mystic | 17d189fd0fb7b7c3dcebc7dceb7bf060eaecf6128c13a93dd8e47c28f426891c

General

Target

17d189fd0fb7b7c3dcebc7dceb7bf060eaecf6128c13a93dd8e47c28f426891c.exe
Size

379KB
MD5

c9d3c669fdbeedde0fcf7f36a9608584
SHA1

c7511046992d060853b95fd16689f3a62291d10e
SHA256

17d189fd0fb7b7c3dcebc7dceb7bf060eaecf6128c13a93dd8e47c28f426891c
SHA512

8d5667763dc26a38a4b7146ee3d425eb2dddc1b40d7f3dbf1e787bacdfaad918a30e15d638816f922b1af64c50266b60a8f6e9df3058e21ab82250663068b0a4
SSDEEP

6144:pXXcRgs3r9vIum2Tg0N63KAOjUB1RkrwjYlz3PwJ/sGg3F:pXsRP3r9HmeJUJU3fwJs3F

Score

10^/10

Malware Config

Signatures

Detect Mystic stealer payload 6 IoCs

resource	yara_rule
behavioral1/memory/1984-3-0x0000000000400000-0x0000000000428000-memory.dmp	family_mystic
behavioral1/memory/1984-4-0x0000000000400000-0x0000000000428000-memory.dmp	family_mystic
behavioral1/memory/1984-5-0x0000000000400000-0x0000000000428000-memory.dmp	family_mystic
behavioral1/memory/1984-7-0x0000000000400000-0x0000000000428000-memory.dmp	family_mystic
behavioral1/memory/1984-9-0x0000000000400000-0x0000000000428000-memory.dmp	family_mystic
behavioral1/memory/1984-11-0x0000000000400000-0x0000000000428000-memory.dmp	family_mystic

Mystic
Mystic is an infostealer written in C++.
stealer mystic

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2404 set thread context of 1984	2404	17d189fd0fb7b7c3dcebc7dceb7bf060eaecf6128c13a93dd8e47c28f426891c.exe	28

Program crash 2 IoCs

pid	pid_target	Process	procid_target
2132	2404	WerFault.exe	17
2696	1984	WerFault.exe	28

Suspicious use of WriteProcessMemory 25 IoCs

description	pid	Process	procid_target
PID 2404 wrote to memory of 1984	2404	17d189fd0fb7b7c3dcebc7dceb7bf060eaecf6128c13a93dd8e47c28f426891c.exe	28
PID 2404 wrote to memory of 1984	2404	17d189fd0fb7b7c3dcebc7dceb7bf060eaecf6128c13a93dd8e47c28f426891c.exe	28
PID 2404 wrote to memory of 1984	2404	17d189fd0fb7b7c3dcebc7dceb7bf060eaecf6128c13a93dd8e47c28f426891c.exe	28
PID 2404 wrote to memory of 1984	2404	17d189fd0fb7b7c3dcebc7dceb7bf060eaecf6128c13a93dd8e47c28f426891c.exe	28
PID 2404 wrote to memory of 1984	2404	17d189fd0fb7b7c3dcebc7dceb7bf060eaecf6128c13a93dd8e47c28f426891c.exe	28
PID 2404 wrote to memory of 1984	2404	17d189fd0fb7b7c3dcebc7dceb7bf060eaecf6128c13a93dd8e47c28f426891c.exe	28
PID 2404 wrote to memory of 1984	2404	17d189fd0fb7b7c3dcebc7dceb7bf060eaecf6128c13a93dd8e47c28f426891c.exe	28
PID 2404 wrote to memory of 1984	2404	17d189fd0fb7b7c3dcebc7dceb7bf060eaecf6128c13a93dd8e47c28f426891c.exe	28
PID 2404 wrote to memory of 1984	2404	17d189fd0fb7b7c3dcebc7dceb7bf060eaecf6128c13a93dd8e47c28f426891c.exe	28
PID 2404 wrote to memory of 1984	2404	17d189fd0fb7b7c3dcebc7dceb7bf060eaecf6128c13a93dd8e47c28f426891c.exe	28
PID 2404 wrote to memory of 1984	2404	17d189fd0fb7b7c3dcebc7dceb7bf060eaecf6128c13a93dd8e47c28f426891c.exe	28
PID 2404 wrote to memory of 1984	2404	17d189fd0fb7b7c3dcebc7dceb7bf060eaecf6128c13a93dd8e47c28f426891c.exe	28
PID 2404 wrote to memory of 1984	2404	17d189fd0fb7b7c3dcebc7dceb7bf060eaecf6128c13a93dd8e47c28f426891c.exe	28
PID 2404 wrote to memory of 1984	2404	17d189fd0fb7b7c3dcebc7dceb7bf060eaecf6128c13a93dd8e47c28f426891c.exe	28
PID 2404 wrote to memory of 2132	2404	17d189fd0fb7b7c3dcebc7dceb7bf060eaecf6128c13a93dd8e47c28f426891c.exe	29
PID 2404 wrote to memory of 2132	2404	17d189fd0fb7b7c3dcebc7dceb7bf060eaecf6128c13a93dd8e47c28f426891c.exe	29
PID 2404 wrote to memory of 2132	2404	17d189fd0fb7b7c3dcebc7dceb7bf060eaecf6128c13a93dd8e47c28f426891c.exe	29
PID 2404 wrote to memory of 2132	2404	17d189fd0fb7b7c3dcebc7dceb7bf060eaecf6128c13a93dd8e47c28f426891c.exe	29
PID 1984 wrote to memory of 2696	1984	AppLaunch.exe	30
PID 1984 wrote to memory of 2696	1984	AppLaunch.exe	30
PID 1984 wrote to memory of 2696	1984	AppLaunch.exe	30
PID 1984 wrote to memory of 2696	1984	AppLaunch.exe	30
PID 1984 wrote to memory of 2696	1984	AppLaunch.exe	30
PID 1984 wrote to memory of 2696	1984	AppLaunch.exe	30
PID 1984 wrote to memory of 2696	1984	AppLaunch.exe	30

C:\Users\Admin\AppData\Local\Temp\17d189fd0fb7b7c3dcebc7dceb7bf060eaecf6128c13a93dd8e47c28f426891c.exe
"C:\Users\Admin\AppData\Local\Temp\17d189fd0fb7b7c3dcebc7dceb7bf060eaecf6128c13a93dd8e47c28f426891c.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2404
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1984
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1984 -s 196
    3⤵
    - Program crash
    PID:2696
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2404 -s 92
  2⤵
  - Program crash
  PID:2132

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1984-0-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/1984-1-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/1984-2-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/1984-3-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/1984-4-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/1984-5-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/1984-6-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmp

Filesize
4KB

Download
memory/1984-7-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/1984-9-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/1984-11-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads