mystic | 710a40f37b9a06f5ce452cc56341b94f95d605e49ba57323ff73dbf594a9292f

Analysis

max time kernel
118s
max time network
128s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
12/10/2023, 22:00

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

710a40f37b9a06f5ce452cc56341b94f95d605e49ba57323ff73dbf594a9292f.exe
Size

359KB
MD5

b200cee12aa1849df39e669bd4d88efc
SHA1

ad6bb525e1d7b776b5f5eec640213866068cce58
SHA256

710a40f37b9a06f5ce452cc56341b94f95d605e49ba57323ff73dbf594a9292f
SHA512

b6c8e7c81e407fc517510133b5aa3dbf76aaab7f4fb358b638e470662296d34cadbfb2c4e44d57acdff917465f0c254f5dc38c456ec91a6e92dccb2282f7d7d7
SSDEEP

6144:rwcaGEZt20ZSwbz8+Dxe8kVAOMlaep/h2cP6AjIsQNEu/JAKOu2Vh8Ey:rwFzZtT78TWdh2cPnQNPJAKOJh8Ey

Score

10^/10

mystic stealer

Malware Config

Signatures

Detect Mystic stealer payload 6 IoCs

resource	yara_rule
behavioral1/memory/1236-3-0x0000000000400000-0x0000000000428000-memory.dmp	family_mystic
behavioral1/memory/1236-7-0x0000000000400000-0x0000000000428000-memory.dmp	family_mystic
behavioral1/memory/1236-5-0x0000000000400000-0x0000000000428000-memory.dmp	family_mystic
behavioral1/memory/1236-9-0x0000000000400000-0x0000000000428000-memory.dmp	family_mystic
behavioral1/memory/1236-11-0x0000000000400000-0x0000000000428000-memory.dmp	family_mystic
behavioral1/memory/1236-4-0x0000000000400000-0x0000000000428000-memory.dmp	family_mystic

Mystic
Mystic is an infostealer written in C++.
stealer mystic

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2188 set thread context of 1236	2188	710a40f37b9a06f5ce452cc56341b94f95d605e49ba57323ff73dbf594a9292f.exe	29

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2308	1236	WerFault.exe	29

Suspicious use of WriteProcessMemory 21 IoCs

description	pid	Process	procid_target
PID 2188 wrote to memory of 1236	2188	710a40f37b9a06f5ce452cc56341b94f95d605e49ba57323ff73dbf594a9292f.exe	29
PID 2188 wrote to memory of 1236	2188	710a40f37b9a06f5ce452cc56341b94f95d605e49ba57323ff73dbf594a9292f.exe	29
PID 2188 wrote to memory of 1236	2188	710a40f37b9a06f5ce452cc56341b94f95d605e49ba57323ff73dbf594a9292f.exe	29
PID 2188 wrote to memory of 1236	2188	710a40f37b9a06f5ce452cc56341b94f95d605e49ba57323ff73dbf594a9292f.exe	29
PID 2188 wrote to memory of 1236	2188	710a40f37b9a06f5ce452cc56341b94f95d605e49ba57323ff73dbf594a9292f.exe	29
PID 2188 wrote to memory of 1236	2188	710a40f37b9a06f5ce452cc56341b94f95d605e49ba57323ff73dbf594a9292f.exe	29
PID 2188 wrote to memory of 1236	2188	710a40f37b9a06f5ce452cc56341b94f95d605e49ba57323ff73dbf594a9292f.exe	29
PID 2188 wrote to memory of 1236	2188	710a40f37b9a06f5ce452cc56341b94f95d605e49ba57323ff73dbf594a9292f.exe	29
PID 2188 wrote to memory of 1236	2188	710a40f37b9a06f5ce452cc56341b94f95d605e49ba57323ff73dbf594a9292f.exe	29
PID 2188 wrote to memory of 1236	2188	710a40f37b9a06f5ce452cc56341b94f95d605e49ba57323ff73dbf594a9292f.exe	29
PID 2188 wrote to memory of 1236	2188	710a40f37b9a06f5ce452cc56341b94f95d605e49ba57323ff73dbf594a9292f.exe	29
PID 2188 wrote to memory of 1236	2188	710a40f37b9a06f5ce452cc56341b94f95d605e49ba57323ff73dbf594a9292f.exe	29
PID 2188 wrote to memory of 1236	2188	710a40f37b9a06f5ce452cc56341b94f95d605e49ba57323ff73dbf594a9292f.exe	29
PID 2188 wrote to memory of 1236	2188	710a40f37b9a06f5ce452cc56341b94f95d605e49ba57323ff73dbf594a9292f.exe	29
PID 1236 wrote to memory of 2308	1236	AppLaunch.exe	30
PID 1236 wrote to memory of 2308	1236	AppLaunch.exe	30
PID 1236 wrote to memory of 2308	1236	AppLaunch.exe	30
PID 1236 wrote to memory of 2308	1236	AppLaunch.exe	30
PID 1236 wrote to memory of 2308	1236	AppLaunch.exe	30
PID 1236 wrote to memory of 2308	1236	AppLaunch.exe	30
PID 1236 wrote to memory of 2308	1236	AppLaunch.exe	30

C:\Users\Admin\AppData\Local\Temp\710a40f37b9a06f5ce452cc56341b94f95d605e49ba57323ff73dbf594a9292f.exe
"C:\Users\Admin\AppData\Local\Temp\710a40f37b9a06f5ce452cc56341b94f95d605e49ba57323ff73dbf594a9292f.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2188
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1236
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1236 -s 196
    3⤵
    - Program crash
    PID:2308

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1236-2-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/1236-3-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/1236-1-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/1236-0-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/1236-7-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/1236-6-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmp

Filesize
4KB

Download
memory/1236-5-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/1236-9-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/1236-11-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/1236-4-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads