mystic | 16e36ae9985d4d513510b2af45f9a1d1376e2d8bb3bc60c19a4cdf3e142832c4

General

Target

16e36ae9985d4d513510b2af45f9a1d1376e2d8bb3bc60c19a4cdf3e142832c4.exe
Size

379KB
MD5

80340c32fb1064004ecd02bf07e9f1c6
SHA1

b9181ae34632384351b3a15835ec9a28e1bf784d
SHA256

16e36ae9985d4d513510b2af45f9a1d1376e2d8bb3bc60c19a4cdf3e142832c4
SHA512

622b190fa3ff56b4f7d64945eb9aab4f83af7acc0dcce0ac09f934ad1d24e453b9046dc9228f2c9e7d5b2e02fd6e66d9ff68fa95628aed47fd923af9690745c7
SSDEEP

6144:kZvcRgs3r9vIum2Tg0N63KAO2Lxmx+rUwRBq89D6d6hWdg3F:kZkRP3r9Hme0L2fwRM89NWS3F

Score

10^/10

Malware Config

Signatures

Detect Mystic stealer payload 6 IoCs

resource	yara_rule
behavioral1/memory/2916-3-0x0000000000400000-0x0000000000428000-memory.dmp	family_mystic
behavioral1/memory/2916-4-0x0000000000400000-0x0000000000428000-memory.dmp	family_mystic
behavioral1/memory/2916-5-0x0000000000400000-0x0000000000428000-memory.dmp	family_mystic
behavioral1/memory/2916-7-0x0000000000400000-0x0000000000428000-memory.dmp	family_mystic
behavioral1/memory/2916-9-0x0000000000400000-0x0000000000428000-memory.dmp	family_mystic
behavioral1/memory/2916-11-0x0000000000400000-0x0000000000428000-memory.dmp	family_mystic

Mystic
Mystic is an infostealer written in C++.
stealer mystic

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2584 set thread context of 2916	2584	16e36ae9985d4d513510b2af45f9a1d1376e2d8bb3bc60c19a4cdf3e142832c4.exe	28

Program crash 2 IoCs

pid	pid_target	Process	procid_target
2084	2584	WerFault.exe	27
2636	2916	WerFault.exe	28

Suspicious use of WriteProcessMemory 25 IoCs

description	pid	Process	procid_target
PID 2584 wrote to memory of 2916	2584	16e36ae9985d4d513510b2af45f9a1d1376e2d8bb3bc60c19a4cdf3e142832c4.exe	28
PID 2584 wrote to memory of 2916	2584	16e36ae9985d4d513510b2af45f9a1d1376e2d8bb3bc60c19a4cdf3e142832c4.exe	28
PID 2584 wrote to memory of 2916	2584	16e36ae9985d4d513510b2af45f9a1d1376e2d8bb3bc60c19a4cdf3e142832c4.exe	28
PID 2584 wrote to memory of 2916	2584	16e36ae9985d4d513510b2af45f9a1d1376e2d8bb3bc60c19a4cdf3e142832c4.exe	28
PID 2584 wrote to memory of 2916	2584	16e36ae9985d4d513510b2af45f9a1d1376e2d8bb3bc60c19a4cdf3e142832c4.exe	28
PID 2584 wrote to memory of 2916	2584	16e36ae9985d4d513510b2af45f9a1d1376e2d8bb3bc60c19a4cdf3e142832c4.exe	28
PID 2584 wrote to memory of 2916	2584	16e36ae9985d4d513510b2af45f9a1d1376e2d8bb3bc60c19a4cdf3e142832c4.exe	28
PID 2584 wrote to memory of 2916	2584	16e36ae9985d4d513510b2af45f9a1d1376e2d8bb3bc60c19a4cdf3e142832c4.exe	28
PID 2584 wrote to memory of 2916	2584	16e36ae9985d4d513510b2af45f9a1d1376e2d8bb3bc60c19a4cdf3e142832c4.exe	28
PID 2584 wrote to memory of 2916	2584	16e36ae9985d4d513510b2af45f9a1d1376e2d8bb3bc60c19a4cdf3e142832c4.exe	28
PID 2584 wrote to memory of 2916	2584	16e36ae9985d4d513510b2af45f9a1d1376e2d8bb3bc60c19a4cdf3e142832c4.exe	28
PID 2584 wrote to memory of 2916	2584	16e36ae9985d4d513510b2af45f9a1d1376e2d8bb3bc60c19a4cdf3e142832c4.exe	28
PID 2584 wrote to memory of 2916	2584	16e36ae9985d4d513510b2af45f9a1d1376e2d8bb3bc60c19a4cdf3e142832c4.exe	28
PID 2584 wrote to memory of 2916	2584	16e36ae9985d4d513510b2af45f9a1d1376e2d8bb3bc60c19a4cdf3e142832c4.exe	28
PID 2584 wrote to memory of 2084	2584	16e36ae9985d4d513510b2af45f9a1d1376e2d8bb3bc60c19a4cdf3e142832c4.exe	29
PID 2584 wrote to memory of 2084	2584	16e36ae9985d4d513510b2af45f9a1d1376e2d8bb3bc60c19a4cdf3e142832c4.exe	29
PID 2584 wrote to memory of 2084	2584	16e36ae9985d4d513510b2af45f9a1d1376e2d8bb3bc60c19a4cdf3e142832c4.exe	29
PID 2584 wrote to memory of 2084	2584	16e36ae9985d4d513510b2af45f9a1d1376e2d8bb3bc60c19a4cdf3e142832c4.exe	29
PID 2916 wrote to memory of 2636	2916	AppLaunch.exe	30
PID 2916 wrote to memory of 2636	2916	AppLaunch.exe	30
PID 2916 wrote to memory of 2636	2916	AppLaunch.exe	30
PID 2916 wrote to memory of 2636	2916	AppLaunch.exe	30
PID 2916 wrote to memory of 2636	2916	AppLaunch.exe	30
PID 2916 wrote to memory of 2636	2916	AppLaunch.exe	30
PID 2916 wrote to memory of 2636	2916	AppLaunch.exe	30

C:\Users\Admin\AppData\Local\Temp\16e36ae9985d4d513510b2af45f9a1d1376e2d8bb3bc60c19a4cdf3e142832c4.exe
"C:\Users\Admin\AppData\Local\Temp\16e36ae9985d4d513510b2af45f9a1d1376e2d8bb3bc60c19a4cdf3e142832c4.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2584
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2916
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2916 -s 196
    3⤵
    - Program crash
    PID:2636
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2584 -s 92
  2⤵
  - Program crash
  PID:2084

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2916-0-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/2916-1-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/2916-2-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/2916-3-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/2916-4-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/2916-5-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/2916-6-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmp

Filesize
4KB

Download
memory/2916-7-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/2916-9-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/2916-11-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads