mystic | c188e8229447ab36f60c87264ea5fb4f2c8b05bb511eb7cee31b122923112089

General

Target

bfa2583daa3c0e78f367e28f1638d130eef29ad911b916ece869f3954855c5e2.exe
Size

380KB
MD5

2138347d41f1d36a98da4dab086bca7c
SHA1

d6b92582a86876414acec4d9035394bd8f992f67
SHA256

bfa2583daa3c0e78f367e28f1638d130eef29ad911b916ece869f3954855c5e2
SHA512

eafb3b89eb2e7c681f310afdfcdd473ecbc51e93539f68782a6c09af2044a3bb79d6888a20b77225c4512f354a66d07fa0b8a345eb0efb77490e50536906a5f4
SSDEEP

6144:plPchHX110KwTVSf3pOCq5b6uAO9S4HsVhbkkpKRjv1l5lrUpa4+PT29qwm:plPi3110dVaUcuLPEhHKdTrUparyMwm

Score

10^/10

Malware Config

Signatures

Detect Mystic stealer payload 6 IoCs

resource	yara_rule
behavioral1/memory/3008-3-0x0000000000400000-0x0000000000428000-memory.dmp	family_mystic
behavioral1/memory/3008-4-0x0000000000400000-0x0000000000428000-memory.dmp	family_mystic
behavioral1/memory/3008-5-0x0000000000400000-0x0000000000428000-memory.dmp	family_mystic
behavioral1/memory/3008-7-0x0000000000400000-0x0000000000428000-memory.dmp	family_mystic
behavioral1/memory/3008-9-0x0000000000400000-0x0000000000428000-memory.dmp	family_mystic
behavioral1/memory/3008-11-0x0000000000400000-0x0000000000428000-memory.dmp	family_mystic

Mystic
Mystic is an infostealer written in C++.
stealer mystic

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3000 set thread context of 3008	3000	bfa2583daa3c0e78f367e28f1638d130eef29ad911b916ece869f3954855c5e2.exe	28

Program crash 2 IoCs

pid	pid_target	Process	procid_target
1044	3000	WerFault.exe	19
2192	3008	WerFault.exe	28

Suspicious use of WriteProcessMemory 25 IoCs

description	pid	Process	procid_target
PID 3000 wrote to memory of 3008	3000	bfa2583daa3c0e78f367e28f1638d130eef29ad911b916ece869f3954855c5e2.exe	28
PID 3000 wrote to memory of 3008	3000	bfa2583daa3c0e78f367e28f1638d130eef29ad911b916ece869f3954855c5e2.exe	28
PID 3000 wrote to memory of 3008	3000	bfa2583daa3c0e78f367e28f1638d130eef29ad911b916ece869f3954855c5e2.exe	28
PID 3000 wrote to memory of 3008	3000	bfa2583daa3c0e78f367e28f1638d130eef29ad911b916ece869f3954855c5e2.exe	28
PID 3000 wrote to memory of 3008	3000	bfa2583daa3c0e78f367e28f1638d130eef29ad911b916ece869f3954855c5e2.exe	28
PID 3000 wrote to memory of 3008	3000	bfa2583daa3c0e78f367e28f1638d130eef29ad911b916ece869f3954855c5e2.exe	28
PID 3000 wrote to memory of 3008	3000	bfa2583daa3c0e78f367e28f1638d130eef29ad911b916ece869f3954855c5e2.exe	28
PID 3000 wrote to memory of 3008	3000	bfa2583daa3c0e78f367e28f1638d130eef29ad911b916ece869f3954855c5e2.exe	28
PID 3000 wrote to memory of 3008	3000	bfa2583daa3c0e78f367e28f1638d130eef29ad911b916ece869f3954855c5e2.exe	28
PID 3000 wrote to memory of 3008	3000	bfa2583daa3c0e78f367e28f1638d130eef29ad911b916ece869f3954855c5e2.exe	28
PID 3000 wrote to memory of 3008	3000	bfa2583daa3c0e78f367e28f1638d130eef29ad911b916ece869f3954855c5e2.exe	28
PID 3000 wrote to memory of 3008	3000	bfa2583daa3c0e78f367e28f1638d130eef29ad911b916ece869f3954855c5e2.exe	28
PID 3000 wrote to memory of 3008	3000	bfa2583daa3c0e78f367e28f1638d130eef29ad911b916ece869f3954855c5e2.exe	28
PID 3000 wrote to memory of 3008	3000	bfa2583daa3c0e78f367e28f1638d130eef29ad911b916ece869f3954855c5e2.exe	28
PID 3000 wrote to memory of 1044	3000	bfa2583daa3c0e78f367e28f1638d130eef29ad911b916ece869f3954855c5e2.exe	29
PID 3000 wrote to memory of 1044	3000	bfa2583daa3c0e78f367e28f1638d130eef29ad911b916ece869f3954855c5e2.exe	29
PID 3000 wrote to memory of 1044	3000	bfa2583daa3c0e78f367e28f1638d130eef29ad911b916ece869f3954855c5e2.exe	29
PID 3000 wrote to memory of 1044	3000	bfa2583daa3c0e78f367e28f1638d130eef29ad911b916ece869f3954855c5e2.exe	29
PID 3008 wrote to memory of 2192	3008	AppLaunch.exe	30
PID 3008 wrote to memory of 2192	3008	AppLaunch.exe	30
PID 3008 wrote to memory of 2192	3008	AppLaunch.exe	30
PID 3008 wrote to memory of 2192	3008	AppLaunch.exe	30
PID 3008 wrote to memory of 2192	3008	AppLaunch.exe	30
PID 3008 wrote to memory of 2192	3008	AppLaunch.exe	30
PID 3008 wrote to memory of 2192	3008	AppLaunch.exe	30

C:\Users\Admin\AppData\Local\Temp\bfa2583daa3c0e78f367e28f1638d130eef29ad911b916ece869f3954855c5e2.exe
"C:\Users\Admin\AppData\Local\Temp\bfa2583daa3c0e78f367e28f1638d130eef29ad911b916ece869f3954855c5e2.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3000
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3008
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3008 -s 196
    3⤵
    - Program crash
    PID:2192
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3000 -s 52
  2⤵
  - Program crash
  PID:1044

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3008-0-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/3008-1-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/3008-2-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/3008-3-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/3008-4-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/3008-6-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmp

Filesize
4KB

Download
memory/3008-5-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/3008-7-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/3008-9-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/3008-11-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads