mystic | 6514a3d9e7ad018c76530826eef5f7689d0c8e2a658b18a909920cc5aa4ad53e

General

Target

f6f01d9bb11a8815d92f74da8ee5754a0dc789920e2f0674b3bc2d95a0f930b9.exe
Size

364KB
MD5

8cb0cf4d594dbf49a263d7a5e5a97f66
SHA1

1e83a2c8aed3e2e7cccf50dcfbd12bdf2409b762
SHA256

f6f01d9bb11a8815d92f74da8ee5754a0dc789920e2f0674b3bc2d95a0f930b9
SHA512

be2a1e1861aef2d45037c9db565228ff44f0656b3424e775d1547616ba30b3be3282cbf682024fee3c441099d184b7df9042d05b2a0b78e2be2871d09924e3fe
SSDEEP

6144:YqXAxlt3fuPgyxhV5dAOP6xM4UWoYy0sRmZbTwkwASF0fZLLnLLB9BxwVoPGCH:YjxltWT9dLWoYy6ZbTwNafTRGCH

Score

10^/10

Malware Config

Signatures

Detect Mystic stealer payload 6 IoCs

resource	yara_rule
behavioral1/memory/2220-3-0x0000000000400000-0x0000000000428000-memory.dmp	family_mystic
behavioral1/memory/2220-4-0x0000000000400000-0x0000000000428000-memory.dmp	family_mystic
behavioral1/memory/2220-5-0x0000000000400000-0x0000000000428000-memory.dmp	family_mystic
behavioral1/memory/2220-7-0x0000000000400000-0x0000000000428000-memory.dmp	family_mystic
behavioral1/memory/2220-9-0x0000000000400000-0x0000000000428000-memory.dmp	family_mystic
behavioral1/memory/2220-11-0x0000000000400000-0x0000000000428000-memory.dmp	family_mystic

Mystic
Mystic is an infostealer written in C++.
stealer mystic

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1896 set thread context of 2220	1896	f6f01d9bb11a8815d92f74da8ee5754a0dc789920e2f0674b3bc2d95a0f930b9.exe	28

Program crash 2 IoCs

pid	pid_target	Process	procid_target
848	1896	WerFault.exe	19
2108	2220	WerFault.exe	28

Suspicious use of WriteProcessMemory 25 IoCs

description	pid	Process	procid_target
PID 1896 wrote to memory of 2220	1896	f6f01d9bb11a8815d92f74da8ee5754a0dc789920e2f0674b3bc2d95a0f930b9.exe	28
PID 1896 wrote to memory of 2220	1896	f6f01d9bb11a8815d92f74da8ee5754a0dc789920e2f0674b3bc2d95a0f930b9.exe	28
PID 1896 wrote to memory of 2220	1896	f6f01d9bb11a8815d92f74da8ee5754a0dc789920e2f0674b3bc2d95a0f930b9.exe	28
PID 1896 wrote to memory of 2220	1896	f6f01d9bb11a8815d92f74da8ee5754a0dc789920e2f0674b3bc2d95a0f930b9.exe	28
PID 1896 wrote to memory of 2220	1896	f6f01d9bb11a8815d92f74da8ee5754a0dc789920e2f0674b3bc2d95a0f930b9.exe	28
PID 1896 wrote to memory of 2220	1896	f6f01d9bb11a8815d92f74da8ee5754a0dc789920e2f0674b3bc2d95a0f930b9.exe	28
PID 1896 wrote to memory of 2220	1896	f6f01d9bb11a8815d92f74da8ee5754a0dc789920e2f0674b3bc2d95a0f930b9.exe	28
PID 1896 wrote to memory of 2220	1896	f6f01d9bb11a8815d92f74da8ee5754a0dc789920e2f0674b3bc2d95a0f930b9.exe	28
PID 1896 wrote to memory of 2220	1896	f6f01d9bb11a8815d92f74da8ee5754a0dc789920e2f0674b3bc2d95a0f930b9.exe	28
PID 1896 wrote to memory of 2220	1896	f6f01d9bb11a8815d92f74da8ee5754a0dc789920e2f0674b3bc2d95a0f930b9.exe	28
PID 1896 wrote to memory of 2220	1896	f6f01d9bb11a8815d92f74da8ee5754a0dc789920e2f0674b3bc2d95a0f930b9.exe	28
PID 1896 wrote to memory of 2220	1896	f6f01d9bb11a8815d92f74da8ee5754a0dc789920e2f0674b3bc2d95a0f930b9.exe	28
PID 1896 wrote to memory of 2220	1896	f6f01d9bb11a8815d92f74da8ee5754a0dc789920e2f0674b3bc2d95a0f930b9.exe	28
PID 1896 wrote to memory of 2220	1896	f6f01d9bb11a8815d92f74da8ee5754a0dc789920e2f0674b3bc2d95a0f930b9.exe	28
PID 1896 wrote to memory of 848	1896	f6f01d9bb11a8815d92f74da8ee5754a0dc789920e2f0674b3bc2d95a0f930b9.exe	29
PID 1896 wrote to memory of 848	1896	f6f01d9bb11a8815d92f74da8ee5754a0dc789920e2f0674b3bc2d95a0f930b9.exe	29
PID 1896 wrote to memory of 848	1896	f6f01d9bb11a8815d92f74da8ee5754a0dc789920e2f0674b3bc2d95a0f930b9.exe	29
PID 1896 wrote to memory of 848	1896	f6f01d9bb11a8815d92f74da8ee5754a0dc789920e2f0674b3bc2d95a0f930b9.exe	29
PID 2220 wrote to memory of 2108	2220	AppLaunch.exe	30
PID 2220 wrote to memory of 2108	2220	AppLaunch.exe	30
PID 2220 wrote to memory of 2108	2220	AppLaunch.exe	30
PID 2220 wrote to memory of 2108	2220	AppLaunch.exe	30
PID 2220 wrote to memory of 2108	2220	AppLaunch.exe	30
PID 2220 wrote to memory of 2108	2220	AppLaunch.exe	30
PID 2220 wrote to memory of 2108	2220	AppLaunch.exe	30

C:\Users\Admin\AppData\Local\Temp\f6f01d9bb11a8815d92f74da8ee5754a0dc789920e2f0674b3bc2d95a0f930b9.exe
"C:\Users\Admin\AppData\Local\Temp\f6f01d9bb11a8815d92f74da8ee5754a0dc789920e2f0674b3bc2d95a0f930b9.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1896
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2220
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2220 -s 196
    3⤵
    - Program crash
    PID:2108
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1896 -s 92
  2⤵
  - Program crash
  PID:848

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2220-1-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/2220-2-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/2220-3-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/2220-0-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/2220-4-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/2220-6-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmp

Filesize
4KB

Download
memory/2220-5-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/2220-7-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/2220-9-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/2220-11-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads