mystic | 344f555bafa13235c6275766214887a9b7d77f0639d5b79df2020ad81383fe81

Analysis

max time kernel
151s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20230915-en
resource tags

arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
submitted
11/10/2023, 09:20

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
file.exe
Size 1016KB
Sample231011-latvgafe84
SHA256 344f555bafa13235c6275766214887a9b7d77f0639d5b79df2020ad81383fe81
MD5 da64796b21017581ed9cc9430a994bd6
SHA1 22f2c6919beb53d4847f841b3ade37a5f57a766b
SHA512 66262c6138a5ab455f64626cd9b6763832ea09d48b8375e113639022bb5ead60788c8b1d678bf86b5bff0c54fd60c20cd3e8f3e7df0b94a6c8847b13e03eba96
SSDEEP 12288:A+hAoJY0BYDKzcx9jkmP8bey7/0RDMmZZxnyUuyyuxubeg0IVAUjGhzy/9:AY7YDKzcx9jkmPe/knxyZC0gx69
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

mystic stealer

Malware Config

Extracted

Family

mystic

http://5.42.92.211/loghub/master

Signatures

Detect Mystic stealer payload 5 IoCs

resource	yara_rule
behavioral2/memory/4552-0-0x0000000000400000-0x0000000000428000-memory.dmp	family_mystic
behavioral2/memory/4552-1-0x0000000000400000-0x0000000000428000-memory.dmp	family_mystic
behavioral2/memory/4552-2-0x0000000000400000-0x0000000000428000-memory.dmp	family_mystic
behavioral2/memory/4552-3-0x0000000000400000-0x0000000000428000-memory.dmp	family_mystic
behavioral2/memory/4552-4-0x0000000000400000-0x0000000000428000-memory.dmp	family_mystic

Mystic
Mystic is an infostealer written in C++.
stealer mystic

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 5088 set thread context of 4552	5088	file.exe	88

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3100	5088	WerFault.exe	84

Suspicious use of WriteProcessMemory 13 IoCs

description	pid	Process	procid_target
PID 5088 wrote to memory of 4588	5088	file.exe	87
PID 5088 wrote to memory of 4588	5088	file.exe	87
PID 5088 wrote to memory of 4588	5088	file.exe	87
PID 5088 wrote to memory of 4552	5088	file.exe	88
PID 5088 wrote to memory of 4552	5088	file.exe	88
PID 5088 wrote to memory of 4552	5088	file.exe	88
PID 5088 wrote to memory of 4552	5088	file.exe	88
PID 5088 wrote to memory of 4552	5088	file.exe	88
PID 5088 wrote to memory of 4552	5088	file.exe	88
PID 5088 wrote to memory of 4552	5088	file.exe	88
PID 5088 wrote to memory of 4552	5088	file.exe	88
PID 5088 wrote to memory of 4552	5088	file.exe	88
PID 5088 wrote to memory of 4552	5088	file.exe	88

C:\Users\Admin\AppData\Local\Temp\file.exe
"C:\Users\Admin\AppData\Local\Temp\file.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:5088
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
  2⤵
  PID:4588
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
  2⤵
  PID:4552
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 5088 -s 148
  2⤵
  - Program crash
  PID:3100

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 5088 -ip 5088
1⤵
PID:2236

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4552-0-0x0000000000400000-0x0000000000428000-memory.dmp

Download

memory/4552-1-0x0000000000400000-0x0000000000428000-memory.dmp

Download

memory/4552-2-0x0000000000400000-0x0000000000428000-memory.dmp

Download

memory/4552-3-0x0000000000400000-0x0000000000428000-memory.dmp

Download

memory/4552-4-0x0000000000400000-0x0000000000428000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads