mystic | fe10929f7103b8fe665f854f531431ce53ea4a1e98322ed6ad870dc3cb7d6fd8

General

Target

fe10929f7103b8fe665f854f531431ce53ea4a1e98322ed6ad870dc3cb7d6fd8.exe
Size

356KB
MD5

9f3f0609bc3e11c7ac426a4da4b5f2a8
SHA1

60bfbd4fdc460031086d217241a4e8e84698a05c
SHA256

fe10929f7103b8fe665f854f531431ce53ea4a1e98322ed6ad870dc3cb7d6fd8
SHA512

32c051338d789beea8a20bf45ca1c2eaddd753dc221eabdd30fb8e623ca66ffc68bef640fded6a45ca7019e9615bc05c9e69c7469b8e92fe754f06b3b2159535
SSDEEP

6144:uHTeW/s5GqrO5aXnfEGIXWPvZAO/yzfBrNXsxUZDYF5io84e02v/Vs0BC+:JmcGqrOk86xqBNXnmIo84fYs0BC+

Score

10^/10

Malware Config

Signatures

Detect Mystic stealer payload 6 IoCs

resource	yara_rule
behavioral1/memory/3024-3-0x0000000000400000-0x0000000000428000-memory.dmp	family_mystic
behavioral1/memory/3024-4-0x0000000000400000-0x0000000000428000-memory.dmp	family_mystic
behavioral1/memory/3024-5-0x0000000000400000-0x0000000000428000-memory.dmp	family_mystic
behavioral1/memory/3024-7-0x0000000000400000-0x0000000000428000-memory.dmp	family_mystic
behavioral1/memory/3024-9-0x0000000000400000-0x0000000000428000-memory.dmp	family_mystic
behavioral1/memory/3024-11-0x0000000000400000-0x0000000000428000-memory.dmp	family_mystic

Mystic
Mystic is an infostealer written in C++.
stealer mystic

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2332 set thread context of 3024	2332	fe10929f7103b8fe665f854f531431ce53ea4a1e98322ed6ad870dc3cb7d6fd8.exe	28

Program crash 2 IoCs

pid	pid_target	Process	procid_target
2624	2332	WerFault.exe	26
2704	3024	WerFault.exe	28

Suspicious use of WriteProcessMemory 25 IoCs

description	pid	Process	procid_target
PID 2332 wrote to memory of 3024	2332	fe10929f7103b8fe665f854f531431ce53ea4a1e98322ed6ad870dc3cb7d6fd8.exe	28
PID 2332 wrote to memory of 3024	2332	fe10929f7103b8fe665f854f531431ce53ea4a1e98322ed6ad870dc3cb7d6fd8.exe	28
PID 2332 wrote to memory of 3024	2332	fe10929f7103b8fe665f854f531431ce53ea4a1e98322ed6ad870dc3cb7d6fd8.exe	28
PID 2332 wrote to memory of 3024	2332	fe10929f7103b8fe665f854f531431ce53ea4a1e98322ed6ad870dc3cb7d6fd8.exe	28
PID 2332 wrote to memory of 3024	2332	fe10929f7103b8fe665f854f531431ce53ea4a1e98322ed6ad870dc3cb7d6fd8.exe	28
PID 2332 wrote to memory of 3024	2332	fe10929f7103b8fe665f854f531431ce53ea4a1e98322ed6ad870dc3cb7d6fd8.exe	28
PID 2332 wrote to memory of 3024	2332	fe10929f7103b8fe665f854f531431ce53ea4a1e98322ed6ad870dc3cb7d6fd8.exe	28
PID 2332 wrote to memory of 3024	2332	fe10929f7103b8fe665f854f531431ce53ea4a1e98322ed6ad870dc3cb7d6fd8.exe	28
PID 2332 wrote to memory of 3024	2332	fe10929f7103b8fe665f854f531431ce53ea4a1e98322ed6ad870dc3cb7d6fd8.exe	28
PID 2332 wrote to memory of 3024	2332	fe10929f7103b8fe665f854f531431ce53ea4a1e98322ed6ad870dc3cb7d6fd8.exe	28
PID 2332 wrote to memory of 3024	2332	fe10929f7103b8fe665f854f531431ce53ea4a1e98322ed6ad870dc3cb7d6fd8.exe	28
PID 2332 wrote to memory of 3024	2332	fe10929f7103b8fe665f854f531431ce53ea4a1e98322ed6ad870dc3cb7d6fd8.exe	28
PID 2332 wrote to memory of 3024	2332	fe10929f7103b8fe665f854f531431ce53ea4a1e98322ed6ad870dc3cb7d6fd8.exe	28
PID 2332 wrote to memory of 3024	2332	fe10929f7103b8fe665f854f531431ce53ea4a1e98322ed6ad870dc3cb7d6fd8.exe	28
PID 2332 wrote to memory of 2624	2332	fe10929f7103b8fe665f854f531431ce53ea4a1e98322ed6ad870dc3cb7d6fd8.exe	29
PID 2332 wrote to memory of 2624	2332	fe10929f7103b8fe665f854f531431ce53ea4a1e98322ed6ad870dc3cb7d6fd8.exe	29
PID 2332 wrote to memory of 2624	2332	fe10929f7103b8fe665f854f531431ce53ea4a1e98322ed6ad870dc3cb7d6fd8.exe	29
PID 2332 wrote to memory of 2624	2332	fe10929f7103b8fe665f854f531431ce53ea4a1e98322ed6ad870dc3cb7d6fd8.exe	29
PID 3024 wrote to memory of 2704	3024	AppLaunch.exe	30
PID 3024 wrote to memory of 2704	3024	AppLaunch.exe	30
PID 3024 wrote to memory of 2704	3024	AppLaunch.exe	30
PID 3024 wrote to memory of 2704	3024	AppLaunch.exe	30
PID 3024 wrote to memory of 2704	3024	AppLaunch.exe	30
PID 3024 wrote to memory of 2704	3024	AppLaunch.exe	30
PID 3024 wrote to memory of 2704	3024	AppLaunch.exe	30

C:\Users\Admin\AppData\Local\Temp\fe10929f7103b8fe665f854f531431ce53ea4a1e98322ed6ad870dc3cb7d6fd8.exe
"C:\Users\Admin\AppData\Local\Temp\fe10929f7103b8fe665f854f531431ce53ea4a1e98322ed6ad870dc3cb7d6fd8.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2332
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3024
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3024 -s 196
    3⤵
    - Program crash
    PID:2704
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2332 -s 76
  2⤵
  - Program crash
  PID:2624

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3024-0-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/3024-1-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/3024-3-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/3024-2-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/3024-4-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/3024-5-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/3024-7-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/3024-6-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmp

Filesize
4KB

Download
memory/3024-9-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/3024-11-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads