mystic | 85cea14c62d038eab11954c093b9a7ef52c99084fa3a822b50b1d86d406fbfef

General

Target

85cea14c62d038eab11954c093b9a7ef52c99084fa3a822b50b1d86d406fbfef.exe
Size

356KB
MD5

53ebf495e825c5ae181438c5a7dc7343
SHA1

ea99b79d5896b5d797b18afbf3a3fbb26bc41859
SHA256

85cea14c62d038eab11954c093b9a7ef52c99084fa3a822b50b1d86d406fbfef
SHA512

11b5c8186930e0a9dd98a08f61c1430e2236cd823337e64dd00bf17e19cdd66e66ef6b826c7a14cb18c651c8f7a9dd50a274809515a606345384fdf5bc93fcd9
SSDEEP

6144:w2TeW/s5GqrO5aXnfEGIXWPvZAOWyzCZUixJxn4CL2zjvoELP4Vs0BC+:CmcGqrOk86xNCZUixJxn92HTL8s0BC+

Score

10^/10

Malware Config

Signatures

Detect Mystic stealer payload 6 IoCs

resource	yara_rule
behavioral1/memory/2628-9-0x0000000000400000-0x0000000000428000-memory.dmp	family_mystic
behavioral1/memory/2628-7-0x0000000000400000-0x0000000000428000-memory.dmp	family_mystic
behavioral1/memory/2628-5-0x0000000000400000-0x0000000000428000-memory.dmp	family_mystic
behavioral1/memory/2628-3-0x0000000000400000-0x0000000000428000-memory.dmp	family_mystic
behavioral1/memory/2628-11-0x0000000000400000-0x0000000000428000-memory.dmp	family_mystic
behavioral1/memory/2628-13-0x0000000000400000-0x0000000000428000-memory.dmp	family_mystic

Mystic
Mystic is an infostealer written in C++.
stealer mystic

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2952 set thread context of 2628	2952	85cea14c62d038eab11954c093b9a7ef52c99084fa3a822b50b1d86d406fbfef.exe	29

Program crash 2 IoCs

pid	pid_target	Process	procid_target
2452	2952	WerFault.exe	20
1632	2628	WerFault.exe	29

Suspicious use of WriteProcessMemory 25 IoCs

description	pid	Process	procid_target
PID 2952 wrote to memory of 2628	2952	85cea14c62d038eab11954c093b9a7ef52c99084fa3a822b50b1d86d406fbfef.exe	29
PID 2952 wrote to memory of 2628	2952	85cea14c62d038eab11954c093b9a7ef52c99084fa3a822b50b1d86d406fbfef.exe	29
PID 2952 wrote to memory of 2628	2952	85cea14c62d038eab11954c093b9a7ef52c99084fa3a822b50b1d86d406fbfef.exe	29
PID 2952 wrote to memory of 2628	2952	85cea14c62d038eab11954c093b9a7ef52c99084fa3a822b50b1d86d406fbfef.exe	29
PID 2952 wrote to memory of 2628	2952	85cea14c62d038eab11954c093b9a7ef52c99084fa3a822b50b1d86d406fbfef.exe	29
PID 2952 wrote to memory of 2628	2952	85cea14c62d038eab11954c093b9a7ef52c99084fa3a822b50b1d86d406fbfef.exe	29
PID 2952 wrote to memory of 2628	2952	85cea14c62d038eab11954c093b9a7ef52c99084fa3a822b50b1d86d406fbfef.exe	29
PID 2952 wrote to memory of 2628	2952	85cea14c62d038eab11954c093b9a7ef52c99084fa3a822b50b1d86d406fbfef.exe	29
PID 2952 wrote to memory of 2628	2952	85cea14c62d038eab11954c093b9a7ef52c99084fa3a822b50b1d86d406fbfef.exe	29
PID 2952 wrote to memory of 2628	2952	85cea14c62d038eab11954c093b9a7ef52c99084fa3a822b50b1d86d406fbfef.exe	29
PID 2952 wrote to memory of 2628	2952	85cea14c62d038eab11954c093b9a7ef52c99084fa3a822b50b1d86d406fbfef.exe	29
PID 2952 wrote to memory of 2628	2952	85cea14c62d038eab11954c093b9a7ef52c99084fa3a822b50b1d86d406fbfef.exe	29
PID 2952 wrote to memory of 2628	2952	85cea14c62d038eab11954c093b9a7ef52c99084fa3a822b50b1d86d406fbfef.exe	29
PID 2952 wrote to memory of 2628	2952	85cea14c62d038eab11954c093b9a7ef52c99084fa3a822b50b1d86d406fbfef.exe	29
PID 2952 wrote to memory of 2452	2952	85cea14c62d038eab11954c093b9a7ef52c99084fa3a822b50b1d86d406fbfef.exe	30
PID 2952 wrote to memory of 2452	2952	85cea14c62d038eab11954c093b9a7ef52c99084fa3a822b50b1d86d406fbfef.exe	30
PID 2952 wrote to memory of 2452	2952	85cea14c62d038eab11954c093b9a7ef52c99084fa3a822b50b1d86d406fbfef.exe	30
PID 2952 wrote to memory of 2452	2952	85cea14c62d038eab11954c093b9a7ef52c99084fa3a822b50b1d86d406fbfef.exe	30
PID 2628 wrote to memory of 1632	2628	AppLaunch.exe	31
PID 2628 wrote to memory of 1632	2628	AppLaunch.exe	31
PID 2628 wrote to memory of 1632	2628	AppLaunch.exe	31
PID 2628 wrote to memory of 1632	2628	AppLaunch.exe	31
PID 2628 wrote to memory of 1632	2628	AppLaunch.exe	31
PID 2628 wrote to memory of 1632	2628	AppLaunch.exe	31
PID 2628 wrote to memory of 1632	2628	AppLaunch.exe	31

C:\Users\Admin\AppData\Local\Temp\85cea14c62d038eab11954c093b9a7ef52c99084fa3a822b50b1d86d406fbfef.exe
"C:\Users\Admin\AppData\Local\Temp\85cea14c62d038eab11954c093b9a7ef52c99084fa3a822b50b1d86d406fbfef.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2952
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2628
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2628 -s 196
    3⤵
    - Program crash
    PID:1632
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2952 -s 76
  2⤵
  - Program crash
  PID:2452

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2628-0-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/2628-8-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmp

Filesize
4KB

Download
memory/2628-9-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/2628-7-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/2628-5-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/2628-3-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/2628-2-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/2628-1-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/2628-11-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/2628-13-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads