mystic | 1f701be5d216cb6f69a2d96bb6eb824dbf4bf3747e64ba9bcc8b56725acc650d

General

Target

e60e1866e98b8edb20ad965708d9a3143d562624de11d701892f7d3efdd47b20.exe
Size

380KB
MD5

051c4f3ecc2f7834c81415816bba81fa
SHA1

b2bbf9220d2cbacdf8b3b1451374ecf674631c5b
SHA256

e60e1866e98b8edb20ad965708d9a3143d562624de11d701892f7d3efdd47b20
SHA512

030777e38e41552f99647430e3a0dbc775fe7c5c6fa5fa780e176cd4eb2920bc9c431d4f3c6d89882154e85bc6f9817f96e55e5156f6e6cb906d86e71a3c03dc
SSDEEP

6144:jlP4hHX110KwTVSf3pOCq5b6uAO/ZiaXUoTlCSBP709iwCVWqwm:jlPe3110dVaUcuhJXUoTlCAIiwC1wm

Score

10^/10

Malware Config

Signatures

Detect Mystic stealer payload 6 IoCs

resource	yara_rule
behavioral1/memory/1980-3-0x0000000000400000-0x0000000000428000-memory.dmp	family_mystic
behavioral1/memory/1980-5-0x0000000000400000-0x0000000000428000-memory.dmp	family_mystic
behavioral1/memory/1980-4-0x0000000000400000-0x0000000000428000-memory.dmp	family_mystic
behavioral1/memory/1980-7-0x0000000000400000-0x0000000000428000-memory.dmp	family_mystic
behavioral1/memory/1980-9-0x0000000000400000-0x0000000000428000-memory.dmp	family_mystic
behavioral1/memory/1980-11-0x0000000000400000-0x0000000000428000-memory.dmp	family_mystic

Mystic
Mystic is an infostealer written in C++.
stealer mystic

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2148 set thread context of 1980	2148	e60e1866e98b8edb20ad965708d9a3143d562624de11d701892f7d3efdd47b20.exe	28

Program crash 2 IoCs

pid	pid_target	Process	procid_target
1880	2148	WerFault.exe	27
1732	1980	WerFault.exe	28

Suspicious use of WriteProcessMemory 25 IoCs

description	pid	Process	procid_target
PID 2148 wrote to memory of 1980	2148	e60e1866e98b8edb20ad965708d9a3143d562624de11d701892f7d3efdd47b20.exe	28
PID 2148 wrote to memory of 1980	2148	e60e1866e98b8edb20ad965708d9a3143d562624de11d701892f7d3efdd47b20.exe	28
PID 2148 wrote to memory of 1980	2148	e60e1866e98b8edb20ad965708d9a3143d562624de11d701892f7d3efdd47b20.exe	28
PID 2148 wrote to memory of 1980	2148	e60e1866e98b8edb20ad965708d9a3143d562624de11d701892f7d3efdd47b20.exe	28
PID 2148 wrote to memory of 1980	2148	e60e1866e98b8edb20ad965708d9a3143d562624de11d701892f7d3efdd47b20.exe	28
PID 2148 wrote to memory of 1980	2148	e60e1866e98b8edb20ad965708d9a3143d562624de11d701892f7d3efdd47b20.exe	28
PID 2148 wrote to memory of 1980	2148	e60e1866e98b8edb20ad965708d9a3143d562624de11d701892f7d3efdd47b20.exe	28
PID 2148 wrote to memory of 1980	2148	e60e1866e98b8edb20ad965708d9a3143d562624de11d701892f7d3efdd47b20.exe	28
PID 2148 wrote to memory of 1980	2148	e60e1866e98b8edb20ad965708d9a3143d562624de11d701892f7d3efdd47b20.exe	28
PID 2148 wrote to memory of 1980	2148	e60e1866e98b8edb20ad965708d9a3143d562624de11d701892f7d3efdd47b20.exe	28
PID 2148 wrote to memory of 1980	2148	e60e1866e98b8edb20ad965708d9a3143d562624de11d701892f7d3efdd47b20.exe	28
PID 2148 wrote to memory of 1980	2148	e60e1866e98b8edb20ad965708d9a3143d562624de11d701892f7d3efdd47b20.exe	28
PID 2148 wrote to memory of 1980	2148	e60e1866e98b8edb20ad965708d9a3143d562624de11d701892f7d3efdd47b20.exe	28
PID 2148 wrote to memory of 1980	2148	e60e1866e98b8edb20ad965708d9a3143d562624de11d701892f7d3efdd47b20.exe	28
PID 2148 wrote to memory of 1880	2148	e60e1866e98b8edb20ad965708d9a3143d562624de11d701892f7d3efdd47b20.exe	29
PID 2148 wrote to memory of 1880	2148	e60e1866e98b8edb20ad965708d9a3143d562624de11d701892f7d3efdd47b20.exe	29
PID 2148 wrote to memory of 1880	2148	e60e1866e98b8edb20ad965708d9a3143d562624de11d701892f7d3efdd47b20.exe	29
PID 2148 wrote to memory of 1880	2148	e60e1866e98b8edb20ad965708d9a3143d562624de11d701892f7d3efdd47b20.exe	29
PID 1980 wrote to memory of 1732	1980	AppLaunch.exe	30
PID 1980 wrote to memory of 1732	1980	AppLaunch.exe	30
PID 1980 wrote to memory of 1732	1980	AppLaunch.exe	30
PID 1980 wrote to memory of 1732	1980	AppLaunch.exe	30
PID 1980 wrote to memory of 1732	1980	AppLaunch.exe	30
PID 1980 wrote to memory of 1732	1980	AppLaunch.exe	30
PID 1980 wrote to memory of 1732	1980	AppLaunch.exe	30

C:\Users\Admin\AppData\Local\Temp\e60e1866e98b8edb20ad965708d9a3143d562624de11d701892f7d3efdd47b20.exe
"C:\Users\Admin\AppData\Local\Temp\e60e1866e98b8edb20ad965708d9a3143d562624de11d701892f7d3efdd47b20.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2148
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1980
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1980 -s 196
    3⤵
    - Program crash
    PID:1732
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2148 -s 52
  2⤵
  - Program crash
  PID:1880

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1980-0-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/1980-1-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/1980-2-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/1980-3-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/1980-6-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmp

Filesize
4KB

Download
memory/1980-5-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/1980-4-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/1980-7-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/1980-9-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/1980-11-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads