mystic | 4370af9251062edeaf536fa0770a5779c2ec59ef3f3e61050b64bb58eb4a7f9c

General

Target

4370af9251062edeaf536fa0770a5779c2ec59ef3f3e61050b64bb58eb4a7f9c.exe
Size

350KB
MD5

05f4b85c81e7d08832041807cf53662a
SHA1

282516da27d4442043ca8d8cd00bb1d3c9f26999
SHA256

4370af9251062edeaf536fa0770a5779c2ec59ef3f3e61050b64bb58eb4a7f9c
SHA512

dec29a80657315d94bb1e62c76ecb391404d2d733ca97ea5d18d24ff36245eb4eb58b5c19597c58496d2ccc25ed8e5398944e5329e424a0a0e424197c69585bf
SSDEEP

6144:bt3LsrNJmc30jXud9b7zAOhp70n6PqU6ag6AbQxsMPGXkfaJF4S:bqxJm+bzLpwn6dM6cKPGU6F4S

Score

10^/10

Malware Config

Signatures

Detect Mystic stealer payload 6 IoCs

resource	yara_rule
behavioral1/memory/2088-3-0x0000000000400000-0x0000000000428000-memory.dmp	family_mystic
behavioral1/memory/2088-5-0x0000000000400000-0x0000000000428000-memory.dmp	family_mystic
behavioral1/memory/2088-4-0x0000000000400000-0x0000000000428000-memory.dmp	family_mystic
behavioral1/memory/2088-7-0x0000000000400000-0x0000000000428000-memory.dmp	family_mystic
behavioral1/memory/2088-9-0x0000000000400000-0x0000000000428000-memory.dmp	family_mystic
behavioral1/memory/2088-11-0x0000000000400000-0x0000000000428000-memory.dmp	family_mystic

Mystic
Mystic is an infostealer written in C++.
stealer mystic

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2404 set thread context of 2088	2404	4370af9251062edeaf536fa0770a5779c2ec59ef3f3e61050b64bb58eb4a7f9c.exe	28

Program crash 2 IoCs

pid	pid_target	Process	procid_target
2724	2404	WerFault.exe	27
2808	2088	WerFault.exe	28

Suspicious use of WriteProcessMemory 25 IoCs

description	pid	Process	procid_target
PID 2404 wrote to memory of 2088	2404	4370af9251062edeaf536fa0770a5779c2ec59ef3f3e61050b64bb58eb4a7f9c.exe	28
PID 2404 wrote to memory of 2088	2404	4370af9251062edeaf536fa0770a5779c2ec59ef3f3e61050b64bb58eb4a7f9c.exe	28
PID 2404 wrote to memory of 2088	2404	4370af9251062edeaf536fa0770a5779c2ec59ef3f3e61050b64bb58eb4a7f9c.exe	28
PID 2404 wrote to memory of 2088	2404	4370af9251062edeaf536fa0770a5779c2ec59ef3f3e61050b64bb58eb4a7f9c.exe	28
PID 2404 wrote to memory of 2088	2404	4370af9251062edeaf536fa0770a5779c2ec59ef3f3e61050b64bb58eb4a7f9c.exe	28
PID 2404 wrote to memory of 2088	2404	4370af9251062edeaf536fa0770a5779c2ec59ef3f3e61050b64bb58eb4a7f9c.exe	28
PID 2404 wrote to memory of 2088	2404	4370af9251062edeaf536fa0770a5779c2ec59ef3f3e61050b64bb58eb4a7f9c.exe	28
PID 2404 wrote to memory of 2088	2404	4370af9251062edeaf536fa0770a5779c2ec59ef3f3e61050b64bb58eb4a7f9c.exe	28
PID 2404 wrote to memory of 2088	2404	4370af9251062edeaf536fa0770a5779c2ec59ef3f3e61050b64bb58eb4a7f9c.exe	28
PID 2404 wrote to memory of 2088	2404	4370af9251062edeaf536fa0770a5779c2ec59ef3f3e61050b64bb58eb4a7f9c.exe	28
PID 2404 wrote to memory of 2088	2404	4370af9251062edeaf536fa0770a5779c2ec59ef3f3e61050b64bb58eb4a7f9c.exe	28
PID 2404 wrote to memory of 2088	2404	4370af9251062edeaf536fa0770a5779c2ec59ef3f3e61050b64bb58eb4a7f9c.exe	28
PID 2404 wrote to memory of 2088	2404	4370af9251062edeaf536fa0770a5779c2ec59ef3f3e61050b64bb58eb4a7f9c.exe	28
PID 2404 wrote to memory of 2088	2404	4370af9251062edeaf536fa0770a5779c2ec59ef3f3e61050b64bb58eb4a7f9c.exe	28
PID 2404 wrote to memory of 2724	2404	4370af9251062edeaf536fa0770a5779c2ec59ef3f3e61050b64bb58eb4a7f9c.exe	29
PID 2404 wrote to memory of 2724	2404	4370af9251062edeaf536fa0770a5779c2ec59ef3f3e61050b64bb58eb4a7f9c.exe	29
PID 2404 wrote to memory of 2724	2404	4370af9251062edeaf536fa0770a5779c2ec59ef3f3e61050b64bb58eb4a7f9c.exe	29
PID 2404 wrote to memory of 2724	2404	4370af9251062edeaf536fa0770a5779c2ec59ef3f3e61050b64bb58eb4a7f9c.exe	29
PID 2088 wrote to memory of 2808	2088	AppLaunch.exe	30
PID 2088 wrote to memory of 2808	2088	AppLaunch.exe	30
PID 2088 wrote to memory of 2808	2088	AppLaunch.exe	30
PID 2088 wrote to memory of 2808	2088	AppLaunch.exe	30
PID 2088 wrote to memory of 2808	2088	AppLaunch.exe	30
PID 2088 wrote to memory of 2808	2088	AppLaunch.exe	30
PID 2088 wrote to memory of 2808	2088	AppLaunch.exe	30

C:\Users\Admin\AppData\Local\Temp\4370af9251062edeaf536fa0770a5779c2ec59ef3f3e61050b64bb58eb4a7f9c.exe
"C:\Users\Admin\AppData\Local\Temp\4370af9251062edeaf536fa0770a5779c2ec59ef3f3e61050b64bb58eb4a7f9c.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2404
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2088
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2088 -s 196
    3⤵
    - Program crash
    PID:2808
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2404 -s 92
  2⤵
  - Program crash
  PID:2724

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2088-3-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/2088-6-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmp

Filesize
4KB

Download
memory/2088-5-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/2088-4-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/2088-7-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/2088-9-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/2088-2-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/2088-1-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/2088-0-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/2088-11-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads