mystic | 9072af6584cc2778c7d066054e1f8e9d58458e46b3ba78a2d33f14fc87f5faf8

General

Target

9072af6584cc2778c7d066054e1f8e9d58458e46b3ba78a2d33f14fc87f5faf8.exe
Size

356KB
MD5

daceb685006348afec45b004a927cd90
SHA1

7f37508936271cc76fe6217bfb8b7e1e960214d8
SHA256

9072af6584cc2778c7d066054e1f8e9d58458e46b3ba78a2d33f14fc87f5faf8
SHA512

2bb4bdbec0ad3e946fe6c3ac01e9d76fc1e6358a44849ec93d8b831b5602f523d396a0367abb3301ace8504d2d19bea8d800b0869896709a8a5c83fbe53002c4
SSDEEP

6144:KwTeW/s5GqrO5aXnfEGIXWPvZAOLy4Si5JtdfMvIUp5RY8Sh+ffVs0BC+:GmcGqrOk86xuinttMvIUp5jShas0BC+

Score

10^/10

Malware Config

Signatures

Detect Mystic stealer payload 6 IoCs

resource	yara_rule
behavioral1/memory/2236-3-0x0000000000400000-0x0000000000428000-memory.dmp	family_mystic
behavioral1/memory/2236-7-0x0000000000400000-0x0000000000428000-memory.dmp	family_mystic
behavioral1/memory/2236-5-0x0000000000400000-0x0000000000428000-memory.dmp	family_mystic
behavioral1/memory/2236-4-0x0000000000400000-0x0000000000428000-memory.dmp	family_mystic
behavioral1/memory/2236-9-0x0000000000400000-0x0000000000428000-memory.dmp	family_mystic
behavioral1/memory/2236-11-0x0000000000400000-0x0000000000428000-memory.dmp	family_mystic

Mystic
Mystic is an infostealer written in C++.
stealer mystic

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2444 set thread context of 2236	2444	9072af6584cc2778c7d066054e1f8e9d58458e46b3ba78a2d33f14fc87f5faf8.exe	29

Program crash 2 IoCs

pid	pid_target	Process	procid_target
2680	2444	WerFault.exe	18
1668	2236	WerFault.exe	29

Suspicious use of WriteProcessMemory 25 IoCs

description	pid	Process	procid_target
PID 2444 wrote to memory of 2236	2444	9072af6584cc2778c7d066054e1f8e9d58458e46b3ba78a2d33f14fc87f5faf8.exe	29
PID 2444 wrote to memory of 2236	2444	9072af6584cc2778c7d066054e1f8e9d58458e46b3ba78a2d33f14fc87f5faf8.exe	29
PID 2444 wrote to memory of 2236	2444	9072af6584cc2778c7d066054e1f8e9d58458e46b3ba78a2d33f14fc87f5faf8.exe	29
PID 2444 wrote to memory of 2236	2444	9072af6584cc2778c7d066054e1f8e9d58458e46b3ba78a2d33f14fc87f5faf8.exe	29
PID 2444 wrote to memory of 2236	2444	9072af6584cc2778c7d066054e1f8e9d58458e46b3ba78a2d33f14fc87f5faf8.exe	29
PID 2444 wrote to memory of 2236	2444	9072af6584cc2778c7d066054e1f8e9d58458e46b3ba78a2d33f14fc87f5faf8.exe	29
PID 2444 wrote to memory of 2236	2444	9072af6584cc2778c7d066054e1f8e9d58458e46b3ba78a2d33f14fc87f5faf8.exe	29
PID 2444 wrote to memory of 2236	2444	9072af6584cc2778c7d066054e1f8e9d58458e46b3ba78a2d33f14fc87f5faf8.exe	29
PID 2444 wrote to memory of 2236	2444	9072af6584cc2778c7d066054e1f8e9d58458e46b3ba78a2d33f14fc87f5faf8.exe	29
PID 2444 wrote to memory of 2236	2444	9072af6584cc2778c7d066054e1f8e9d58458e46b3ba78a2d33f14fc87f5faf8.exe	29
PID 2444 wrote to memory of 2236	2444	9072af6584cc2778c7d066054e1f8e9d58458e46b3ba78a2d33f14fc87f5faf8.exe	29
PID 2444 wrote to memory of 2236	2444	9072af6584cc2778c7d066054e1f8e9d58458e46b3ba78a2d33f14fc87f5faf8.exe	29
PID 2444 wrote to memory of 2236	2444	9072af6584cc2778c7d066054e1f8e9d58458e46b3ba78a2d33f14fc87f5faf8.exe	29
PID 2444 wrote to memory of 2236	2444	9072af6584cc2778c7d066054e1f8e9d58458e46b3ba78a2d33f14fc87f5faf8.exe	29
PID 2444 wrote to memory of 2680	2444	9072af6584cc2778c7d066054e1f8e9d58458e46b3ba78a2d33f14fc87f5faf8.exe	30
PID 2444 wrote to memory of 2680	2444	9072af6584cc2778c7d066054e1f8e9d58458e46b3ba78a2d33f14fc87f5faf8.exe	30
PID 2444 wrote to memory of 2680	2444	9072af6584cc2778c7d066054e1f8e9d58458e46b3ba78a2d33f14fc87f5faf8.exe	30
PID 2444 wrote to memory of 2680	2444	9072af6584cc2778c7d066054e1f8e9d58458e46b3ba78a2d33f14fc87f5faf8.exe	30
PID 2236 wrote to memory of 1668	2236	AppLaunch.exe	31
PID 2236 wrote to memory of 1668	2236	AppLaunch.exe	31
PID 2236 wrote to memory of 1668	2236	AppLaunch.exe	31
PID 2236 wrote to memory of 1668	2236	AppLaunch.exe	31
PID 2236 wrote to memory of 1668	2236	AppLaunch.exe	31
PID 2236 wrote to memory of 1668	2236	AppLaunch.exe	31
PID 2236 wrote to memory of 1668	2236	AppLaunch.exe	31

C:\Users\Admin\AppData\Local\Temp\9072af6584cc2778c7d066054e1f8e9d58458e46b3ba78a2d33f14fc87f5faf8.exe
"C:\Users\Admin\AppData\Local\Temp\9072af6584cc2778c7d066054e1f8e9d58458e46b3ba78a2d33f14fc87f5faf8.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2444
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2236
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2236 -s 196
    3⤵
    - Program crash
    PID:1668
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2444 -s 76
  2⤵
  - Program crash
  PID:2680

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2236-2-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/2236-3-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/2236-1-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/2236-0-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/2236-6-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmp

Filesize
4KB

Download
memory/2236-7-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/2236-5-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/2236-4-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/2236-9-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/2236-11-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads