mystic | ae6f29bb2d378aacc34f5ed9c2cfdb316ec645979749ec9f8577d7ab713d407f

General

Target

ae6f29bb2d378aacc34f5ed9c2cfdb316ec645979749ec9f8577d7ab713d407f.exe
Size

379KB
MD5

31c0ca454154f7a3e4438b64101a6967
SHA1

3b8544499c65d0649d6c290d85a5c7c6f7d76077
SHA256

ae6f29bb2d378aacc34f5ed9c2cfdb316ec645979749ec9f8577d7ab713d407f
SHA512

e02c19ad9fdc66b24132d2577837692b4829202dd7652d9ad233bfa1da0092e7b663948e18e52838fe322234b2b432422876a94700be6062b0debfc9924d3580
SSDEEP

6144:qU0cRgs3r9vIum2Tg0N63KAOI/KHsS+lo0dOhFoWS69g3F:qULRP3r9Hmee/KMSEo2OgWy3F

Score

10^/10

Malware Config

Signatures

Detect Mystic stealer payload 6 IoCs

resource	yara_rule
behavioral1/memory/1720-4-0x0000000000400000-0x0000000000428000-memory.dmp	family_mystic
behavioral1/memory/1720-3-0x0000000000400000-0x0000000000428000-memory.dmp	family_mystic
behavioral1/memory/1720-7-0x0000000000400000-0x0000000000428000-memory.dmp	family_mystic
behavioral1/memory/1720-5-0x0000000000400000-0x0000000000428000-memory.dmp	family_mystic
behavioral1/memory/1720-9-0x0000000000400000-0x0000000000428000-memory.dmp	family_mystic
behavioral1/memory/1720-11-0x0000000000400000-0x0000000000428000-memory.dmp	family_mystic

Mystic
Mystic is an infostealer written in C++.
stealer mystic

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 340 set thread context of 1720	340	ae6f29bb2d378aacc34f5ed9c2cfdb316ec645979749ec9f8577d7ab713d407f.exe	28

Program crash 2 IoCs

pid	pid_target	Process	procid_target
1512	340	WerFault.exe	16
1528	1720	WerFault.exe	28

Suspicious use of WriteProcessMemory 25 IoCs

description	pid	Process	procid_target
PID 340 wrote to memory of 1720	340	ae6f29bb2d378aacc34f5ed9c2cfdb316ec645979749ec9f8577d7ab713d407f.exe	28
PID 340 wrote to memory of 1720	340	ae6f29bb2d378aacc34f5ed9c2cfdb316ec645979749ec9f8577d7ab713d407f.exe	28
PID 340 wrote to memory of 1720	340	ae6f29bb2d378aacc34f5ed9c2cfdb316ec645979749ec9f8577d7ab713d407f.exe	28
PID 340 wrote to memory of 1720	340	ae6f29bb2d378aacc34f5ed9c2cfdb316ec645979749ec9f8577d7ab713d407f.exe	28
PID 340 wrote to memory of 1720	340	ae6f29bb2d378aacc34f5ed9c2cfdb316ec645979749ec9f8577d7ab713d407f.exe	28
PID 340 wrote to memory of 1720	340	ae6f29bb2d378aacc34f5ed9c2cfdb316ec645979749ec9f8577d7ab713d407f.exe	28
PID 340 wrote to memory of 1720	340	ae6f29bb2d378aacc34f5ed9c2cfdb316ec645979749ec9f8577d7ab713d407f.exe	28
PID 340 wrote to memory of 1720	340	ae6f29bb2d378aacc34f5ed9c2cfdb316ec645979749ec9f8577d7ab713d407f.exe	28
PID 340 wrote to memory of 1720	340	ae6f29bb2d378aacc34f5ed9c2cfdb316ec645979749ec9f8577d7ab713d407f.exe	28
PID 340 wrote to memory of 1720	340	ae6f29bb2d378aacc34f5ed9c2cfdb316ec645979749ec9f8577d7ab713d407f.exe	28
PID 340 wrote to memory of 1720	340	ae6f29bb2d378aacc34f5ed9c2cfdb316ec645979749ec9f8577d7ab713d407f.exe	28
PID 340 wrote to memory of 1720	340	ae6f29bb2d378aacc34f5ed9c2cfdb316ec645979749ec9f8577d7ab713d407f.exe	28
PID 340 wrote to memory of 1720	340	ae6f29bb2d378aacc34f5ed9c2cfdb316ec645979749ec9f8577d7ab713d407f.exe	28
PID 340 wrote to memory of 1720	340	ae6f29bb2d378aacc34f5ed9c2cfdb316ec645979749ec9f8577d7ab713d407f.exe	28
PID 340 wrote to memory of 1512	340	ae6f29bb2d378aacc34f5ed9c2cfdb316ec645979749ec9f8577d7ab713d407f.exe	29
PID 340 wrote to memory of 1512	340	ae6f29bb2d378aacc34f5ed9c2cfdb316ec645979749ec9f8577d7ab713d407f.exe	29
PID 340 wrote to memory of 1512	340	ae6f29bb2d378aacc34f5ed9c2cfdb316ec645979749ec9f8577d7ab713d407f.exe	29
PID 340 wrote to memory of 1512	340	ae6f29bb2d378aacc34f5ed9c2cfdb316ec645979749ec9f8577d7ab713d407f.exe	29
PID 1720 wrote to memory of 1528	1720	AppLaunch.exe	30
PID 1720 wrote to memory of 1528	1720	AppLaunch.exe	30
PID 1720 wrote to memory of 1528	1720	AppLaunch.exe	30
PID 1720 wrote to memory of 1528	1720	AppLaunch.exe	30
PID 1720 wrote to memory of 1528	1720	AppLaunch.exe	30
PID 1720 wrote to memory of 1528	1720	AppLaunch.exe	30
PID 1720 wrote to memory of 1528	1720	AppLaunch.exe	30

C:\Users\Admin\AppData\Local\Temp\ae6f29bb2d378aacc34f5ed9c2cfdb316ec645979749ec9f8577d7ab713d407f.exe
"C:\Users\Admin\AppData\Local\Temp\ae6f29bb2d378aacc34f5ed9c2cfdb316ec645979749ec9f8577d7ab713d407f.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:340
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1720
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1720 -s 196
    3⤵
    - Program crash
    PID:1528
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 340 -s 92
  2⤵
  - Program crash
  PID:1512

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1720-2-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/1720-1-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/1720-0-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/1720-4-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/1720-3-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/1720-6-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmp

Filesize
4KB

Download
memory/1720-7-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/1720-5-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/1720-9-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/1720-11-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads