mystic | 344f555bafa13235c6275766214887a9b7d77f0639d5b79df2020ad81383fe81

General

Target

344f555bafa13235c6275766214887a9b7d77f0639d5b79df2020ad81383fe81_JC.exe
Size

1016KB
MD5

da64796b21017581ed9cc9430a994bd6
SHA1

22f2c6919beb53d4847f841b3ade37a5f57a766b
SHA256

344f555bafa13235c6275766214887a9b7d77f0639d5b79df2020ad81383fe81
SHA512

66262c6138a5ab455f64626cd9b6763832ea09d48b8375e113639022bb5ead60788c8b1d678bf86b5bff0c54fd60c20cd3e8f3e7df0b94a6c8847b13e03eba96
SSDEEP

12288:A+hAoJY0BYDKzcx9jkmP8bey7/0RDMmZZxnyUuyyuxubeg0IVAUjGhzy/9:AY7YDKzcx9jkmPe/knxyZC0gx69

Score

10^/10

Malware Config

Signatures

Detect Mystic stealer payload 6 IoCs

resource	yara_rule
behavioral1/memory/2368-3-0x0000000000400000-0x0000000000428000-memory.dmp	family_mystic
behavioral1/memory/2368-5-0x0000000000400000-0x0000000000428000-memory.dmp	family_mystic
behavioral1/memory/2368-4-0x0000000000400000-0x0000000000428000-memory.dmp	family_mystic
behavioral1/memory/2368-7-0x0000000000400000-0x0000000000428000-memory.dmp	family_mystic
behavioral1/memory/2368-9-0x0000000000400000-0x0000000000428000-memory.dmp	family_mystic
behavioral1/memory/2368-11-0x0000000000400000-0x0000000000428000-memory.dmp	family_mystic

Mystic
Mystic is an infostealer written in C++.
stealer mystic

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2388 set thread context of 2368	2388	344f555bafa13235c6275766214887a9b7d77f0639d5b79df2020ad81383fe81_JC.exe	29

Program crash 2 IoCs

pid	pid_target	Process	procid_target
1432	2388	WerFault.exe	14
2284	2368	WerFault.exe	29

Suspicious use of WriteProcessMemory 25 IoCs

description	pid	Process	procid_target
PID 2388 wrote to memory of 2368	2388	344f555bafa13235c6275766214887a9b7d77f0639d5b79df2020ad81383fe81_JC.exe	29
PID 2388 wrote to memory of 2368	2388	344f555bafa13235c6275766214887a9b7d77f0639d5b79df2020ad81383fe81_JC.exe	29
PID 2388 wrote to memory of 2368	2388	344f555bafa13235c6275766214887a9b7d77f0639d5b79df2020ad81383fe81_JC.exe	29
PID 2388 wrote to memory of 2368	2388	344f555bafa13235c6275766214887a9b7d77f0639d5b79df2020ad81383fe81_JC.exe	29
PID 2388 wrote to memory of 2368	2388	344f555bafa13235c6275766214887a9b7d77f0639d5b79df2020ad81383fe81_JC.exe	29
PID 2388 wrote to memory of 2368	2388	344f555bafa13235c6275766214887a9b7d77f0639d5b79df2020ad81383fe81_JC.exe	29
PID 2388 wrote to memory of 2368	2388	344f555bafa13235c6275766214887a9b7d77f0639d5b79df2020ad81383fe81_JC.exe	29
PID 2388 wrote to memory of 2368	2388	344f555bafa13235c6275766214887a9b7d77f0639d5b79df2020ad81383fe81_JC.exe	29
PID 2388 wrote to memory of 2368	2388	344f555bafa13235c6275766214887a9b7d77f0639d5b79df2020ad81383fe81_JC.exe	29
PID 2388 wrote to memory of 2368	2388	344f555bafa13235c6275766214887a9b7d77f0639d5b79df2020ad81383fe81_JC.exe	29
PID 2388 wrote to memory of 2368	2388	344f555bafa13235c6275766214887a9b7d77f0639d5b79df2020ad81383fe81_JC.exe	29
PID 2388 wrote to memory of 2368	2388	344f555bafa13235c6275766214887a9b7d77f0639d5b79df2020ad81383fe81_JC.exe	29
PID 2388 wrote to memory of 2368	2388	344f555bafa13235c6275766214887a9b7d77f0639d5b79df2020ad81383fe81_JC.exe	29
PID 2388 wrote to memory of 2368	2388	344f555bafa13235c6275766214887a9b7d77f0639d5b79df2020ad81383fe81_JC.exe	29
PID 2388 wrote to memory of 1432	2388	344f555bafa13235c6275766214887a9b7d77f0639d5b79df2020ad81383fe81_JC.exe	30
PID 2388 wrote to memory of 1432	2388	344f555bafa13235c6275766214887a9b7d77f0639d5b79df2020ad81383fe81_JC.exe	30
PID 2388 wrote to memory of 1432	2388	344f555bafa13235c6275766214887a9b7d77f0639d5b79df2020ad81383fe81_JC.exe	30
PID 2388 wrote to memory of 1432	2388	344f555bafa13235c6275766214887a9b7d77f0639d5b79df2020ad81383fe81_JC.exe	30
PID 2368 wrote to memory of 2284	2368	AppLaunch.exe	31
PID 2368 wrote to memory of 2284	2368	AppLaunch.exe	31
PID 2368 wrote to memory of 2284	2368	AppLaunch.exe	31
PID 2368 wrote to memory of 2284	2368	AppLaunch.exe	31
PID 2368 wrote to memory of 2284	2368	AppLaunch.exe	31
PID 2368 wrote to memory of 2284	2368	AppLaunch.exe	31
PID 2368 wrote to memory of 2284	2368	AppLaunch.exe	31

C:\Users\Admin\AppData\Local\Temp\344f555bafa13235c6275766214887a9b7d77f0639d5b79df2020ad81383fe81_JC.exe
"C:\Users\Admin\AppData\Local\Temp\344f555bafa13235c6275766214887a9b7d77f0639d5b79df2020ad81383fe81_JC.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2388
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2368
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2368 -s 196
    3⤵
    - Program crash
    PID:2284
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2388 -s 92
  2⤵
  - Program crash
  PID:1432

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2368-0-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/2368-1-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/2368-2-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/2368-3-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/2368-5-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/2368-4-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/2368-6-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmp

Filesize
4KB

Download
memory/2368-7-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/2368-9-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/2368-11-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads