mystic | 6fda596794eec5e90b0fe21d0409df4881c52980af09be721429d849ab8db860

General

Target

3d53faf7fb3af3a735df7179ce8dc731ea9017e32365b0ede294d5f21f748e58.exe
Size

1016KB
MD5

9197894f082bcbf9de819c2770a5207d
SHA1

fabcfad80b27394644712a25564c3de399a8e126
SHA256

3d53faf7fb3af3a735df7179ce8dc731ea9017e32365b0ede294d5f21f748e58
SHA512

89810df68fda615939204d78ce6a567780c35a4cac483a6742f45cff4c46d45ad40f118583910ddf1ccddacb1cdbd2c51856e28154fcae94c92724020bf3b383
SSDEEP

12288:d+uAoZYyBYDKzcx9jkmP8bey7/0RDMmZZxnyUuyyutrY9PXY8/9:dNpYDKzcx9jkmPe/knxyerY9PoE9

Score

10^/10

Malware Config

Signatures

Detect Mystic stealer payload 6 IoCs

resource	yara_rule
behavioral1/memory/2952-3-0x0000000000400000-0x0000000000428000-memory.dmp	family_mystic
behavioral1/memory/2952-4-0x0000000000400000-0x0000000000428000-memory.dmp	family_mystic
behavioral1/memory/2952-5-0x0000000000400000-0x0000000000428000-memory.dmp	family_mystic
behavioral1/memory/2952-7-0x0000000000400000-0x0000000000428000-memory.dmp	family_mystic
behavioral1/memory/2952-9-0x0000000000400000-0x0000000000428000-memory.dmp	family_mystic
behavioral1/memory/2952-11-0x0000000000400000-0x0000000000428000-memory.dmp	family_mystic

Mystic
Mystic is an infostealer written in C++.
stealer mystic

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2160 set thread context of 2952	2160	3d53faf7fb3af3a735df7179ce8dc731ea9017e32365b0ede294d5f21f748e58.exe	29

Program crash 2 IoCs

pid	pid_target	Process	procid_target
1488	2160	WerFault.exe	14
2008	2952	WerFault.exe	29

Suspicious use of WriteProcessMemory 25 IoCs

description	pid	Process	procid_target
PID 2160 wrote to memory of 2952	2160	3d53faf7fb3af3a735df7179ce8dc731ea9017e32365b0ede294d5f21f748e58.exe	29
PID 2160 wrote to memory of 2952	2160	3d53faf7fb3af3a735df7179ce8dc731ea9017e32365b0ede294d5f21f748e58.exe	29
PID 2160 wrote to memory of 2952	2160	3d53faf7fb3af3a735df7179ce8dc731ea9017e32365b0ede294d5f21f748e58.exe	29
PID 2160 wrote to memory of 2952	2160	3d53faf7fb3af3a735df7179ce8dc731ea9017e32365b0ede294d5f21f748e58.exe	29
PID 2160 wrote to memory of 2952	2160	3d53faf7fb3af3a735df7179ce8dc731ea9017e32365b0ede294d5f21f748e58.exe	29
PID 2160 wrote to memory of 2952	2160	3d53faf7fb3af3a735df7179ce8dc731ea9017e32365b0ede294d5f21f748e58.exe	29
PID 2160 wrote to memory of 2952	2160	3d53faf7fb3af3a735df7179ce8dc731ea9017e32365b0ede294d5f21f748e58.exe	29
PID 2160 wrote to memory of 2952	2160	3d53faf7fb3af3a735df7179ce8dc731ea9017e32365b0ede294d5f21f748e58.exe	29
PID 2160 wrote to memory of 2952	2160	3d53faf7fb3af3a735df7179ce8dc731ea9017e32365b0ede294d5f21f748e58.exe	29
PID 2160 wrote to memory of 2952	2160	3d53faf7fb3af3a735df7179ce8dc731ea9017e32365b0ede294d5f21f748e58.exe	29
PID 2160 wrote to memory of 2952	2160	3d53faf7fb3af3a735df7179ce8dc731ea9017e32365b0ede294d5f21f748e58.exe	29
PID 2160 wrote to memory of 2952	2160	3d53faf7fb3af3a735df7179ce8dc731ea9017e32365b0ede294d5f21f748e58.exe	29
PID 2160 wrote to memory of 2952	2160	3d53faf7fb3af3a735df7179ce8dc731ea9017e32365b0ede294d5f21f748e58.exe	29
PID 2160 wrote to memory of 2952	2160	3d53faf7fb3af3a735df7179ce8dc731ea9017e32365b0ede294d5f21f748e58.exe	29
PID 2160 wrote to memory of 1488	2160	3d53faf7fb3af3a735df7179ce8dc731ea9017e32365b0ede294d5f21f748e58.exe	30
PID 2160 wrote to memory of 1488	2160	3d53faf7fb3af3a735df7179ce8dc731ea9017e32365b0ede294d5f21f748e58.exe	30
PID 2160 wrote to memory of 1488	2160	3d53faf7fb3af3a735df7179ce8dc731ea9017e32365b0ede294d5f21f748e58.exe	30
PID 2160 wrote to memory of 1488	2160	3d53faf7fb3af3a735df7179ce8dc731ea9017e32365b0ede294d5f21f748e58.exe	30
PID 2952 wrote to memory of 2008	2952	AppLaunch.exe	31
PID 2952 wrote to memory of 2008	2952	AppLaunch.exe	31
PID 2952 wrote to memory of 2008	2952	AppLaunch.exe	31
PID 2952 wrote to memory of 2008	2952	AppLaunch.exe	31
PID 2952 wrote to memory of 2008	2952	AppLaunch.exe	31
PID 2952 wrote to memory of 2008	2952	AppLaunch.exe	31
PID 2952 wrote to memory of 2008	2952	AppLaunch.exe	31

C:\Users\Admin\AppData\Local\Temp\3d53faf7fb3af3a735df7179ce8dc731ea9017e32365b0ede294d5f21f748e58.exe
"C:\Users\Admin\AppData\Local\Temp\3d53faf7fb3af3a735df7179ce8dc731ea9017e32365b0ede294d5f21f748e58.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2160
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2952
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2952 -s 196
    3⤵
    - Program crash
    PID:2008
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2160 -s 92
  2⤵
  - Program crash
  PID:1488

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2952-0-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/2952-1-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/2952-3-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/2952-2-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/2952-4-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/2952-5-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/2952-7-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/2952-6-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmp

Filesize
4KB

Download
memory/2952-9-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/2952-11-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads