mystic | d962f4a088d03401da2e67f159569e79ffb03be727eec7deefedc2fa76e6a505

Analysis

max time kernel
121s
max time network
147s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
11-10-2023 06:58

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

9cb0e46ddf8eb2316a08898f452d51ba6f952df7de828b4b5a83624db9d47d51.exe
Size

1016KB
MD5

acff043c5c92363b1da7de6d4588a687
SHA1

1ec1adbb7c48a8a4ae9d93db22a8fb00068bbb9c
SHA256

9cb0e46ddf8eb2316a08898f452d51ba6f952df7de828b4b5a83624db9d47d51
SHA512

e2e384cfd3428d3f98da98d95b311c87fc73009954648a406c5fb502f181d46c667c90aedfbe535313e20503b16da9849d2e79b26c4486a890bae8fd2067af24
SSDEEP

12288:z+hAo/YSBYDKzcx9jkmP8bey7/0RDMmZZxnyUuyyuMTZA/ZabWeFQ/9:zCJYDKzcx9jkmPe/knxy5A/Zm/u9

Score

10^/10

mystic stealer

Malware Config

Signatures

Detect Mystic stealer payload 6 IoCs

resource	yara_rule
behavioral1/memory/1808-3-0x0000000000400000-0x0000000000428000-memory.dmp	family_mystic
behavioral1/memory/1808-4-0x0000000000400000-0x0000000000428000-memory.dmp	family_mystic
behavioral1/memory/1808-5-0x0000000000400000-0x0000000000428000-memory.dmp	family_mystic
behavioral1/memory/1808-9-0x0000000000400000-0x0000000000428000-memory.dmp	family_mystic
behavioral1/memory/1808-7-0x0000000000400000-0x0000000000428000-memory.dmp	family_mystic
behavioral1/memory/1808-11-0x0000000000400000-0x0000000000428000-memory.dmp	family_mystic

Mystic
Mystic is an infostealer written in C++.
stealer mystic

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2648 set thread context of 1808	2648	9cb0e46ddf8eb2316a08898f452d51ba6f952df7de828b4b5a83624db9d47d51.exe	31

Program crash 2 IoCs

pid	pid_target	Process	procid_target
2688	2648	WerFault.exe	1
2696	1808	WerFault.exe	31

Suspicious use of WriteProcessMemory 32 IoCs

description	pid	Process	procid_target
PID 2648 wrote to memory of 2844	2648	9cb0e46ddf8eb2316a08898f452d51ba6f952df7de828b4b5a83624db9d47d51.exe	30
PID 2648 wrote to memory of 2844	2648	9cb0e46ddf8eb2316a08898f452d51ba6f952df7de828b4b5a83624db9d47d51.exe	30
PID 2648 wrote to memory of 2844	2648	9cb0e46ddf8eb2316a08898f452d51ba6f952df7de828b4b5a83624db9d47d51.exe	30
PID 2648 wrote to memory of 2844	2648	9cb0e46ddf8eb2316a08898f452d51ba6f952df7de828b4b5a83624db9d47d51.exe	30
PID 2648 wrote to memory of 2844	2648	9cb0e46ddf8eb2316a08898f452d51ba6f952df7de828b4b5a83624db9d47d51.exe	30
PID 2648 wrote to memory of 2844	2648	9cb0e46ddf8eb2316a08898f452d51ba6f952df7de828b4b5a83624db9d47d51.exe	30
PID 2648 wrote to memory of 2844	2648	9cb0e46ddf8eb2316a08898f452d51ba6f952df7de828b4b5a83624db9d47d51.exe	30
PID 2648 wrote to memory of 1808	2648	9cb0e46ddf8eb2316a08898f452d51ba6f952df7de828b4b5a83624db9d47d51.exe	31
PID 2648 wrote to memory of 1808	2648	9cb0e46ddf8eb2316a08898f452d51ba6f952df7de828b4b5a83624db9d47d51.exe	31
PID 2648 wrote to memory of 1808	2648	9cb0e46ddf8eb2316a08898f452d51ba6f952df7de828b4b5a83624db9d47d51.exe	31
PID 2648 wrote to memory of 1808	2648	9cb0e46ddf8eb2316a08898f452d51ba6f952df7de828b4b5a83624db9d47d51.exe	31
PID 2648 wrote to memory of 1808	2648	9cb0e46ddf8eb2316a08898f452d51ba6f952df7de828b4b5a83624db9d47d51.exe	31
PID 2648 wrote to memory of 1808	2648	9cb0e46ddf8eb2316a08898f452d51ba6f952df7de828b4b5a83624db9d47d51.exe	31
PID 2648 wrote to memory of 1808	2648	9cb0e46ddf8eb2316a08898f452d51ba6f952df7de828b4b5a83624db9d47d51.exe	31
PID 2648 wrote to memory of 1808	2648	9cb0e46ddf8eb2316a08898f452d51ba6f952df7de828b4b5a83624db9d47d51.exe	31
PID 2648 wrote to memory of 1808	2648	9cb0e46ddf8eb2316a08898f452d51ba6f952df7de828b4b5a83624db9d47d51.exe	31
PID 2648 wrote to memory of 1808	2648	9cb0e46ddf8eb2316a08898f452d51ba6f952df7de828b4b5a83624db9d47d51.exe	31
PID 2648 wrote to memory of 1808	2648	9cb0e46ddf8eb2316a08898f452d51ba6f952df7de828b4b5a83624db9d47d51.exe	31
PID 2648 wrote to memory of 1808	2648	9cb0e46ddf8eb2316a08898f452d51ba6f952df7de828b4b5a83624db9d47d51.exe	31
PID 2648 wrote to memory of 1808	2648	9cb0e46ddf8eb2316a08898f452d51ba6f952df7de828b4b5a83624db9d47d51.exe	31
PID 2648 wrote to memory of 1808	2648	9cb0e46ddf8eb2316a08898f452d51ba6f952df7de828b4b5a83624db9d47d51.exe	31
PID 2648 wrote to memory of 2688	2648	9cb0e46ddf8eb2316a08898f452d51ba6f952df7de828b4b5a83624db9d47d51.exe	32
PID 2648 wrote to memory of 2688	2648	9cb0e46ddf8eb2316a08898f452d51ba6f952df7de828b4b5a83624db9d47d51.exe	32
PID 2648 wrote to memory of 2688	2648	9cb0e46ddf8eb2316a08898f452d51ba6f952df7de828b4b5a83624db9d47d51.exe	32
PID 2648 wrote to memory of 2688	2648	9cb0e46ddf8eb2316a08898f452d51ba6f952df7de828b4b5a83624db9d47d51.exe	32
PID 1808 wrote to memory of 2696	1808	AppLaunch.exe	33
PID 1808 wrote to memory of 2696	1808	AppLaunch.exe	33
PID 1808 wrote to memory of 2696	1808	AppLaunch.exe	33
PID 1808 wrote to memory of 2696	1808	AppLaunch.exe	33
PID 1808 wrote to memory of 2696	1808	AppLaunch.exe	33
PID 1808 wrote to memory of 2696	1808	AppLaunch.exe	33
PID 1808 wrote to memory of 2696	1808	AppLaunch.exe	33

C:\Users\Admin\AppData\Local\Temp\9cb0e46ddf8eb2316a08898f452d51ba6f952df7de828b4b5a83624db9d47d51.exe
"C:\Users\Admin\AppData\Local\Temp\9cb0e46ddf8eb2316a08898f452d51ba6f952df7de828b4b5a83624db9d47d51.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2648
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
  2⤵
  PID:2844
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1808
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1808 -s 196
    3⤵
    - Program crash
    PID:2696
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2648 -s 100
  2⤵
  - Program crash
  PID:2688

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1808-0-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/1808-1-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/1808-2-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/1808-3-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/1808-4-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/1808-5-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/1808-9-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/1808-7-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/1808-6-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmp

Filesize
4KB

Download
memory/1808-11-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads