mystic | 9786c99a3457f4d2a9f69ada3f2d8b0252709ecd2538e89236767e8d01c2aa4e

General

Target

9786c99a3457f4d2a9f69ada3f2d8b0252709ecd2538e89236767e8d01c2aa4e.exe
Size

364KB
MD5

fca0a7962aba661ac25cdd2c81d8c78e
SHA1

b479fe16b004dd3b19404e741e8251bc1fa9b204
SHA256

9786c99a3457f4d2a9f69ada3f2d8b0252709ecd2538e89236767e8d01c2aa4e
SHA512

fc4c2b5c28264be6ac810886b06e281be6688e7e04e26dbe3515fa178f454a7a96d16db67d48c8f08f16f9793bc16d88609fbe6a2a3500615bfe8680748001fb
SSDEEP

6144:EmXAxlt3fuPgyxhV5dAO7fWV8/dWPDEiXeWfdwoJWoPGCH:EHxltWTJfI8FWPDEPWf+oJnGCH

Score

10^/10

Malware Config

Signatures

Detect Mystic stealer payload 6 IoCs

resource	yara_rule
behavioral1/memory/3004-3-0x0000000000400000-0x0000000000428000-memory.dmp	family_mystic
behavioral1/memory/3004-4-0x0000000000400000-0x0000000000428000-memory.dmp	family_mystic
behavioral1/memory/3004-5-0x0000000000400000-0x0000000000428000-memory.dmp	family_mystic
behavioral1/memory/3004-7-0x0000000000400000-0x0000000000428000-memory.dmp	family_mystic
behavioral1/memory/3004-9-0x0000000000400000-0x0000000000428000-memory.dmp	family_mystic
behavioral1/memory/3004-11-0x0000000000400000-0x0000000000428000-memory.dmp	family_mystic

Mystic
Mystic is an infostealer written in C++.
stealer mystic

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2408 set thread context of 3004	2408	9786c99a3457f4d2a9f69ada3f2d8b0252709ecd2538e89236767e8d01c2aa4e.exe	28

Program crash 2 IoCs

pid	pid_target	Process	procid_target
620	2408	WerFault.exe	18
2916	3004	WerFault.exe	28

Suspicious use of WriteProcessMemory 25 IoCs

description	pid	Process	procid_target
PID 2408 wrote to memory of 3004	2408	9786c99a3457f4d2a9f69ada3f2d8b0252709ecd2538e89236767e8d01c2aa4e.exe	28
PID 2408 wrote to memory of 3004	2408	9786c99a3457f4d2a9f69ada3f2d8b0252709ecd2538e89236767e8d01c2aa4e.exe	28
PID 2408 wrote to memory of 3004	2408	9786c99a3457f4d2a9f69ada3f2d8b0252709ecd2538e89236767e8d01c2aa4e.exe	28
PID 2408 wrote to memory of 3004	2408	9786c99a3457f4d2a9f69ada3f2d8b0252709ecd2538e89236767e8d01c2aa4e.exe	28
PID 2408 wrote to memory of 3004	2408	9786c99a3457f4d2a9f69ada3f2d8b0252709ecd2538e89236767e8d01c2aa4e.exe	28
PID 2408 wrote to memory of 3004	2408	9786c99a3457f4d2a9f69ada3f2d8b0252709ecd2538e89236767e8d01c2aa4e.exe	28
PID 2408 wrote to memory of 3004	2408	9786c99a3457f4d2a9f69ada3f2d8b0252709ecd2538e89236767e8d01c2aa4e.exe	28
PID 2408 wrote to memory of 3004	2408	9786c99a3457f4d2a9f69ada3f2d8b0252709ecd2538e89236767e8d01c2aa4e.exe	28
PID 2408 wrote to memory of 3004	2408	9786c99a3457f4d2a9f69ada3f2d8b0252709ecd2538e89236767e8d01c2aa4e.exe	28
PID 2408 wrote to memory of 3004	2408	9786c99a3457f4d2a9f69ada3f2d8b0252709ecd2538e89236767e8d01c2aa4e.exe	28
PID 2408 wrote to memory of 3004	2408	9786c99a3457f4d2a9f69ada3f2d8b0252709ecd2538e89236767e8d01c2aa4e.exe	28
PID 2408 wrote to memory of 3004	2408	9786c99a3457f4d2a9f69ada3f2d8b0252709ecd2538e89236767e8d01c2aa4e.exe	28
PID 2408 wrote to memory of 3004	2408	9786c99a3457f4d2a9f69ada3f2d8b0252709ecd2538e89236767e8d01c2aa4e.exe	28
PID 2408 wrote to memory of 3004	2408	9786c99a3457f4d2a9f69ada3f2d8b0252709ecd2538e89236767e8d01c2aa4e.exe	28
PID 2408 wrote to memory of 620	2408	9786c99a3457f4d2a9f69ada3f2d8b0252709ecd2538e89236767e8d01c2aa4e.exe	29
PID 2408 wrote to memory of 620	2408	9786c99a3457f4d2a9f69ada3f2d8b0252709ecd2538e89236767e8d01c2aa4e.exe	29
PID 2408 wrote to memory of 620	2408	9786c99a3457f4d2a9f69ada3f2d8b0252709ecd2538e89236767e8d01c2aa4e.exe	29
PID 2408 wrote to memory of 620	2408	9786c99a3457f4d2a9f69ada3f2d8b0252709ecd2538e89236767e8d01c2aa4e.exe	29
PID 3004 wrote to memory of 2916	3004	AppLaunch.exe	30
PID 3004 wrote to memory of 2916	3004	AppLaunch.exe	30
PID 3004 wrote to memory of 2916	3004	AppLaunch.exe	30
PID 3004 wrote to memory of 2916	3004	AppLaunch.exe	30
PID 3004 wrote to memory of 2916	3004	AppLaunch.exe	30
PID 3004 wrote to memory of 2916	3004	AppLaunch.exe	30
PID 3004 wrote to memory of 2916	3004	AppLaunch.exe	30

C:\Users\Admin\AppData\Local\Temp\9786c99a3457f4d2a9f69ada3f2d8b0252709ecd2538e89236767e8d01c2aa4e.exe
"C:\Users\Admin\AppData\Local\Temp\9786c99a3457f4d2a9f69ada3f2d8b0252709ecd2538e89236767e8d01c2aa4e.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2408
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3004
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3004 -s 196
    3⤵
    - Program crash
    PID:2916
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2408 -s 92
  2⤵
  - Program crash
  PID:620

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3004-0-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/3004-1-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/3004-3-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/3004-2-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/3004-4-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/3004-5-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/3004-6-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmp

Filesize
4KB

Download
memory/3004-7-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/3004-9-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/3004-11-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads