mystic | 21df3450742709214c8f330f87956d5e871816eb9cdbcf503c49786651c4d6b8

General

Target

21df3450742709214c8f330f87956d5e871816eb9cdbcf503c49786651c4d6b8.exe
Size

276KB
MD5

7a8fb035790633a8ae8894441fbe8775
SHA1

b7b316bf93045e82e8755c3b819f49c8fa44ba9c
SHA256

21df3450742709214c8f330f87956d5e871816eb9cdbcf503c49786651c4d6b8
SHA512

780cae83aad071492b817043f2d43d369633f34413d782146480eeeaae05933cdebae89a31867d3ec6185fbc7a9b24f70a6814835c2ac4b42c21a16636ae1bda
SSDEEP

3072:WhVUoyoyi7Re9jWW4Vu6106vOiIPMoCT7NxH/F3EPVYtoz6HyWzybWMQMlB2mlIZ:Whe/KajWpVP06ffH/FEpWz2hIvPpTrj

Score

10^/10

Malware Config

Signatures

Detect Mystic stealer payload 6 IoCs

resource	yara_rule
behavioral1/memory/2528-3-0x0000000000400000-0x0000000000428000-memory.dmp	family_mystic
behavioral1/memory/2528-4-0x0000000000400000-0x0000000000428000-memory.dmp	family_mystic
behavioral1/memory/2528-5-0x0000000000400000-0x0000000000428000-memory.dmp	family_mystic
behavioral1/memory/2528-7-0x0000000000400000-0x0000000000428000-memory.dmp	family_mystic
behavioral1/memory/2528-9-0x0000000000400000-0x0000000000428000-memory.dmp	family_mystic
behavioral1/memory/2528-11-0x0000000000400000-0x0000000000428000-memory.dmp	family_mystic

Mystic
Mystic is an infostealer written in C++.
stealer mystic

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2348 set thread context of 2528	2348	21df3450742709214c8f330f87956d5e871816eb9cdbcf503c49786651c4d6b8.exe	29

Program crash 2 IoCs

pid	pid_target	Process	procid_target
2732	2348	WerFault.exe	27
2708	2528	WerFault.exe	29

Suspicious use of WriteProcessMemory 25 IoCs

description	pid	Process	procid_target
PID 2348 wrote to memory of 2528	2348	21df3450742709214c8f330f87956d5e871816eb9cdbcf503c49786651c4d6b8.exe	29
PID 2348 wrote to memory of 2528	2348	21df3450742709214c8f330f87956d5e871816eb9cdbcf503c49786651c4d6b8.exe	29
PID 2348 wrote to memory of 2528	2348	21df3450742709214c8f330f87956d5e871816eb9cdbcf503c49786651c4d6b8.exe	29
PID 2348 wrote to memory of 2528	2348	21df3450742709214c8f330f87956d5e871816eb9cdbcf503c49786651c4d6b8.exe	29
PID 2348 wrote to memory of 2528	2348	21df3450742709214c8f330f87956d5e871816eb9cdbcf503c49786651c4d6b8.exe	29
PID 2348 wrote to memory of 2528	2348	21df3450742709214c8f330f87956d5e871816eb9cdbcf503c49786651c4d6b8.exe	29
PID 2348 wrote to memory of 2528	2348	21df3450742709214c8f330f87956d5e871816eb9cdbcf503c49786651c4d6b8.exe	29
PID 2348 wrote to memory of 2528	2348	21df3450742709214c8f330f87956d5e871816eb9cdbcf503c49786651c4d6b8.exe	29
PID 2348 wrote to memory of 2528	2348	21df3450742709214c8f330f87956d5e871816eb9cdbcf503c49786651c4d6b8.exe	29
PID 2348 wrote to memory of 2528	2348	21df3450742709214c8f330f87956d5e871816eb9cdbcf503c49786651c4d6b8.exe	29
PID 2348 wrote to memory of 2528	2348	21df3450742709214c8f330f87956d5e871816eb9cdbcf503c49786651c4d6b8.exe	29
PID 2348 wrote to memory of 2528	2348	21df3450742709214c8f330f87956d5e871816eb9cdbcf503c49786651c4d6b8.exe	29
PID 2348 wrote to memory of 2528	2348	21df3450742709214c8f330f87956d5e871816eb9cdbcf503c49786651c4d6b8.exe	29
PID 2348 wrote to memory of 2528	2348	21df3450742709214c8f330f87956d5e871816eb9cdbcf503c49786651c4d6b8.exe	29
PID 2348 wrote to memory of 2732	2348	21df3450742709214c8f330f87956d5e871816eb9cdbcf503c49786651c4d6b8.exe	30
PID 2348 wrote to memory of 2732	2348	21df3450742709214c8f330f87956d5e871816eb9cdbcf503c49786651c4d6b8.exe	30
PID 2348 wrote to memory of 2732	2348	21df3450742709214c8f330f87956d5e871816eb9cdbcf503c49786651c4d6b8.exe	30
PID 2348 wrote to memory of 2732	2348	21df3450742709214c8f330f87956d5e871816eb9cdbcf503c49786651c4d6b8.exe	30
PID 2528 wrote to memory of 2708	2528	AppLaunch.exe	31
PID 2528 wrote to memory of 2708	2528	AppLaunch.exe	31
PID 2528 wrote to memory of 2708	2528	AppLaunch.exe	31
PID 2528 wrote to memory of 2708	2528	AppLaunch.exe	31
PID 2528 wrote to memory of 2708	2528	AppLaunch.exe	31
PID 2528 wrote to memory of 2708	2528	AppLaunch.exe	31
PID 2528 wrote to memory of 2708	2528	AppLaunch.exe	31

C:\Users\Admin\AppData\Local\Temp\21df3450742709214c8f330f87956d5e871816eb9cdbcf503c49786651c4d6b8.exe
"C:\Users\Admin\AppData\Local\Temp\21df3450742709214c8f330f87956d5e871816eb9cdbcf503c49786651c4d6b8.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2348
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2528
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2528 -s 196
    3⤵
    - Program crash
    PID:2708
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2348 -s 68
  2⤵
  - Program crash
  PID:2732

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2528-1-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/2528-0-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/2528-2-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/2528-3-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/2528-4-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/2528-6-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmp

Filesize
4KB

Download
memory/2528-5-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/2528-7-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/2528-9-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/2528-11-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads