mystic | fab788167c4a7649ab86c259aed26b2b21b6a8c576e41d26dba78c7659fc6465

General

Target

fab788167c4a7649ab86c259aed26b2b21b6a8c576e41d26dba78c7659fc6465.exe
Size

380KB
MD5

47a554afcbad97c3199a3663193ff29f
SHA1

fbd0a67f165fe458cc20b8f9e259d4eb5d0b8438
SHA256

fab788167c4a7649ab86c259aed26b2b21b6a8c576e41d26dba78c7659fc6465
SHA512

72f32f6d978f0ac3276502095e867b9a976e1ea25ce1dabf8e59273b55626e39c3630beb635e07c8532b70bb6af9060e2ac164b594914c7e656d5d06005c151d
SSDEEP

6144:AlPnhHX110KwTVSf3pOCq5b6uAO4wogYpk+kI2v4mgEqwm:AlPh3110dVaUcuOngYpkiU4mgVwm

Score

10^/10

Malware Config

Signatures

Detect Mystic stealer payload 6 IoCs

resource	yara_rule
behavioral1/memory/1236-3-0x0000000000400000-0x0000000000428000-memory.dmp	family_mystic
behavioral1/memory/1236-4-0x0000000000400000-0x0000000000428000-memory.dmp	family_mystic
behavioral1/memory/1236-5-0x0000000000400000-0x0000000000428000-memory.dmp	family_mystic
behavioral1/memory/1236-7-0x0000000000400000-0x0000000000428000-memory.dmp	family_mystic
behavioral1/memory/1236-9-0x0000000000400000-0x0000000000428000-memory.dmp	family_mystic
behavioral1/memory/1236-11-0x0000000000400000-0x0000000000428000-memory.dmp	family_mystic

Mystic
Mystic is an infostealer written in C++.
stealer mystic

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2972 set thread context of 1236	2972	fab788167c4a7649ab86c259aed26b2b21b6a8c576e41d26dba78c7659fc6465.exe	28

Program crash 2 IoCs

pid	pid_target	Process	procid_target
1668	2972	WerFault.exe	16
2652	1236	WerFault.exe	28

Suspicious use of WriteProcessMemory 25 IoCs

description	pid	Process	procid_target
PID 2972 wrote to memory of 1236	2972	fab788167c4a7649ab86c259aed26b2b21b6a8c576e41d26dba78c7659fc6465.exe	28
PID 2972 wrote to memory of 1236	2972	fab788167c4a7649ab86c259aed26b2b21b6a8c576e41d26dba78c7659fc6465.exe	28
PID 2972 wrote to memory of 1236	2972	fab788167c4a7649ab86c259aed26b2b21b6a8c576e41d26dba78c7659fc6465.exe	28
PID 2972 wrote to memory of 1236	2972	fab788167c4a7649ab86c259aed26b2b21b6a8c576e41d26dba78c7659fc6465.exe	28
PID 2972 wrote to memory of 1236	2972	fab788167c4a7649ab86c259aed26b2b21b6a8c576e41d26dba78c7659fc6465.exe	28
PID 2972 wrote to memory of 1236	2972	fab788167c4a7649ab86c259aed26b2b21b6a8c576e41d26dba78c7659fc6465.exe	28
PID 2972 wrote to memory of 1236	2972	fab788167c4a7649ab86c259aed26b2b21b6a8c576e41d26dba78c7659fc6465.exe	28
PID 2972 wrote to memory of 1236	2972	fab788167c4a7649ab86c259aed26b2b21b6a8c576e41d26dba78c7659fc6465.exe	28
PID 2972 wrote to memory of 1236	2972	fab788167c4a7649ab86c259aed26b2b21b6a8c576e41d26dba78c7659fc6465.exe	28
PID 2972 wrote to memory of 1236	2972	fab788167c4a7649ab86c259aed26b2b21b6a8c576e41d26dba78c7659fc6465.exe	28
PID 2972 wrote to memory of 1236	2972	fab788167c4a7649ab86c259aed26b2b21b6a8c576e41d26dba78c7659fc6465.exe	28
PID 2972 wrote to memory of 1236	2972	fab788167c4a7649ab86c259aed26b2b21b6a8c576e41d26dba78c7659fc6465.exe	28
PID 2972 wrote to memory of 1236	2972	fab788167c4a7649ab86c259aed26b2b21b6a8c576e41d26dba78c7659fc6465.exe	28
PID 2972 wrote to memory of 1236	2972	fab788167c4a7649ab86c259aed26b2b21b6a8c576e41d26dba78c7659fc6465.exe	28
PID 2972 wrote to memory of 1668	2972	fab788167c4a7649ab86c259aed26b2b21b6a8c576e41d26dba78c7659fc6465.exe	29
PID 2972 wrote to memory of 1668	2972	fab788167c4a7649ab86c259aed26b2b21b6a8c576e41d26dba78c7659fc6465.exe	29
PID 2972 wrote to memory of 1668	2972	fab788167c4a7649ab86c259aed26b2b21b6a8c576e41d26dba78c7659fc6465.exe	29
PID 2972 wrote to memory of 1668	2972	fab788167c4a7649ab86c259aed26b2b21b6a8c576e41d26dba78c7659fc6465.exe	29
PID 1236 wrote to memory of 2652	1236	AppLaunch.exe	30
PID 1236 wrote to memory of 2652	1236	AppLaunch.exe	30
PID 1236 wrote to memory of 2652	1236	AppLaunch.exe	30
PID 1236 wrote to memory of 2652	1236	AppLaunch.exe	30
PID 1236 wrote to memory of 2652	1236	AppLaunch.exe	30
PID 1236 wrote to memory of 2652	1236	AppLaunch.exe	30
PID 1236 wrote to memory of 2652	1236	AppLaunch.exe	30

C:\Users\Admin\AppData\Local\Temp\fab788167c4a7649ab86c259aed26b2b21b6a8c576e41d26dba78c7659fc6465.exe
"C:\Users\Admin\AppData\Local\Temp\fab788167c4a7649ab86c259aed26b2b21b6a8c576e41d26dba78c7659fc6465.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2972
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1236
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1236 -s 196
    3⤵
    - Program crash
    PID:2652
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2972 -s 52
  2⤵
  - Program crash
  PID:1668

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1236-0-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/1236-1-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/1236-2-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/1236-3-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/1236-4-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/1236-5-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/1236-6-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmp

Filesize
4KB

Download
memory/1236-7-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/1236-9-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/1236-11-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads