mystic | a4e0f66c32f30cf5e73c0ceba8b5a90f007f6126594d3475c86094d850761d66

General

Target

a4e0f66c32f30cf5e73c0ceba8b5a90f007f6126594d3475c86094d850761d66.exe
Size

356KB
MD5

ee34268c1f6bb64acbc91ba24d7dba85
SHA1

4b8faf8e4851570331e3fae98745501ea14e8a6a
SHA256

a4e0f66c32f30cf5e73c0ceba8b5a90f007f6126594d3475c86094d850761d66
SHA512

b44578aecddbd8d3266f633436c59dbacc0554f7c6f5791ae864a11f6d3e38de13780754244834157f7f9e6004d2725de6e2bfb7550df7aaf908b3af3ac9c377
SSDEEP

6144:EATeW/s5GqrO5aXnfEGIXWPvZAOZynlZO1zrd4T2scpAuRBqXzE4+WVs0BC+:wmcGqrOk86xKlZNak4B+s0BC+

Score

10^/10

Malware Config

Signatures

Detect Mystic stealer payload 6 IoCs

resource	yara_rule
behavioral1/memory/2032-5-0x0000000000400000-0x0000000000428000-memory.dmp	family_mystic
behavioral1/memory/2032-4-0x0000000000400000-0x0000000000428000-memory.dmp	family_mystic
behavioral1/memory/2032-3-0x0000000000400000-0x0000000000428000-memory.dmp	family_mystic
behavioral1/memory/2032-7-0x0000000000400000-0x0000000000428000-memory.dmp	family_mystic
behavioral1/memory/2032-9-0x0000000000400000-0x0000000000428000-memory.dmp	family_mystic
behavioral1/memory/2032-11-0x0000000000400000-0x0000000000428000-memory.dmp	family_mystic

Mystic
Mystic is an infostealer written in C++.
stealer mystic

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1648 set thread context of 2032	1648	a4e0f66c32f30cf5e73c0ceba8b5a90f007f6126594d3475c86094d850761d66.exe	29

Program crash 2 IoCs

pid	pid_target	Process	procid_target
2392	1648	WerFault.exe	27
2648	2032	WerFault.exe	29

Suspicious use of WriteProcessMemory 25 IoCs

description	pid	Process	procid_target
PID 1648 wrote to memory of 2032	1648	a4e0f66c32f30cf5e73c0ceba8b5a90f007f6126594d3475c86094d850761d66.exe	29
PID 1648 wrote to memory of 2032	1648	a4e0f66c32f30cf5e73c0ceba8b5a90f007f6126594d3475c86094d850761d66.exe	29
PID 1648 wrote to memory of 2032	1648	a4e0f66c32f30cf5e73c0ceba8b5a90f007f6126594d3475c86094d850761d66.exe	29
PID 1648 wrote to memory of 2032	1648	a4e0f66c32f30cf5e73c0ceba8b5a90f007f6126594d3475c86094d850761d66.exe	29
PID 1648 wrote to memory of 2032	1648	a4e0f66c32f30cf5e73c0ceba8b5a90f007f6126594d3475c86094d850761d66.exe	29
PID 1648 wrote to memory of 2032	1648	a4e0f66c32f30cf5e73c0ceba8b5a90f007f6126594d3475c86094d850761d66.exe	29
PID 1648 wrote to memory of 2032	1648	a4e0f66c32f30cf5e73c0ceba8b5a90f007f6126594d3475c86094d850761d66.exe	29
PID 1648 wrote to memory of 2032	1648	a4e0f66c32f30cf5e73c0ceba8b5a90f007f6126594d3475c86094d850761d66.exe	29
PID 1648 wrote to memory of 2032	1648	a4e0f66c32f30cf5e73c0ceba8b5a90f007f6126594d3475c86094d850761d66.exe	29
PID 1648 wrote to memory of 2032	1648	a4e0f66c32f30cf5e73c0ceba8b5a90f007f6126594d3475c86094d850761d66.exe	29
PID 1648 wrote to memory of 2032	1648	a4e0f66c32f30cf5e73c0ceba8b5a90f007f6126594d3475c86094d850761d66.exe	29
PID 1648 wrote to memory of 2032	1648	a4e0f66c32f30cf5e73c0ceba8b5a90f007f6126594d3475c86094d850761d66.exe	29
PID 1648 wrote to memory of 2032	1648	a4e0f66c32f30cf5e73c0ceba8b5a90f007f6126594d3475c86094d850761d66.exe	29
PID 1648 wrote to memory of 2032	1648	a4e0f66c32f30cf5e73c0ceba8b5a90f007f6126594d3475c86094d850761d66.exe	29
PID 1648 wrote to memory of 2392	1648	a4e0f66c32f30cf5e73c0ceba8b5a90f007f6126594d3475c86094d850761d66.exe	30
PID 1648 wrote to memory of 2392	1648	a4e0f66c32f30cf5e73c0ceba8b5a90f007f6126594d3475c86094d850761d66.exe	30
PID 1648 wrote to memory of 2392	1648	a4e0f66c32f30cf5e73c0ceba8b5a90f007f6126594d3475c86094d850761d66.exe	30
PID 1648 wrote to memory of 2392	1648	a4e0f66c32f30cf5e73c0ceba8b5a90f007f6126594d3475c86094d850761d66.exe	30
PID 2032 wrote to memory of 2648	2032	AppLaunch.exe	31
PID 2032 wrote to memory of 2648	2032	AppLaunch.exe	31
PID 2032 wrote to memory of 2648	2032	AppLaunch.exe	31
PID 2032 wrote to memory of 2648	2032	AppLaunch.exe	31
PID 2032 wrote to memory of 2648	2032	AppLaunch.exe	31
PID 2032 wrote to memory of 2648	2032	AppLaunch.exe	31
PID 2032 wrote to memory of 2648	2032	AppLaunch.exe	31

C:\Users\Admin\AppData\Local\Temp\a4e0f66c32f30cf5e73c0ceba8b5a90f007f6126594d3475c86094d850761d66.exe
"C:\Users\Admin\AppData\Local\Temp\a4e0f66c32f30cf5e73c0ceba8b5a90f007f6126594d3475c86094d850761d66.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1648
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2032
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2032 -s 196
    3⤵
    - Program crash
    PID:2648
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1648 -s 76
  2⤵
  - Program crash
  PID:2392

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2032-0-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/2032-1-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/2032-2-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/2032-6-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmp

Filesize
4KB

Download
memory/2032-5-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/2032-4-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/2032-3-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/2032-7-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/2032-9-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/2032-11-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads