mystic | 766aeaa7d8a7d736f2f98ca0f932af162d2a107005a49579d6c0dcbaf6567a94

General

Target

e62fe81a4d4bd11dc112c66fd18a736dd8cb6252c1bdf22ff62e09f2a537196a.exe
Size

346KB
MD5

72e55ffb7ea5a7a1fb75c5c9de9b5481
SHA1

cf21337d4f4d48cd5366b97c4f7c7e940bfe419b
SHA256

e62fe81a4d4bd11dc112c66fd18a736dd8cb6252c1bdf22ff62e09f2a537196a
SHA512

56913ff5607ac74fffbf3257a68faf10883754cb5936105039329f8648af8181e2b7a28ccf077d9c7fd13e6ab277e1aade81c1db4e848e62bad8a2a780d0af47
SSDEEP

6144:2VCJljS9PgGzqLHvw1t6mAOZn4sHp4Wf953FOKcHGMTR1AVIMyhd4xb3XhYfOwh0:2V6S9PgGim8f6haOwJiKC

Score

10^/10

Malware Config

Signatures

Detect Mystic stealer payload 6 IoCs

resource	yara_rule
behavioral1/memory/2552-3-0x0000000000400000-0x0000000000428000-memory.dmp	family_mystic
behavioral1/memory/2552-5-0x0000000000400000-0x0000000000428000-memory.dmp	family_mystic
behavioral1/memory/2552-7-0x0000000000400000-0x0000000000428000-memory.dmp	family_mystic
behavioral1/memory/2552-4-0x0000000000400000-0x0000000000428000-memory.dmp	family_mystic
behavioral1/memory/2552-9-0x0000000000400000-0x0000000000428000-memory.dmp	family_mystic
behavioral1/memory/2552-11-0x0000000000400000-0x0000000000428000-memory.dmp	family_mystic

Mystic
Mystic is an infostealer written in C++.
stealer mystic

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2148 set thread context of 2552	2148	e62fe81a4d4bd11dc112c66fd18a736dd8cb6252c1bdf22ff62e09f2a537196a.exe	29

Program crash 2 IoCs

pid	pid_target	Process	procid_target
2140	2148	WerFault.exe	27
2208	2552	WerFault.exe	29

Suspicious use of WriteProcessMemory 25 IoCs

description	pid	Process	procid_target
PID 2148 wrote to memory of 2552	2148	e62fe81a4d4bd11dc112c66fd18a736dd8cb6252c1bdf22ff62e09f2a537196a.exe	29
PID 2148 wrote to memory of 2552	2148	e62fe81a4d4bd11dc112c66fd18a736dd8cb6252c1bdf22ff62e09f2a537196a.exe	29
PID 2148 wrote to memory of 2552	2148	e62fe81a4d4bd11dc112c66fd18a736dd8cb6252c1bdf22ff62e09f2a537196a.exe	29
PID 2148 wrote to memory of 2552	2148	e62fe81a4d4bd11dc112c66fd18a736dd8cb6252c1bdf22ff62e09f2a537196a.exe	29
PID 2148 wrote to memory of 2552	2148	e62fe81a4d4bd11dc112c66fd18a736dd8cb6252c1bdf22ff62e09f2a537196a.exe	29
PID 2148 wrote to memory of 2552	2148	e62fe81a4d4bd11dc112c66fd18a736dd8cb6252c1bdf22ff62e09f2a537196a.exe	29
PID 2148 wrote to memory of 2552	2148	e62fe81a4d4bd11dc112c66fd18a736dd8cb6252c1bdf22ff62e09f2a537196a.exe	29
PID 2148 wrote to memory of 2552	2148	e62fe81a4d4bd11dc112c66fd18a736dd8cb6252c1bdf22ff62e09f2a537196a.exe	29
PID 2148 wrote to memory of 2552	2148	e62fe81a4d4bd11dc112c66fd18a736dd8cb6252c1bdf22ff62e09f2a537196a.exe	29
PID 2148 wrote to memory of 2552	2148	e62fe81a4d4bd11dc112c66fd18a736dd8cb6252c1bdf22ff62e09f2a537196a.exe	29
PID 2148 wrote to memory of 2552	2148	e62fe81a4d4bd11dc112c66fd18a736dd8cb6252c1bdf22ff62e09f2a537196a.exe	29
PID 2148 wrote to memory of 2552	2148	e62fe81a4d4bd11dc112c66fd18a736dd8cb6252c1bdf22ff62e09f2a537196a.exe	29
PID 2148 wrote to memory of 2552	2148	e62fe81a4d4bd11dc112c66fd18a736dd8cb6252c1bdf22ff62e09f2a537196a.exe	29
PID 2148 wrote to memory of 2552	2148	e62fe81a4d4bd11dc112c66fd18a736dd8cb6252c1bdf22ff62e09f2a537196a.exe	29
PID 2148 wrote to memory of 2140	2148	e62fe81a4d4bd11dc112c66fd18a736dd8cb6252c1bdf22ff62e09f2a537196a.exe	30
PID 2148 wrote to memory of 2140	2148	e62fe81a4d4bd11dc112c66fd18a736dd8cb6252c1bdf22ff62e09f2a537196a.exe	30
PID 2148 wrote to memory of 2140	2148	e62fe81a4d4bd11dc112c66fd18a736dd8cb6252c1bdf22ff62e09f2a537196a.exe	30
PID 2148 wrote to memory of 2140	2148	e62fe81a4d4bd11dc112c66fd18a736dd8cb6252c1bdf22ff62e09f2a537196a.exe	30
PID 2552 wrote to memory of 2208	2552	AppLaunch.exe	31
PID 2552 wrote to memory of 2208	2552	AppLaunch.exe	31
PID 2552 wrote to memory of 2208	2552	AppLaunch.exe	31
PID 2552 wrote to memory of 2208	2552	AppLaunch.exe	31
PID 2552 wrote to memory of 2208	2552	AppLaunch.exe	31
PID 2552 wrote to memory of 2208	2552	AppLaunch.exe	31
PID 2552 wrote to memory of 2208	2552	AppLaunch.exe	31

C:\Users\Admin\AppData\Local\Temp\e62fe81a4d4bd11dc112c66fd18a736dd8cb6252c1bdf22ff62e09f2a537196a.exe
"C:\Users\Admin\AppData\Local\Temp\e62fe81a4d4bd11dc112c66fd18a736dd8cb6252c1bdf22ff62e09f2a537196a.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2148
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2552
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2552 -s 196
    3⤵
    - Program crash
    PID:2208
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2148 -s 120
  2⤵
  - Program crash
  PID:2140

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2552-0-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/2552-1-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/2552-2-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/2552-3-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/2552-6-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmp

Filesize
4KB

Download
memory/2552-5-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/2552-7-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/2552-4-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/2552-9-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/2552-11-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads