mystic | e8cb2d615c2954b14f5efa245b8a4b9d0fd90043d65b0d03a40896a0af1c9ef2

General

Target

e8cb2d615c2954b14f5efa245b8a4b9d0fd90043d65b0d03a40896a0af1c9ef2.exe
Size

1016KB
MD5

48de38fa3f68c04b522b4961e5db163a
SHA1

84b5c214ace08a4269e7259814e68d1cdb7d60be
SHA256

e8cb2d615c2954b14f5efa245b8a4b9d0fd90043d65b0d03a40896a0af1c9ef2
SHA512

0dcbadc99929545055559105e5d34317866edfb8be233d566f796d3aab84cec556bbe7e40cb502d1b9af80393a3a833b7cbe8ef8912ce19ba638f4f9c76ae506
SSDEEP

12288:++RAocYVBYDKzcx9jkmP8bey7/0RDMmZZxnyUuyyu0mNwNUKdss/9:+xWYDKzcx9jkmPe/knxyPm6NNWU9

Score

10^/10

mystic stealer

Malware Config

Extracted

Family

mystic

C2

http://5.42.92.211/loghub/master

Signatures

Detect Mystic stealer payload 8 IoCs

resource	yara_rule
behavioral1/memory/2996-6-0x0000000000400000-0x0000000000428000-memory.dmp	family_mystic
behavioral1/memory/2996-8-0x0000000000400000-0x0000000000428000-memory.dmp	family_mystic
behavioral1/memory/2996-10-0x0000000000400000-0x0000000000428000-memory.dmp	family_mystic
behavioral1/memory/2996-13-0x0000000000400000-0x0000000000428000-memory.dmp	family_mystic
behavioral1/memory/2996-15-0x0000000000400000-0x0000000000428000-memory.dmp	family_mystic
behavioral1/memory/2996-17-0x0000000000400000-0x0000000000428000-memory.dmp	family_mystic
behavioral1/memory/2996-18-0x0000000000400000-0x0000000000428000-memory.dmp	family_mystic
behavioral1/memory/2996-19-0x0000000000400000-0x0000000000428000-memory.dmp	family_mystic

Mystic
Mystic is an infostealer written in C++.
stealer mystic

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3004 set thread context of 2996	3004	e8cb2d615c2954b14f5efa245b8a4b9d0fd90043d65b0d03a40896a0af1c9ef2.exe	29

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2724	3004	WerFault.exe	27

Suspicious use of WriteProcessMemory 18 IoCs

description	pid	Process	procid_target
PID 3004 wrote to memory of 2996	3004	e8cb2d615c2954b14f5efa245b8a4b9d0fd90043d65b0d03a40896a0af1c9ef2.exe	29
PID 3004 wrote to memory of 2996	3004	e8cb2d615c2954b14f5efa245b8a4b9d0fd90043d65b0d03a40896a0af1c9ef2.exe	29
PID 3004 wrote to memory of 2996	3004	e8cb2d615c2954b14f5efa245b8a4b9d0fd90043d65b0d03a40896a0af1c9ef2.exe	29
PID 3004 wrote to memory of 2996	3004	e8cb2d615c2954b14f5efa245b8a4b9d0fd90043d65b0d03a40896a0af1c9ef2.exe	29
PID 3004 wrote to memory of 2996	3004	e8cb2d615c2954b14f5efa245b8a4b9d0fd90043d65b0d03a40896a0af1c9ef2.exe	29
PID 3004 wrote to memory of 2996	3004	e8cb2d615c2954b14f5efa245b8a4b9d0fd90043d65b0d03a40896a0af1c9ef2.exe	29
PID 3004 wrote to memory of 2996	3004	e8cb2d615c2954b14f5efa245b8a4b9d0fd90043d65b0d03a40896a0af1c9ef2.exe	29
PID 3004 wrote to memory of 2996	3004	e8cb2d615c2954b14f5efa245b8a4b9d0fd90043d65b0d03a40896a0af1c9ef2.exe	29
PID 3004 wrote to memory of 2996	3004	e8cb2d615c2954b14f5efa245b8a4b9d0fd90043d65b0d03a40896a0af1c9ef2.exe	29
PID 3004 wrote to memory of 2996	3004	e8cb2d615c2954b14f5efa245b8a4b9d0fd90043d65b0d03a40896a0af1c9ef2.exe	29
PID 3004 wrote to memory of 2996	3004	e8cb2d615c2954b14f5efa245b8a4b9d0fd90043d65b0d03a40896a0af1c9ef2.exe	29
PID 3004 wrote to memory of 2996	3004	e8cb2d615c2954b14f5efa245b8a4b9d0fd90043d65b0d03a40896a0af1c9ef2.exe	29
PID 3004 wrote to memory of 2996	3004	e8cb2d615c2954b14f5efa245b8a4b9d0fd90043d65b0d03a40896a0af1c9ef2.exe	29
PID 3004 wrote to memory of 2996	3004	e8cb2d615c2954b14f5efa245b8a4b9d0fd90043d65b0d03a40896a0af1c9ef2.exe	29
PID 3004 wrote to memory of 2724	3004	e8cb2d615c2954b14f5efa245b8a4b9d0fd90043d65b0d03a40896a0af1c9ef2.exe	30
PID 3004 wrote to memory of 2724	3004	e8cb2d615c2954b14f5efa245b8a4b9d0fd90043d65b0d03a40896a0af1c9ef2.exe	30
PID 3004 wrote to memory of 2724	3004	e8cb2d615c2954b14f5efa245b8a4b9d0fd90043d65b0d03a40896a0af1c9ef2.exe	30
PID 3004 wrote to memory of 2724	3004	e8cb2d615c2954b14f5efa245b8a4b9d0fd90043d65b0d03a40896a0af1c9ef2.exe	30

C:\Users\Admin\AppData\Local\Temp\e8cb2d615c2954b14f5efa245b8a4b9d0fd90043d65b0d03a40896a0af1c9ef2.exe
"C:\Users\Admin\AppData\Local\Temp\e8cb2d615c2954b14f5efa245b8a4b9d0fd90043d65b0d03a40896a0af1c9ef2.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3004
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
  2⤵
  PID:2996
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3004 -s 92
  2⤵
  - Program crash
  PID:2724

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2996-0-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/2996-2-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/2996-4-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/2996-6-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/2996-8-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/2996-10-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/2996-12-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmp

Filesize
4KB

Download
memory/2996-13-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/2996-15-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/2996-17-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/2996-18-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/2996-19-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download

Analysis

Sharing