mystic | 363f711e611b3870d7bc5b3bf6477f32a0e78ffe3fbc5a420e02055e50071485

General

Target

363f711e611b3870d7bc5b3bf6477f32a0e78ffe3fbc5a420e02055e50071485.exe
Size

356KB
MD5

aaab16a952844e0447db787a3a731cd5
SHA1

5738691395cf05159a6de127616a389ad69a832b
SHA256

363f711e611b3870d7bc5b3bf6477f32a0e78ffe3fbc5a420e02055e50071485
SHA512

2b7c18ee273352c2864d96bfceed8ead8dc8aaf7304841dd1c7b13e3bdbc2cd3d388d60734c59b73f7f59e6ed88a6f418b8ead7c38d2ac77514726d89907c057
SSDEEP

6144:TNXTeW/s5GqrO5aXnfEGIXWPvZAOcyRkEboPN22KprfZe2S+E95HEy0YzXtYVs0z:QmcGqrOk86xp9pe2S+E95Ey0YzX+s0Bl

Score

10^/10

Malware Config

Signatures

Detect Mystic stealer payload 6 IoCs

resource	yara_rule
behavioral1/memory/2360-4-0x0000000000400000-0x0000000000428000-memory.dmp	family_mystic
behavioral1/memory/2360-3-0x0000000000400000-0x0000000000428000-memory.dmp	family_mystic
behavioral1/memory/2360-5-0x0000000000400000-0x0000000000428000-memory.dmp	family_mystic
behavioral1/memory/2360-7-0x0000000000400000-0x0000000000428000-memory.dmp	family_mystic
behavioral1/memory/2360-9-0x0000000000400000-0x0000000000428000-memory.dmp	family_mystic
behavioral1/memory/2360-11-0x0000000000400000-0x0000000000428000-memory.dmp	family_mystic

Mystic
Mystic is an infostealer written in C++.
stealer mystic

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 272 set thread context of 2360	272	363f711e611b3870d7bc5b3bf6477f32a0e78ffe3fbc5a420e02055e50071485.exe	29

Program crash 2 IoCs

pid	pid_target	Process	procid_target
1596	2360	WerFault.exe	29
2544	272	WerFault.exe	17

Suspicious use of WriteProcessMemory 25 IoCs

description	pid	Process	procid_target
PID 272 wrote to memory of 2360	272	363f711e611b3870d7bc5b3bf6477f32a0e78ffe3fbc5a420e02055e50071485.exe	29
PID 272 wrote to memory of 2360	272	363f711e611b3870d7bc5b3bf6477f32a0e78ffe3fbc5a420e02055e50071485.exe	29
PID 272 wrote to memory of 2360	272	363f711e611b3870d7bc5b3bf6477f32a0e78ffe3fbc5a420e02055e50071485.exe	29
PID 272 wrote to memory of 2360	272	363f711e611b3870d7bc5b3bf6477f32a0e78ffe3fbc5a420e02055e50071485.exe	29
PID 272 wrote to memory of 2360	272	363f711e611b3870d7bc5b3bf6477f32a0e78ffe3fbc5a420e02055e50071485.exe	29
PID 272 wrote to memory of 2360	272	363f711e611b3870d7bc5b3bf6477f32a0e78ffe3fbc5a420e02055e50071485.exe	29
PID 272 wrote to memory of 2360	272	363f711e611b3870d7bc5b3bf6477f32a0e78ffe3fbc5a420e02055e50071485.exe	29
PID 272 wrote to memory of 2360	272	363f711e611b3870d7bc5b3bf6477f32a0e78ffe3fbc5a420e02055e50071485.exe	29
PID 272 wrote to memory of 2360	272	363f711e611b3870d7bc5b3bf6477f32a0e78ffe3fbc5a420e02055e50071485.exe	29
PID 272 wrote to memory of 2360	272	363f711e611b3870d7bc5b3bf6477f32a0e78ffe3fbc5a420e02055e50071485.exe	29
PID 272 wrote to memory of 2360	272	363f711e611b3870d7bc5b3bf6477f32a0e78ffe3fbc5a420e02055e50071485.exe	29
PID 272 wrote to memory of 2360	272	363f711e611b3870d7bc5b3bf6477f32a0e78ffe3fbc5a420e02055e50071485.exe	29
PID 272 wrote to memory of 2360	272	363f711e611b3870d7bc5b3bf6477f32a0e78ffe3fbc5a420e02055e50071485.exe	29
PID 272 wrote to memory of 2360	272	363f711e611b3870d7bc5b3bf6477f32a0e78ffe3fbc5a420e02055e50071485.exe	29
PID 272 wrote to memory of 2544	272	363f711e611b3870d7bc5b3bf6477f32a0e78ffe3fbc5a420e02055e50071485.exe	33
PID 272 wrote to memory of 2544	272	363f711e611b3870d7bc5b3bf6477f32a0e78ffe3fbc5a420e02055e50071485.exe	33
PID 272 wrote to memory of 2544	272	363f711e611b3870d7bc5b3bf6477f32a0e78ffe3fbc5a420e02055e50071485.exe	33
PID 272 wrote to memory of 2544	272	363f711e611b3870d7bc5b3bf6477f32a0e78ffe3fbc5a420e02055e50071485.exe	33
PID 2360 wrote to memory of 1596	2360	AppLaunch.exe	32
PID 2360 wrote to memory of 1596	2360	AppLaunch.exe	32
PID 2360 wrote to memory of 1596	2360	AppLaunch.exe	32
PID 2360 wrote to memory of 1596	2360	AppLaunch.exe	32
PID 2360 wrote to memory of 1596	2360	AppLaunch.exe	32
PID 2360 wrote to memory of 1596	2360	AppLaunch.exe	32
PID 2360 wrote to memory of 1596	2360	AppLaunch.exe	32

C:\Users\Admin\AppData\Local\Temp\363f711e611b3870d7bc5b3bf6477f32a0e78ffe3fbc5a420e02055e50071485.exe
"C:\Users\Admin\AppData\Local\Temp\363f711e611b3870d7bc5b3bf6477f32a0e78ffe3fbc5a420e02055e50071485.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:272
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2360
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2360 -s 196
    3⤵
    - Program crash
    PID:1596
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 272 -s 76
  2⤵
  - Program crash
  PID:2544

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2360-0-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/2360-1-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/2360-2-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/2360-4-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/2360-3-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/2360-5-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/2360-6-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmp

Filesize
4KB

Download
memory/2360-7-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/2360-9-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/2360-11-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads