ad2b5e22a434d2e99
SHA1 3b9248099fd18ac9b0e4813e850aa775ad4ccda3
SHA512 cd34d360bfcb00113ac61d248ed39bb99f3d719bde2e06e24c6e0bb63d10f330a6c589142f2cb1c771fa0959c681e32225086b8e63b102752f3ccfba42abb3e4
SSDEEP 24576:9yiaa9kn8a9eYAEr/Hrc3g8ANH+dFGgCh5mOV/+y6KwKv2KGlmIjo:Yi9e0YHr/LWdFGVaOR56KwPKGl
MD5 SHA1 SHA512 SSDEEP

Submit Download

LA0Hq6wP.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\LA0Hq6wP.exe
Size 1.0MB
SHA256 2c3cbe932f684a512c508e6be20518635d67ed0605618c50120c2349ce8d1053
MD5 1b198bc20a9ad01ad2b5e22a434d2e99
SHA1 3b9248099fd18ac9b0e4813e850aa775ad4ccda3
SHA512 cd34d360bfcb00113ac61d248ed39bb99f3d719bde2e06e24c6e0bb63d10f330a6c589142f2cb1c771fa0959c681e32225086b8e63b102752f3ccfba42abb3e4
SSDEEP 24576:9yiaa9kn8a9eYAEr/Hrc3g8ANH+dFGgCh5mOV/+y6KwKv2KGlmIjo:Yi9e0YHr/LWdFGVaOR56KwPKGl
MD5 SHA1 SHA512 SSDEEP

Submit Download

np4Ap8OW.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\np4Ap8OW.exe
Size 879KB
SHA256 c79aea786ea9c7925bfee0fb6798c6a7494fe6b539c525225cc880b5afa6a3ae
MD5 c451a64099530672d0b0971638862e2f
SHA1 2e352947bbbbc0829664676867fd1f195a1a97b3
SHA512 eebeec10aa3d881736a4ecbb9b01779f03083922c1616f6965461f6c884000ab7cc6b9dfc956bf0fb25d0d1a5f8a955fea29194d82f2eadf1f315d46be363ff4
SSDEEP 24576:zyvM9LYAEr/HZhIV8AyNod4ngCrJmgVr+ZKKrS+AK+:GuYHr/5Qd4nV8gxCKKrMK
MD5 SHA1 SHA512 SSDEEP

Submit Download

np4Ap8OW.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\np4Ap8OW.exe
Size 879KB
SHA256 c79aea786ea9c7925bfee0fb6798c6a7494fe6b539c525225cc880b5afa6a3ae
MD5 c451a64099530672d0b0971638862e2f
SHA1 2e352947bbbbc0829664676867fd1f195a1a97b3
SHA512 eebeec10aa3d881736a4ecbb9b01779f03083922c1616f6965461f6c884000ab7cc6b9dfc956bf0fb25d0d1a5f8a955fea29194d82f2eadf1f315d46be363ff4
SSDEEP 24576:zyvM9LYAEr/HZhIV8AyNod4ngCrJmgVr+ZKKrS+AK+:GuYHr/5Qd4nV8gxCKKrMK
MD5 SHA1 SHA512 SSDEEP

Submit Download

Kk1qb4KP.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\Kk1qb4KP.exe
Size 585KB
SHA256 103ed73550294f2d1e3a1d2f3661961d3ce445d2c8fbc2054665ea42dab35e34
MD5 53c0009d9422f56d792de2a38fbd1712
SHA1 6ca5b7d3db3bbc868baaedd7fa2dd98646d37b8f
SHA512 aa19d299e6e9c9fe78ac1fc0c15759c829f3d1efe70378f4a39de88e6bce5cc211d3bcf365544cb4d68d305c84132f135cb7612d7fb529cf928c7210609d19a7
SSDEEP 12288:BMr5y90AsX9CZiAu49l8A20NiRowdo0WvgCF1rWKy:4yZ09CZdn8ALifdbsgCS9
MD5 SHA1 SHA512 SSDEEP

Submit Download

Kk1qb4KP.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\Kk1qb4KP.exe
Size 585KB
SHA256 103ed73550294f2d1e3a1d2f3661961d3ce445d2c8fbc2054665ea42dab35e34
MD5 53c0009d9422f56d792de2a38fbd1712
SHA1 6ca5b7d3db3bbc868baaedd7fa2dd98646d37b8f
SHA512 aa19d299e6e9c9fe78ac1fc0c15759c829f3d1efe70378f4a39de88e6bce5cc211d3bcf365544cb4d68d305c84132f135cb7612d7fb529cf928c7210609d19a7
SSDEEP 12288:BMr5y90AsX9CZiAu49l8A20NiRowdo0WvgCF1rWKy:4yZ09CZdn8ALifdbsgCS9
MD5 SHA1 SHA512 SSDEEP

Submit Download

zk2NL4qW.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\zk2NL4qW.exe
Size 412KB
SHA256 abcbdcfa1bb45f3ae9a23a34b921cf3ec8966500cafdacca993a412d195e2f94
MD5 9d2157fa5c31b7bf729d43ae4fa65269
SHA1 2edc60df4844d5ad0eb4f00ac63cd0643053b1bf
SHA512 670a44d9e3b41b7266093df437d0227ed6e9952052349327bf98037e43b797f28e7a47ebac86f57671f81849e7d97311b06d86d0d3aba7ac9777f15268e10227
SSDEEP 6144:K6y+bnr+vp0yN90QE9utJFaezX8uGol3Fh+Nuk3A/bwdzAbECxGw9jL:aMrXy90/uhfX8H22Nukowd8J3L
MD5 SHA1 SHA512 SSDEEP

Submit Download

zk2NL4qW.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\zk2NL4qW.exe
Size 412KB
SHA256 abcbdcfa1bb45f3ae9a23a34b921cf3ec8966500cafdacca993a412d195e2f94
MD5 9d2157fa5c31b7bf729d43ae4fa65269
SHA1 2edc60df4844d5ad0eb4f00ac63cd0643053b1bf
SHA512 670a44d9e3b41b7266093df437d0227ed6e9952052349327bf98037e43b797f28e7a47ebac86f57671f81849e7d97311b06d86d0d3aba7ac9777f15268e10227
SSDEEP 6144:K6y+bnr+vp0yN90QE9utJFaezX8uGol3Fh+Nuk3A/bwdzAbECxGw9jL:aMrXy90/uhfX8H22Nukowd8J3L
MD5 SHA1 SHA512 SSDEEP

Submit Download

1wx18Oy0.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\1wx18Oy0.exe
Size 378KB
SHA256 bd0cb98cfc807abf3e2418868e6e9d16a3021a1c2875f8eb0ec7c7f454b6415c
MD5 c7ef55e3b866da369dceeffcbec35070
SHA1 587d78319f738e85416443f130fc1c29e8e316a7
SHA512 a5606f6108f06e603ba6ec18d6c7295548bad8d0722e34a7ec45f73666d8b37fd40dbe757cd3cb10da19d4e6009b3fce022245033c812a0588a863937349cc1d
SSDEEP 6144:x4mSV92pCryG4kfjSGwEi56AOVG7aqQZ/aldhAb8R3GK0+pa30D:x4m+2wryNSe7bQZ/aAYN0+YED
MD5 SHA1 SHA512 SSDEEP

Submit Download

1wx18Oy0.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\1wx18Oy0.exe
Size 378KB
SHA256 bd0cb98cfc807abf3e2418868e6e9d16a3021a1c2875f8eb0ec7c7f454b6415c
MD5 c7ef55e3b866da369dceeffcbec35070
SHA1 587d78319f738e85416443f130fc1c29e8e316a7
SHA512 a5606f6108f06e603ba6ec18d6c7295548bad8d0722e34a7ec45f73666d8b37fd40dbe757cd3cb10da19d4e6009b3fce022245033c812a0588a863937349cc1d
SSDEEP 6144:x4mSV92pCryG4kfjSGwEi56AOVG7aqQZ/aldhAb8R3GK0+pa30D:x4m+2wryNSe7bQZ/aAYN0+YED
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/4356-35-0x0000000000400000-0x0000000000428000-memory.dmp

Download

memory/4356-38-0x0000000000400000-0x0000000000428000-memory.dmp

Download

memory/4356-39-0x0000000000400000-0x0000000000428000-memory.dmp

Download

memory/4356-41-0x0000000000400000-0x0000000000428000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads