mystic | 8bc0d66ff5a18280e245f716319d59c2b001138fc373ae32590d4557f1ad1014

General

Target

8bc0d66ff5a18280e245f716319d59c2b001138fc373ae32590d4557f1ad1014.exe
Size

379KB
MD5

6f37d7fbd8dbc935e5b9884f0ae6ac11
SHA1

99f0002e98cc5cf12248f8c36e816a5a6e0f175f
SHA256

8bc0d66ff5a18280e245f716319d59c2b001138fc373ae32590d4557f1ad1014
SHA512

fc8ddbdd29273526d59d622280ef1a3861d3ebcf528afef1b2e02651d035340c01c7b74191211cf9a379efa3e5c1c81b77d80c774132501e86376a0eecbc15f0
SSDEEP

6144:4nGcRgs3r9vIum2Tg0N63KAOqdMl0kHlsaai3aLfwzioj05LAg3F:4n9RP3r9HmegmlsaawaLfJb3F

Score

10^/10

Malware Config

Signatures

Detect Mystic stealer payload 6 IoCs

resource	yara_rule
behavioral1/memory/1892-3-0x0000000000400000-0x0000000000428000-memory.dmp	family_mystic
behavioral1/memory/1892-4-0x0000000000400000-0x0000000000428000-memory.dmp	family_mystic
behavioral1/memory/1892-5-0x0000000000400000-0x0000000000428000-memory.dmp	family_mystic
behavioral1/memory/1892-7-0x0000000000400000-0x0000000000428000-memory.dmp	family_mystic
behavioral1/memory/1892-9-0x0000000000400000-0x0000000000428000-memory.dmp	family_mystic
behavioral1/memory/1892-11-0x0000000000400000-0x0000000000428000-memory.dmp	family_mystic

Mystic
Mystic is an infostealer written in C++.
stealer mystic

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2236 set thread context of 1892	2236	8bc0d66ff5a18280e245f716319d59c2b001138fc373ae32590d4557f1ad1014.exe	28

Program crash 2 IoCs

pid	pid_target	Process	procid_target
2612	2236	WerFault.exe	27
2116	1892	WerFault.exe	28

Suspicious use of WriteProcessMemory 25 IoCs

description	pid	Process	procid_target
PID 2236 wrote to memory of 1892	2236	8bc0d66ff5a18280e245f716319d59c2b001138fc373ae32590d4557f1ad1014.exe	28
PID 2236 wrote to memory of 1892	2236	8bc0d66ff5a18280e245f716319d59c2b001138fc373ae32590d4557f1ad1014.exe	28
PID 2236 wrote to memory of 1892	2236	8bc0d66ff5a18280e245f716319d59c2b001138fc373ae32590d4557f1ad1014.exe	28
PID 2236 wrote to memory of 1892	2236	8bc0d66ff5a18280e245f716319d59c2b001138fc373ae32590d4557f1ad1014.exe	28
PID 2236 wrote to memory of 1892	2236	8bc0d66ff5a18280e245f716319d59c2b001138fc373ae32590d4557f1ad1014.exe	28
PID 2236 wrote to memory of 1892	2236	8bc0d66ff5a18280e245f716319d59c2b001138fc373ae32590d4557f1ad1014.exe	28
PID 2236 wrote to memory of 1892	2236	8bc0d66ff5a18280e245f716319d59c2b001138fc373ae32590d4557f1ad1014.exe	28
PID 2236 wrote to memory of 1892	2236	8bc0d66ff5a18280e245f716319d59c2b001138fc373ae32590d4557f1ad1014.exe	28
PID 2236 wrote to memory of 1892	2236	8bc0d66ff5a18280e245f716319d59c2b001138fc373ae32590d4557f1ad1014.exe	28
PID 2236 wrote to memory of 1892	2236	8bc0d66ff5a18280e245f716319d59c2b001138fc373ae32590d4557f1ad1014.exe	28
PID 2236 wrote to memory of 1892	2236	8bc0d66ff5a18280e245f716319d59c2b001138fc373ae32590d4557f1ad1014.exe	28
PID 2236 wrote to memory of 1892	2236	8bc0d66ff5a18280e245f716319d59c2b001138fc373ae32590d4557f1ad1014.exe	28
PID 2236 wrote to memory of 1892	2236	8bc0d66ff5a18280e245f716319d59c2b001138fc373ae32590d4557f1ad1014.exe	28
PID 2236 wrote to memory of 1892	2236	8bc0d66ff5a18280e245f716319d59c2b001138fc373ae32590d4557f1ad1014.exe	28
PID 2236 wrote to memory of 2612	2236	8bc0d66ff5a18280e245f716319d59c2b001138fc373ae32590d4557f1ad1014.exe	29
PID 2236 wrote to memory of 2612	2236	8bc0d66ff5a18280e245f716319d59c2b001138fc373ae32590d4557f1ad1014.exe	29
PID 2236 wrote to memory of 2612	2236	8bc0d66ff5a18280e245f716319d59c2b001138fc373ae32590d4557f1ad1014.exe	29
PID 2236 wrote to memory of 2612	2236	8bc0d66ff5a18280e245f716319d59c2b001138fc373ae32590d4557f1ad1014.exe	29
PID 1892 wrote to memory of 2116	1892	AppLaunch.exe	30
PID 1892 wrote to memory of 2116	1892	AppLaunch.exe	30
PID 1892 wrote to memory of 2116	1892	AppLaunch.exe	30
PID 1892 wrote to memory of 2116	1892	AppLaunch.exe	30
PID 1892 wrote to memory of 2116	1892	AppLaunch.exe	30
PID 1892 wrote to memory of 2116	1892	AppLaunch.exe	30
PID 1892 wrote to memory of 2116	1892	AppLaunch.exe	30

C:\Users\Admin\AppData\Local\Temp\8bc0d66ff5a18280e245f716319d59c2b001138fc373ae32590d4557f1ad1014.exe
"C:\Users\Admin\AppData\Local\Temp\8bc0d66ff5a18280e245f716319d59c2b001138fc373ae32590d4557f1ad1014.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2236
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1892
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1892 -s 196
    3⤵
    - Program crash
    PID:2116
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2236 -s 92
  2⤵
  - Program crash
  PID:2612

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1892-0-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/1892-1-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/1892-2-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/1892-3-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/1892-4-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/1892-5-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/1892-6-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmp

Filesize
4KB

Download
memory/1892-7-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/1892-9-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/1892-11-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads