mystic | c84a5d84e0bbb6e22a908d94311f8194d3e434aedaabc87f9daa8845979326c6

General

Target

c84a5d84e0bbb6e22a908d94311f8194d3e434aedaabc87f9daa8845979326c6.exe
Size

379KB
MD5

4c8ff63a12b1d0e762bc3ddbe7cc2c39
SHA1

fabd4d57e69b13b7b0e66fa889678605bb626be8
SHA256

c84a5d84e0bbb6e22a908d94311f8194d3e434aedaabc87f9daa8845979326c6
SHA512

ca2c67bf8f20179b2c18b149c9c4068b5aee679d13938316be77723fa5379498638d4e470bb62d60f29304180c05ea687f2376f64645fe4fc2699e42f4487ce1
SSDEEP

6144:9a+cRgs3r9vIum2Tg0N63KAOD+q8PQEgm9BsPrghYz87JxUztRSg3F:9aVRP3r9Hmelt8PQ498g6zMxk/p3F

Score

10^/10

Malware Config

Signatures

Detect Mystic stealer payload 6 IoCs

resource	yara_rule
behavioral1/memory/2760-3-0x0000000000400000-0x0000000000428000-memory.dmp	family_mystic
behavioral1/memory/2760-4-0x0000000000400000-0x0000000000428000-memory.dmp	family_mystic
behavioral1/memory/2760-5-0x0000000000400000-0x0000000000428000-memory.dmp	family_mystic
behavioral1/memory/2760-7-0x0000000000400000-0x0000000000428000-memory.dmp	family_mystic
behavioral1/memory/2760-9-0x0000000000400000-0x0000000000428000-memory.dmp	family_mystic
behavioral1/memory/2760-11-0x0000000000400000-0x0000000000428000-memory.dmp	family_mystic

Mystic
Mystic is an infostealer written in C++.
stealer mystic

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2696 set thread context of 2760	2696	c84a5d84e0bbb6e22a908d94311f8194d3e434aedaabc87f9daa8845979326c6.exe	28

Program crash 2 IoCs

pid	pid_target	Process	procid_target
2756	2696	WerFault.exe	16
2052	2760	WerFault.exe	28

Suspicious use of WriteProcessMemory 25 IoCs

description	pid	Process	procid_target
PID 2696 wrote to memory of 2760	2696	c84a5d84e0bbb6e22a908d94311f8194d3e434aedaabc87f9daa8845979326c6.exe	28
PID 2696 wrote to memory of 2760	2696	c84a5d84e0bbb6e22a908d94311f8194d3e434aedaabc87f9daa8845979326c6.exe	28
PID 2696 wrote to memory of 2760	2696	c84a5d84e0bbb6e22a908d94311f8194d3e434aedaabc87f9daa8845979326c6.exe	28
PID 2696 wrote to memory of 2760	2696	c84a5d84e0bbb6e22a908d94311f8194d3e434aedaabc87f9daa8845979326c6.exe	28
PID 2696 wrote to memory of 2760	2696	c84a5d84e0bbb6e22a908d94311f8194d3e434aedaabc87f9daa8845979326c6.exe	28
PID 2696 wrote to memory of 2760	2696	c84a5d84e0bbb6e22a908d94311f8194d3e434aedaabc87f9daa8845979326c6.exe	28
PID 2696 wrote to memory of 2760	2696	c84a5d84e0bbb6e22a908d94311f8194d3e434aedaabc87f9daa8845979326c6.exe	28
PID 2696 wrote to memory of 2760	2696	c84a5d84e0bbb6e22a908d94311f8194d3e434aedaabc87f9daa8845979326c6.exe	28
PID 2696 wrote to memory of 2760	2696	c84a5d84e0bbb6e22a908d94311f8194d3e434aedaabc87f9daa8845979326c6.exe	28
PID 2696 wrote to memory of 2760	2696	c84a5d84e0bbb6e22a908d94311f8194d3e434aedaabc87f9daa8845979326c6.exe	28
PID 2696 wrote to memory of 2760	2696	c84a5d84e0bbb6e22a908d94311f8194d3e434aedaabc87f9daa8845979326c6.exe	28
PID 2696 wrote to memory of 2760	2696	c84a5d84e0bbb6e22a908d94311f8194d3e434aedaabc87f9daa8845979326c6.exe	28
PID 2696 wrote to memory of 2760	2696	c84a5d84e0bbb6e22a908d94311f8194d3e434aedaabc87f9daa8845979326c6.exe	28
PID 2696 wrote to memory of 2760	2696	c84a5d84e0bbb6e22a908d94311f8194d3e434aedaabc87f9daa8845979326c6.exe	28
PID 2696 wrote to memory of 2756	2696	c84a5d84e0bbb6e22a908d94311f8194d3e434aedaabc87f9daa8845979326c6.exe	29
PID 2696 wrote to memory of 2756	2696	c84a5d84e0bbb6e22a908d94311f8194d3e434aedaabc87f9daa8845979326c6.exe	29
PID 2696 wrote to memory of 2756	2696	c84a5d84e0bbb6e22a908d94311f8194d3e434aedaabc87f9daa8845979326c6.exe	29
PID 2696 wrote to memory of 2756	2696	c84a5d84e0bbb6e22a908d94311f8194d3e434aedaabc87f9daa8845979326c6.exe	29
PID 2760 wrote to memory of 2052	2760	AppLaunch.exe	30
PID 2760 wrote to memory of 2052	2760	AppLaunch.exe	30
PID 2760 wrote to memory of 2052	2760	AppLaunch.exe	30
PID 2760 wrote to memory of 2052	2760	AppLaunch.exe	30
PID 2760 wrote to memory of 2052	2760	AppLaunch.exe	30
PID 2760 wrote to memory of 2052	2760	AppLaunch.exe	30
PID 2760 wrote to memory of 2052	2760	AppLaunch.exe	30

C:\Users\Admin\AppData\Local\Temp\c84a5d84e0bbb6e22a908d94311f8194d3e434aedaabc87f9daa8845979326c6.exe
"C:\Users\Admin\AppData\Local\Temp\c84a5d84e0bbb6e22a908d94311f8194d3e434aedaabc87f9daa8845979326c6.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2696
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2760
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2760 -s 196
    3⤵
    - Program crash
    PID:2052
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2696 -s 92
  2⤵
  - Program crash
  PID:2756

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2760-0-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/2760-1-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/2760-2-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/2760-3-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/2760-4-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/2760-5-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/2760-7-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/2760-6-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmp

Filesize
4KB

Download
memory/2760-9-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/2760-11-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads