mystic | 5a092ed66bf853f994369cc04f9eb75af6f83274a882c41698736202f4c424eb

General

Target

5a092ed66bf853f994369cc04f9eb75af6f83274a882c41698736202f4c424eb.exe
Size

346KB
MD5

1505f2108aed0a2a2a82695d58b05893
SHA1

2e67e50580825df2da5398cbc7ba420653a35418
SHA256

5a092ed66bf853f994369cc04f9eb75af6f83274a882c41698736202f4c424eb
SHA512

96d4639e9a302c4deb74c980a38b5e71bf5fac39de1c57b1d3b16e6b7e3176362bcabef6dacae25879afa8f924b7a9c09f66b5f235c6fe386fee52207314d603
SSDEEP

6144:poCBljS9PgGzqLHvw1t6mAOEzDiU2O7X9Blc018N9MsmeYYYYVx3viKC:poqS9PgGim+zZBNBl/8rMsmIxiKC

Score

10^/10

Malware Config

Signatures

Detect Mystic stealer payload 6 IoCs

resource	yara_rule
behavioral1/memory/1716-3-0x0000000000400000-0x0000000000428000-memory.dmp	family_mystic
behavioral1/memory/1716-4-0x0000000000400000-0x0000000000428000-memory.dmp	family_mystic
behavioral1/memory/1716-5-0x0000000000400000-0x0000000000428000-memory.dmp	family_mystic
behavioral1/memory/1716-7-0x0000000000400000-0x0000000000428000-memory.dmp	family_mystic
behavioral1/memory/1716-9-0x0000000000400000-0x0000000000428000-memory.dmp	family_mystic
behavioral1/memory/1716-11-0x0000000000400000-0x0000000000428000-memory.dmp	family_mystic

Mystic
Mystic is an infostealer written in C++.
stealer mystic

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3012 set thread context of 1716	3012	5a092ed66bf853f994369cc04f9eb75af6f83274a882c41698736202f4c424eb.exe	29

Program crash 2 IoCs

pid	pid_target	Process	procid_target
2292	3012	WerFault.exe	27
3032	1716	WerFault.exe	29

Suspicious use of WriteProcessMemory 25 IoCs

description	pid	Process	procid_target
PID 3012 wrote to memory of 1716	3012	5a092ed66bf853f994369cc04f9eb75af6f83274a882c41698736202f4c424eb.exe	29
PID 3012 wrote to memory of 1716	3012	5a092ed66bf853f994369cc04f9eb75af6f83274a882c41698736202f4c424eb.exe	29
PID 3012 wrote to memory of 1716	3012	5a092ed66bf853f994369cc04f9eb75af6f83274a882c41698736202f4c424eb.exe	29
PID 3012 wrote to memory of 1716	3012	5a092ed66bf853f994369cc04f9eb75af6f83274a882c41698736202f4c424eb.exe	29
PID 3012 wrote to memory of 1716	3012	5a092ed66bf853f994369cc04f9eb75af6f83274a882c41698736202f4c424eb.exe	29
PID 3012 wrote to memory of 1716	3012	5a092ed66bf853f994369cc04f9eb75af6f83274a882c41698736202f4c424eb.exe	29
PID 3012 wrote to memory of 1716	3012	5a092ed66bf853f994369cc04f9eb75af6f83274a882c41698736202f4c424eb.exe	29
PID 3012 wrote to memory of 1716	3012	5a092ed66bf853f994369cc04f9eb75af6f83274a882c41698736202f4c424eb.exe	29
PID 3012 wrote to memory of 1716	3012	5a092ed66bf853f994369cc04f9eb75af6f83274a882c41698736202f4c424eb.exe	29
PID 3012 wrote to memory of 1716	3012	5a092ed66bf853f994369cc04f9eb75af6f83274a882c41698736202f4c424eb.exe	29
PID 3012 wrote to memory of 1716	3012	5a092ed66bf853f994369cc04f9eb75af6f83274a882c41698736202f4c424eb.exe	29
PID 3012 wrote to memory of 1716	3012	5a092ed66bf853f994369cc04f9eb75af6f83274a882c41698736202f4c424eb.exe	29
PID 3012 wrote to memory of 1716	3012	5a092ed66bf853f994369cc04f9eb75af6f83274a882c41698736202f4c424eb.exe	29
PID 3012 wrote to memory of 1716	3012	5a092ed66bf853f994369cc04f9eb75af6f83274a882c41698736202f4c424eb.exe	29
PID 3012 wrote to memory of 2292	3012	5a092ed66bf853f994369cc04f9eb75af6f83274a882c41698736202f4c424eb.exe	30
PID 3012 wrote to memory of 2292	3012	5a092ed66bf853f994369cc04f9eb75af6f83274a882c41698736202f4c424eb.exe	30
PID 3012 wrote to memory of 2292	3012	5a092ed66bf853f994369cc04f9eb75af6f83274a882c41698736202f4c424eb.exe	30
PID 3012 wrote to memory of 2292	3012	5a092ed66bf853f994369cc04f9eb75af6f83274a882c41698736202f4c424eb.exe	30
PID 1716 wrote to memory of 3032	1716	AppLaunch.exe	31
PID 1716 wrote to memory of 3032	1716	AppLaunch.exe	31
PID 1716 wrote to memory of 3032	1716	AppLaunch.exe	31
PID 1716 wrote to memory of 3032	1716	AppLaunch.exe	31
PID 1716 wrote to memory of 3032	1716	AppLaunch.exe	31
PID 1716 wrote to memory of 3032	1716	AppLaunch.exe	31
PID 1716 wrote to memory of 3032	1716	AppLaunch.exe	31

C:\Users\Admin\AppData\Local\Temp\5a092ed66bf853f994369cc04f9eb75af6f83274a882c41698736202f4c424eb.exe
"C:\Users\Admin\AppData\Local\Temp\5a092ed66bf853f994369cc04f9eb75af6f83274a882c41698736202f4c424eb.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3012
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1716
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1716 -s 196
    3⤵
    - Program crash
    PID:3032
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3012 -s 120
  2⤵
  - Program crash
  PID:2292

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1716-1-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/1716-0-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/1716-3-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/1716-4-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/1716-2-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/1716-5-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/1716-6-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmp

Filesize
4KB

Download
memory/1716-7-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/1716-9-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/1716-11-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads