mystic | 1b20275c8db7574c859b82f4f297513c7b87becba52b080003625fffc4fc72ad

General

Target

1b20275c8db7574c859b82f4f297513c7b87becba52b080003625fffc4fc72ad.exe
Size

379KB
MD5

9737390daf9c4cfe26fe4d61280fc734
SHA1

02f7257c497860754304983b66621ed4d2a90203
SHA256

1b20275c8db7574c859b82f4f297513c7b87becba52b080003625fffc4fc72ad
SHA512

e53a776819382b745486b4c7324aef66a9a7fef6e51728e13a6e4fb043b32cef242080994fbbcdff6666de4e34f93e5cadf0420bdb6245a20ab409ab5bc469b6
SSDEEP

6144:mXJcRgs3r9vIum2Tg0N63KAOQ9R3MBMffo2GBvszDRK6k4mYICn8y0feyIgJg3F:mXORP3r9HmeK9pCEsBvARCe3F

Score

10^/10

Malware Config

Signatures

Detect Mystic stealer payload 6 IoCs

resource	yara_rule
behavioral1/memory/2344-3-0x0000000000400000-0x0000000000428000-memory.dmp	family_mystic
behavioral1/memory/2344-4-0x0000000000400000-0x0000000000428000-memory.dmp	family_mystic
behavioral1/memory/2344-5-0x0000000000400000-0x0000000000428000-memory.dmp	family_mystic
behavioral1/memory/2344-7-0x0000000000400000-0x0000000000428000-memory.dmp	family_mystic
behavioral1/memory/2344-9-0x0000000000400000-0x0000000000428000-memory.dmp	family_mystic
behavioral1/memory/2344-11-0x0000000000400000-0x0000000000428000-memory.dmp	family_mystic

Mystic
Mystic is an infostealer written in C++.
stealer mystic

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2580 set thread context of 2344	2580	1b20275c8db7574c859b82f4f297513c7b87becba52b080003625fffc4fc72ad.exe	28

Program crash 2 IoCs

pid	pid_target	Process	procid_target
1452	2580	WerFault.exe	27
2644	2344	WerFault.exe	28

Suspicious use of WriteProcessMemory 25 IoCs

description	pid	Process	procid_target
PID 2580 wrote to memory of 2344	2580	1b20275c8db7574c859b82f4f297513c7b87becba52b080003625fffc4fc72ad.exe	28
PID 2580 wrote to memory of 2344	2580	1b20275c8db7574c859b82f4f297513c7b87becba52b080003625fffc4fc72ad.exe	28
PID 2580 wrote to memory of 2344	2580	1b20275c8db7574c859b82f4f297513c7b87becba52b080003625fffc4fc72ad.exe	28
PID 2580 wrote to memory of 2344	2580	1b20275c8db7574c859b82f4f297513c7b87becba52b080003625fffc4fc72ad.exe	28
PID 2580 wrote to memory of 2344	2580	1b20275c8db7574c859b82f4f297513c7b87becba52b080003625fffc4fc72ad.exe	28
PID 2580 wrote to memory of 2344	2580	1b20275c8db7574c859b82f4f297513c7b87becba52b080003625fffc4fc72ad.exe	28
PID 2580 wrote to memory of 2344	2580	1b20275c8db7574c859b82f4f297513c7b87becba52b080003625fffc4fc72ad.exe	28
PID 2580 wrote to memory of 2344	2580	1b20275c8db7574c859b82f4f297513c7b87becba52b080003625fffc4fc72ad.exe	28
PID 2580 wrote to memory of 2344	2580	1b20275c8db7574c859b82f4f297513c7b87becba52b080003625fffc4fc72ad.exe	28
PID 2580 wrote to memory of 2344	2580	1b20275c8db7574c859b82f4f297513c7b87becba52b080003625fffc4fc72ad.exe	28
PID 2580 wrote to memory of 2344	2580	1b20275c8db7574c859b82f4f297513c7b87becba52b080003625fffc4fc72ad.exe	28
PID 2580 wrote to memory of 2344	2580	1b20275c8db7574c859b82f4f297513c7b87becba52b080003625fffc4fc72ad.exe	28
PID 2580 wrote to memory of 2344	2580	1b20275c8db7574c859b82f4f297513c7b87becba52b080003625fffc4fc72ad.exe	28
PID 2580 wrote to memory of 2344	2580	1b20275c8db7574c859b82f4f297513c7b87becba52b080003625fffc4fc72ad.exe	28
PID 2580 wrote to memory of 1452	2580	1b20275c8db7574c859b82f4f297513c7b87becba52b080003625fffc4fc72ad.exe	29
PID 2580 wrote to memory of 1452	2580	1b20275c8db7574c859b82f4f297513c7b87becba52b080003625fffc4fc72ad.exe	29
PID 2580 wrote to memory of 1452	2580	1b20275c8db7574c859b82f4f297513c7b87becba52b080003625fffc4fc72ad.exe	29
PID 2580 wrote to memory of 1452	2580	1b20275c8db7574c859b82f4f297513c7b87becba52b080003625fffc4fc72ad.exe	29
PID 2344 wrote to memory of 2644	2344	AppLaunch.exe	30
PID 2344 wrote to memory of 2644	2344	AppLaunch.exe	30
PID 2344 wrote to memory of 2644	2344	AppLaunch.exe	30
PID 2344 wrote to memory of 2644	2344	AppLaunch.exe	30
PID 2344 wrote to memory of 2644	2344	AppLaunch.exe	30
PID 2344 wrote to memory of 2644	2344	AppLaunch.exe	30
PID 2344 wrote to memory of 2644	2344	AppLaunch.exe	30

C:\Users\Admin\AppData\Local\Temp\1b20275c8db7574c859b82f4f297513c7b87becba52b080003625fffc4fc72ad.exe
"C:\Users\Admin\AppData\Local\Temp\1b20275c8db7574c859b82f4f297513c7b87becba52b080003625fffc4fc72ad.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2580
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2344
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2344 -s 196
    3⤵
    - Program crash
    PID:2644
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2580 -s 92
  2⤵
  - Program crash
  PID:1452

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2344-0-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/2344-1-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/2344-2-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/2344-3-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/2344-4-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/2344-5-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/2344-7-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/2344-6-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmp

Filesize
4KB

Download
memory/2344-9-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/2344-11-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads