mystic | 796f5369ed4d947f9f6544f50e8ebd195421c58163d2241d9379dd5bf714ec53

General

Target

796f5369ed4d947f9f6544f50e8ebd195421c58163d2241d9379dd5bf714ec53.exe
Size

379KB
MD5

1f8728d2b389a2814ccee557d45f5aab
SHA1

70ea98485c30970d10fa44a5f7a44c3613c45cea
SHA256

796f5369ed4d947f9f6544f50e8ebd195421c58163d2241d9379dd5bf714ec53
SHA512

aa9b8f7291bac60cd8c2d35e48ba3af4fb97ce495e67aaac0be97b826a6a13fc30f1e0729c2bd00acb031530a0ce6b3de433bb30ab11ad78092734508e696289
SSDEEP

6144:JaqcRgs3r9vIum2Tg0N63KAOP++hDSWqiPJ8vEDhNAdg3F:JaRRP3r9Hmep+CeUJog93F

Score

10^/10

Malware Config

Signatures

Detect Mystic stealer payload 6 IoCs

resource	yara_rule
behavioral1/memory/2216-3-0x0000000000400000-0x0000000000428000-memory.dmp	family_mystic
behavioral1/memory/2216-4-0x0000000000400000-0x0000000000428000-memory.dmp	family_mystic
behavioral1/memory/2216-5-0x0000000000400000-0x0000000000428000-memory.dmp	family_mystic
behavioral1/memory/2216-7-0x0000000000400000-0x0000000000428000-memory.dmp	family_mystic
behavioral1/memory/2216-9-0x0000000000400000-0x0000000000428000-memory.dmp	family_mystic
behavioral1/memory/2216-11-0x0000000000400000-0x0000000000428000-memory.dmp	family_mystic

Mystic
Mystic is an infostealer written in C++.
stealer mystic

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2988 set thread context of 2216	2988	796f5369ed4d947f9f6544f50e8ebd195421c58163d2241d9379dd5bf714ec53.exe	28

Program crash 2 IoCs

pid	pid_target	Process	procid_target
380	2988	WerFault.exe	27
3068	2216	WerFault.exe	28

Suspicious use of WriteProcessMemory 25 IoCs

description	pid	Process	procid_target
PID 2988 wrote to memory of 2216	2988	796f5369ed4d947f9f6544f50e8ebd195421c58163d2241d9379dd5bf714ec53.exe	28
PID 2988 wrote to memory of 2216	2988	796f5369ed4d947f9f6544f50e8ebd195421c58163d2241d9379dd5bf714ec53.exe	28
PID 2988 wrote to memory of 2216	2988	796f5369ed4d947f9f6544f50e8ebd195421c58163d2241d9379dd5bf714ec53.exe	28
PID 2988 wrote to memory of 2216	2988	796f5369ed4d947f9f6544f50e8ebd195421c58163d2241d9379dd5bf714ec53.exe	28
PID 2988 wrote to memory of 2216	2988	796f5369ed4d947f9f6544f50e8ebd195421c58163d2241d9379dd5bf714ec53.exe	28
PID 2988 wrote to memory of 2216	2988	796f5369ed4d947f9f6544f50e8ebd195421c58163d2241d9379dd5bf714ec53.exe	28
PID 2988 wrote to memory of 2216	2988	796f5369ed4d947f9f6544f50e8ebd195421c58163d2241d9379dd5bf714ec53.exe	28
PID 2988 wrote to memory of 2216	2988	796f5369ed4d947f9f6544f50e8ebd195421c58163d2241d9379dd5bf714ec53.exe	28
PID 2988 wrote to memory of 2216	2988	796f5369ed4d947f9f6544f50e8ebd195421c58163d2241d9379dd5bf714ec53.exe	28
PID 2988 wrote to memory of 2216	2988	796f5369ed4d947f9f6544f50e8ebd195421c58163d2241d9379dd5bf714ec53.exe	28
PID 2988 wrote to memory of 2216	2988	796f5369ed4d947f9f6544f50e8ebd195421c58163d2241d9379dd5bf714ec53.exe	28
PID 2988 wrote to memory of 2216	2988	796f5369ed4d947f9f6544f50e8ebd195421c58163d2241d9379dd5bf714ec53.exe	28
PID 2988 wrote to memory of 2216	2988	796f5369ed4d947f9f6544f50e8ebd195421c58163d2241d9379dd5bf714ec53.exe	28
PID 2988 wrote to memory of 2216	2988	796f5369ed4d947f9f6544f50e8ebd195421c58163d2241d9379dd5bf714ec53.exe	28
PID 2988 wrote to memory of 380	2988	796f5369ed4d947f9f6544f50e8ebd195421c58163d2241d9379dd5bf714ec53.exe	29
PID 2988 wrote to memory of 380	2988	796f5369ed4d947f9f6544f50e8ebd195421c58163d2241d9379dd5bf714ec53.exe	29
PID 2988 wrote to memory of 380	2988	796f5369ed4d947f9f6544f50e8ebd195421c58163d2241d9379dd5bf714ec53.exe	29
PID 2988 wrote to memory of 380	2988	796f5369ed4d947f9f6544f50e8ebd195421c58163d2241d9379dd5bf714ec53.exe	29
PID 2216 wrote to memory of 3068	2216	AppLaunch.exe	30
PID 2216 wrote to memory of 3068	2216	AppLaunch.exe	30
PID 2216 wrote to memory of 3068	2216	AppLaunch.exe	30
PID 2216 wrote to memory of 3068	2216	AppLaunch.exe	30
PID 2216 wrote to memory of 3068	2216	AppLaunch.exe	30
PID 2216 wrote to memory of 3068	2216	AppLaunch.exe	30
PID 2216 wrote to memory of 3068	2216	AppLaunch.exe	30

C:\Users\Admin\AppData\Local\Temp\796f5369ed4d947f9f6544f50e8ebd195421c58163d2241d9379dd5bf714ec53.exe
"C:\Users\Admin\AppData\Local\Temp\796f5369ed4d947f9f6544f50e8ebd195421c58163d2241d9379dd5bf714ec53.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2988
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2216
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2216 -s 196
    3⤵
    - Program crash
    PID:3068
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2988 -s 92
  2⤵
  - Program crash
  PID:380

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2216-0-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/2216-1-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/2216-2-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/2216-3-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/2216-4-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/2216-5-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/2216-7-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/2216-6-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmp

Filesize
4KB

Download
memory/2216-9-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/2216-11-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads