mystic | aa545c1bf309f1b5f7f1184dc6d5d8db634ae9ccc85c4e37a9aaf3efe593f7df

General

Target

aa545c1bf309f1b5f7f1184dc6d5d8db634ae9ccc85c4e37a9aaf3efe593f7df.exe
Size

350KB
MD5

0adaf64f19915763e4b9ae3879ffb211
SHA1

a227d1987e27f34dfc9b475cf68f6bcc9734ce8b
SHA256

aa545c1bf309f1b5f7f1184dc6d5d8db634ae9ccc85c4e37a9aaf3efe593f7df
SHA512

7c89211ecf36726687906c7ce7548fb37f689ebb166d06972139441cbabd46fe6576ba7f1bd66fda9a5bdb3f1560d09a56649f7fb814b57e575e7e1455faf651
SSDEEP

6144:ltBLsrNJmc30jXud9b7zAO/p70n6XI4rlKVAqjq3b75sN9VQaJF4S:l0xJm+bzFpwn6XI4d+NDjF4S

Score

10^/10

Malware Config

Signatures

Detect Mystic stealer payload 6 IoCs

resource	yara_rule
behavioral1/memory/1684-5-0x0000000000400000-0x0000000000428000-memory.dmp	family_mystic
behavioral1/memory/1684-4-0x0000000000400000-0x0000000000428000-memory.dmp	family_mystic
behavioral1/memory/1684-3-0x0000000000400000-0x0000000000428000-memory.dmp	family_mystic
behavioral1/memory/1684-7-0x0000000000400000-0x0000000000428000-memory.dmp	family_mystic
behavioral1/memory/1684-9-0x0000000000400000-0x0000000000428000-memory.dmp	family_mystic
behavioral1/memory/1684-11-0x0000000000400000-0x0000000000428000-memory.dmp	family_mystic

Mystic
Mystic is an infostealer written in C++.
stealer mystic

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1716 set thread context of 1684	1716	aa545c1bf309f1b5f7f1184dc6d5d8db634ae9ccc85c4e37a9aaf3efe593f7df.exe	28

Program crash 2 IoCs

pid	pid_target	Process	procid_target
2312	1716	WerFault.exe	11
2600	1684	WerFault.exe	28

Suspicious use of WriteProcessMemory 25 IoCs

description	pid	Process	procid_target
PID 1716 wrote to memory of 1684	1716	aa545c1bf309f1b5f7f1184dc6d5d8db634ae9ccc85c4e37a9aaf3efe593f7df.exe	28
PID 1716 wrote to memory of 1684	1716	aa545c1bf309f1b5f7f1184dc6d5d8db634ae9ccc85c4e37a9aaf3efe593f7df.exe	28
PID 1716 wrote to memory of 1684	1716	aa545c1bf309f1b5f7f1184dc6d5d8db634ae9ccc85c4e37a9aaf3efe593f7df.exe	28
PID 1716 wrote to memory of 1684	1716	aa545c1bf309f1b5f7f1184dc6d5d8db634ae9ccc85c4e37a9aaf3efe593f7df.exe	28
PID 1716 wrote to memory of 1684	1716	aa545c1bf309f1b5f7f1184dc6d5d8db634ae9ccc85c4e37a9aaf3efe593f7df.exe	28
PID 1716 wrote to memory of 1684	1716	aa545c1bf309f1b5f7f1184dc6d5d8db634ae9ccc85c4e37a9aaf3efe593f7df.exe	28
PID 1716 wrote to memory of 1684	1716	aa545c1bf309f1b5f7f1184dc6d5d8db634ae9ccc85c4e37a9aaf3efe593f7df.exe	28
PID 1716 wrote to memory of 1684	1716	aa545c1bf309f1b5f7f1184dc6d5d8db634ae9ccc85c4e37a9aaf3efe593f7df.exe	28
PID 1716 wrote to memory of 1684	1716	aa545c1bf309f1b5f7f1184dc6d5d8db634ae9ccc85c4e37a9aaf3efe593f7df.exe	28
PID 1716 wrote to memory of 1684	1716	aa545c1bf309f1b5f7f1184dc6d5d8db634ae9ccc85c4e37a9aaf3efe593f7df.exe	28
PID 1716 wrote to memory of 1684	1716	aa545c1bf309f1b5f7f1184dc6d5d8db634ae9ccc85c4e37a9aaf3efe593f7df.exe	28
PID 1716 wrote to memory of 1684	1716	aa545c1bf309f1b5f7f1184dc6d5d8db634ae9ccc85c4e37a9aaf3efe593f7df.exe	28
PID 1716 wrote to memory of 1684	1716	aa545c1bf309f1b5f7f1184dc6d5d8db634ae9ccc85c4e37a9aaf3efe593f7df.exe	28
PID 1716 wrote to memory of 1684	1716	aa545c1bf309f1b5f7f1184dc6d5d8db634ae9ccc85c4e37a9aaf3efe593f7df.exe	28
PID 1716 wrote to memory of 2312	1716	aa545c1bf309f1b5f7f1184dc6d5d8db634ae9ccc85c4e37a9aaf3efe593f7df.exe	29
PID 1716 wrote to memory of 2312	1716	aa545c1bf309f1b5f7f1184dc6d5d8db634ae9ccc85c4e37a9aaf3efe593f7df.exe	29
PID 1716 wrote to memory of 2312	1716	aa545c1bf309f1b5f7f1184dc6d5d8db634ae9ccc85c4e37a9aaf3efe593f7df.exe	29
PID 1716 wrote to memory of 2312	1716	aa545c1bf309f1b5f7f1184dc6d5d8db634ae9ccc85c4e37a9aaf3efe593f7df.exe	29
PID 1684 wrote to memory of 2600	1684	AppLaunch.exe	30
PID 1684 wrote to memory of 2600	1684	AppLaunch.exe	30
PID 1684 wrote to memory of 2600	1684	AppLaunch.exe	30
PID 1684 wrote to memory of 2600	1684	AppLaunch.exe	30
PID 1684 wrote to memory of 2600	1684	AppLaunch.exe	30
PID 1684 wrote to memory of 2600	1684	AppLaunch.exe	30
PID 1684 wrote to memory of 2600	1684	AppLaunch.exe	30

C:\Users\Admin\AppData\Local\Temp\aa545c1bf309f1b5f7f1184dc6d5d8db634ae9ccc85c4e37a9aaf3efe593f7df.exe
"C:\Users\Admin\AppData\Local\Temp\aa545c1bf309f1b5f7f1184dc6d5d8db634ae9ccc85c4e37a9aaf3efe593f7df.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1716
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1684
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1684 -s 196
    3⤵
    - Program crash
    PID:2600
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1716 -s 92
  2⤵
  - Program crash
  PID:2312

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1684-0-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/1684-1-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/1684-5-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/1684-6-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmp

Filesize
4KB

Download
memory/1684-4-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/1684-3-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/1684-2-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/1684-7-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/1684-9-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/1684-11-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads