mystic | ae6404217d9bbe5213a9bc7d8a93d085c6e11190ca533b5bb09cfa346ef831b7

General

Target

ae6404217d9bbe5213a9bc7d8a93d085c6e11190ca533b5bb09cfa346ef831b7.exe
Size

346KB
MD5

276174b4255e7bc8ae5d626c19761be2
SHA1

fad3e08d3a065268a713bab0e46359ffa45f5b60
SHA256

ae6404217d9bbe5213a9bc7d8a93d085c6e11190ca533b5bb09cfa346ef831b7
SHA512

664f718aaf39cbfc5a1b912754d7ee36de662ef28565e081f91ea85b98acd1790f2d5ddd1694e543da3c9c3cde1b38eb2dcf21854ad33901b692831b039f6023
SSDEEP

6144:8WCGljS9PgGzqLHvw1t6mAOpM0Uyyc/umU2nDY22bReuSVaxL3viKC:8W7S9PgGim0T+9UUDY22bdxziKC

Score

10^/10

Malware Config

Signatures

Detect Mystic stealer payload 6 IoCs

resource	yara_rule
behavioral1/memory/2416-4-0x0000000000400000-0x0000000000428000-memory.dmp	family_mystic
behavioral1/memory/2416-5-0x0000000000400000-0x0000000000428000-memory.dmp	family_mystic
behavioral1/memory/2416-6-0x0000000000400000-0x0000000000428000-memory.dmp	family_mystic
behavioral1/memory/2416-8-0x0000000000400000-0x0000000000428000-memory.dmp	family_mystic
behavioral1/memory/2416-10-0x0000000000400000-0x0000000000428000-memory.dmp	family_mystic
behavioral1/memory/2416-12-0x0000000000400000-0x0000000000428000-memory.dmp	family_mystic

Mystic
Mystic is an infostealer written in C++.
stealer mystic

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2108 set thread context of 2416	2108	ae6404217d9bbe5213a9bc7d8a93d085c6e11190ca533b5bb09cfa346ef831b7.exe	29

Program crash 2 IoCs

pid	pid_target	Process	procid_target
1824	2108	WerFault.exe	27
2580	2416	WerFault.exe	29

Suspicious use of WriteProcessMemory 25 IoCs

description	pid	Process	procid_target
PID 2108 wrote to memory of 2416	2108	ae6404217d9bbe5213a9bc7d8a93d085c6e11190ca533b5bb09cfa346ef831b7.exe	29
PID 2108 wrote to memory of 2416	2108	ae6404217d9bbe5213a9bc7d8a93d085c6e11190ca533b5bb09cfa346ef831b7.exe	29
PID 2108 wrote to memory of 2416	2108	ae6404217d9bbe5213a9bc7d8a93d085c6e11190ca533b5bb09cfa346ef831b7.exe	29
PID 2108 wrote to memory of 2416	2108	ae6404217d9bbe5213a9bc7d8a93d085c6e11190ca533b5bb09cfa346ef831b7.exe	29
PID 2108 wrote to memory of 2416	2108	ae6404217d9bbe5213a9bc7d8a93d085c6e11190ca533b5bb09cfa346ef831b7.exe	29
PID 2108 wrote to memory of 2416	2108	ae6404217d9bbe5213a9bc7d8a93d085c6e11190ca533b5bb09cfa346ef831b7.exe	29
PID 2108 wrote to memory of 2416	2108	ae6404217d9bbe5213a9bc7d8a93d085c6e11190ca533b5bb09cfa346ef831b7.exe	29
PID 2108 wrote to memory of 2416	2108	ae6404217d9bbe5213a9bc7d8a93d085c6e11190ca533b5bb09cfa346ef831b7.exe	29
PID 2108 wrote to memory of 2416	2108	ae6404217d9bbe5213a9bc7d8a93d085c6e11190ca533b5bb09cfa346ef831b7.exe	29
PID 2108 wrote to memory of 2416	2108	ae6404217d9bbe5213a9bc7d8a93d085c6e11190ca533b5bb09cfa346ef831b7.exe	29
PID 2108 wrote to memory of 2416	2108	ae6404217d9bbe5213a9bc7d8a93d085c6e11190ca533b5bb09cfa346ef831b7.exe	29
PID 2108 wrote to memory of 2416	2108	ae6404217d9bbe5213a9bc7d8a93d085c6e11190ca533b5bb09cfa346ef831b7.exe	29
PID 2108 wrote to memory of 2416	2108	ae6404217d9bbe5213a9bc7d8a93d085c6e11190ca533b5bb09cfa346ef831b7.exe	29
PID 2108 wrote to memory of 2416	2108	ae6404217d9bbe5213a9bc7d8a93d085c6e11190ca533b5bb09cfa346ef831b7.exe	29
PID 2108 wrote to memory of 1824	2108	ae6404217d9bbe5213a9bc7d8a93d085c6e11190ca533b5bb09cfa346ef831b7.exe	30
PID 2108 wrote to memory of 1824	2108	ae6404217d9bbe5213a9bc7d8a93d085c6e11190ca533b5bb09cfa346ef831b7.exe	30
PID 2108 wrote to memory of 1824	2108	ae6404217d9bbe5213a9bc7d8a93d085c6e11190ca533b5bb09cfa346ef831b7.exe	30
PID 2108 wrote to memory of 1824	2108	ae6404217d9bbe5213a9bc7d8a93d085c6e11190ca533b5bb09cfa346ef831b7.exe	30
PID 2416 wrote to memory of 2580	2416	AppLaunch.exe	31
PID 2416 wrote to memory of 2580	2416	AppLaunch.exe	31
PID 2416 wrote to memory of 2580	2416	AppLaunch.exe	31
PID 2416 wrote to memory of 2580	2416	AppLaunch.exe	31
PID 2416 wrote to memory of 2580	2416	AppLaunch.exe	31
PID 2416 wrote to memory of 2580	2416	AppLaunch.exe	31
PID 2416 wrote to memory of 2580	2416	AppLaunch.exe	31

C:\Users\Admin\AppData\Local\Temp\ae6404217d9bbe5213a9bc7d8a93d085c6e11190ca533b5bb09cfa346ef831b7.exe
"C:\Users\Admin\AppData\Local\Temp\ae6404217d9bbe5213a9bc7d8a93d085c6e11190ca533b5bb09cfa346ef831b7.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2108
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2416
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2416 -s 196
    3⤵
    - Program crash
    PID:2580
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2108 -s 120
  2⤵
  - Program crash
  PID:1824

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2416-0-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/2416-1-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/2416-2-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/2416-4-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/2416-5-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/2416-6-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/2416-7-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmp

Filesize
4KB

Download
memory/2416-8-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/2416-10-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/2416-12-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads