mystic | 9371f17eecb504172e85f4cfb6656b0b406276db4321ce59d05f3442e1505b7e

General

Target

9371f17eecb504172e85f4cfb6656b0b406276db4321ce59d05f3442e1505b7e.exe
Size

379KB
MD5

82320cce4237ee3908bdfc9af6f1e9ce
SHA1

6af4625450ebae17d87e5d05c5671bf0649f3c49
SHA256

9371f17eecb504172e85f4cfb6656b0b406276db4321ce59d05f3442e1505b7e
SHA512

6983d57e1b52f70e7eaf3175c5a43d50028deefe9dddde25b4f063fa5fc87b80a40a188c189aefa17e2b4688c6593df5c06f5f33249a22f9397ac270c2c87dea
SSDEEP

6144:Ol4cRgs3r9vIum2Tg0N63KAOU7/rdu1rJAZuER2WfwTtg3F:OlvRP3r9HmeqbreJiuEFwTC3F

Score

10^/10

Malware Config

Signatures

Detect Mystic stealer payload 6 IoCs

resource	yara_rule
behavioral1/memory/1264-4-0x0000000000400000-0x0000000000428000-memory.dmp	family_mystic
behavioral1/memory/1264-3-0x0000000000400000-0x0000000000428000-memory.dmp	family_mystic
behavioral1/memory/1264-5-0x0000000000400000-0x0000000000428000-memory.dmp	family_mystic
behavioral1/memory/1264-7-0x0000000000400000-0x0000000000428000-memory.dmp	family_mystic
behavioral1/memory/1264-9-0x0000000000400000-0x0000000000428000-memory.dmp	family_mystic
behavioral1/memory/1264-11-0x0000000000400000-0x0000000000428000-memory.dmp	family_mystic

Mystic
Mystic is an infostealer written in C++.
stealer mystic

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2448 set thread context of 1264	2448	9371f17eecb504172e85f4cfb6656b0b406276db4321ce59d05f3442e1505b7e.exe	28

Program crash 2 IoCs

pid	pid_target	Process	procid_target
2432	2448	WerFault.exe	18
2672	1264	WerFault.exe	28

Suspicious use of WriteProcessMemory 25 IoCs

description	pid	Process	procid_target
PID 2448 wrote to memory of 1264	2448	9371f17eecb504172e85f4cfb6656b0b406276db4321ce59d05f3442e1505b7e.exe	28
PID 2448 wrote to memory of 1264	2448	9371f17eecb504172e85f4cfb6656b0b406276db4321ce59d05f3442e1505b7e.exe	28
PID 2448 wrote to memory of 1264	2448	9371f17eecb504172e85f4cfb6656b0b406276db4321ce59d05f3442e1505b7e.exe	28
PID 2448 wrote to memory of 1264	2448	9371f17eecb504172e85f4cfb6656b0b406276db4321ce59d05f3442e1505b7e.exe	28
PID 2448 wrote to memory of 1264	2448	9371f17eecb504172e85f4cfb6656b0b406276db4321ce59d05f3442e1505b7e.exe	28
PID 2448 wrote to memory of 1264	2448	9371f17eecb504172e85f4cfb6656b0b406276db4321ce59d05f3442e1505b7e.exe	28
PID 2448 wrote to memory of 1264	2448	9371f17eecb504172e85f4cfb6656b0b406276db4321ce59d05f3442e1505b7e.exe	28
PID 2448 wrote to memory of 1264	2448	9371f17eecb504172e85f4cfb6656b0b406276db4321ce59d05f3442e1505b7e.exe	28
PID 2448 wrote to memory of 1264	2448	9371f17eecb504172e85f4cfb6656b0b406276db4321ce59d05f3442e1505b7e.exe	28
PID 2448 wrote to memory of 1264	2448	9371f17eecb504172e85f4cfb6656b0b406276db4321ce59d05f3442e1505b7e.exe	28
PID 2448 wrote to memory of 1264	2448	9371f17eecb504172e85f4cfb6656b0b406276db4321ce59d05f3442e1505b7e.exe	28
PID 2448 wrote to memory of 1264	2448	9371f17eecb504172e85f4cfb6656b0b406276db4321ce59d05f3442e1505b7e.exe	28
PID 2448 wrote to memory of 1264	2448	9371f17eecb504172e85f4cfb6656b0b406276db4321ce59d05f3442e1505b7e.exe	28
PID 2448 wrote to memory of 1264	2448	9371f17eecb504172e85f4cfb6656b0b406276db4321ce59d05f3442e1505b7e.exe	28
PID 2448 wrote to memory of 2432	2448	9371f17eecb504172e85f4cfb6656b0b406276db4321ce59d05f3442e1505b7e.exe	29
PID 2448 wrote to memory of 2432	2448	9371f17eecb504172e85f4cfb6656b0b406276db4321ce59d05f3442e1505b7e.exe	29
PID 2448 wrote to memory of 2432	2448	9371f17eecb504172e85f4cfb6656b0b406276db4321ce59d05f3442e1505b7e.exe	29
PID 2448 wrote to memory of 2432	2448	9371f17eecb504172e85f4cfb6656b0b406276db4321ce59d05f3442e1505b7e.exe	29
PID 1264 wrote to memory of 2672	1264	AppLaunch.exe	30
PID 1264 wrote to memory of 2672	1264	AppLaunch.exe	30
PID 1264 wrote to memory of 2672	1264	AppLaunch.exe	30
PID 1264 wrote to memory of 2672	1264	AppLaunch.exe	30
PID 1264 wrote to memory of 2672	1264	AppLaunch.exe	30
PID 1264 wrote to memory of 2672	1264	AppLaunch.exe	30
PID 1264 wrote to memory of 2672	1264	AppLaunch.exe	30

C:\Users\Admin\AppData\Local\Temp\9371f17eecb504172e85f4cfb6656b0b406276db4321ce59d05f3442e1505b7e.exe
"C:\Users\Admin\AppData\Local\Temp\9371f17eecb504172e85f4cfb6656b0b406276db4321ce59d05f3442e1505b7e.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2448
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1264
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1264 -s 196
    3⤵
    - Program crash
    PID:2672
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2448 -s 92
  2⤵
  - Program crash
  PID:2432

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1264-0-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/1264-1-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/1264-2-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/1264-4-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/1264-3-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/1264-5-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/1264-6-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmp

Filesize
4KB

Download
memory/1264-7-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/1264-9-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/1264-11-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads