mystic | 7a266b1d528127259dc89f9d9410b19c5ab55247034db6e4ec8f37c1b51bee79

Analysis

max time kernel
120s
max time network
141s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
12/10/2023, 07:55

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

7a266b1d528127259dc89f9d9410b19c5ab55247034db6e4ec8f37c1b51bee79.exe
Size

1.8MB
MD5

f94bf3a0e3733958d4973ef664f78927
SHA1

a1e0a0f9d6d92e6047f9dbbbe57cda7925af7e29
SHA256

7a266b1d528127259dc89f9d9410b19c5ab55247034db6e4ec8f37c1b51bee79
SHA512

947d6efffd28f45692eef1dfc893636679e76c907d45504ee7e6778f0b412ec8ab91771cb821d1ccb2c212077c51d49bdb71b072ad57a07c8c44d8eafb76c2b0
SSDEEP

24576:DMdQ1KOpYU/hsYVNQnb3iUBDqd6a9Dhvh9wj78ptl:31F/hsYVNQ+UI6a3vHwj78pv

Score

10^/10

mystic stealer

Malware Config

Signatures

Detect Mystic stealer payload 6 IoCs

resource	yara_rule
behavioral1/memory/2404-5-0x0000000000400000-0x0000000000428000-memory.dmp	family_mystic
behavioral1/memory/2404-7-0x0000000000400000-0x0000000000428000-memory.dmp	family_mystic
behavioral1/memory/2404-9-0x0000000000400000-0x0000000000428000-memory.dmp	family_mystic
behavioral1/memory/2404-4-0x0000000000400000-0x0000000000428000-memory.dmp	family_mystic
behavioral1/memory/2404-3-0x0000000000400000-0x0000000000428000-memory.dmp	family_mystic
behavioral1/memory/2404-11-0x0000000000400000-0x0000000000428000-memory.dmp	family_mystic

Mystic
Mystic is an infostealer written in C++.
stealer mystic

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2860 set thread context of 2404	2860	7a266b1d528127259dc89f9d9410b19c5ab55247034db6e4ec8f37c1b51bee79.exe	28

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2844	2404	WerFault.exe	28

Suspicious use of WriteProcessMemory 21 IoCs

description	pid	Process	procid_target
PID 2860 wrote to memory of 2404	2860	7a266b1d528127259dc89f9d9410b19c5ab55247034db6e4ec8f37c1b51bee79.exe	28
PID 2860 wrote to memory of 2404	2860	7a266b1d528127259dc89f9d9410b19c5ab55247034db6e4ec8f37c1b51bee79.exe	28
PID 2860 wrote to memory of 2404	2860	7a266b1d528127259dc89f9d9410b19c5ab55247034db6e4ec8f37c1b51bee79.exe	28
PID 2860 wrote to memory of 2404	2860	7a266b1d528127259dc89f9d9410b19c5ab55247034db6e4ec8f37c1b51bee79.exe	28
PID 2860 wrote to memory of 2404	2860	7a266b1d528127259dc89f9d9410b19c5ab55247034db6e4ec8f37c1b51bee79.exe	28
PID 2860 wrote to memory of 2404	2860	7a266b1d528127259dc89f9d9410b19c5ab55247034db6e4ec8f37c1b51bee79.exe	28
PID 2860 wrote to memory of 2404	2860	7a266b1d528127259dc89f9d9410b19c5ab55247034db6e4ec8f37c1b51bee79.exe	28
PID 2860 wrote to memory of 2404	2860	7a266b1d528127259dc89f9d9410b19c5ab55247034db6e4ec8f37c1b51bee79.exe	28
PID 2860 wrote to memory of 2404	2860	7a266b1d528127259dc89f9d9410b19c5ab55247034db6e4ec8f37c1b51bee79.exe	28
PID 2860 wrote to memory of 2404	2860	7a266b1d528127259dc89f9d9410b19c5ab55247034db6e4ec8f37c1b51bee79.exe	28
PID 2860 wrote to memory of 2404	2860	7a266b1d528127259dc89f9d9410b19c5ab55247034db6e4ec8f37c1b51bee79.exe	28
PID 2860 wrote to memory of 2404	2860	7a266b1d528127259dc89f9d9410b19c5ab55247034db6e4ec8f37c1b51bee79.exe	28
PID 2860 wrote to memory of 2404	2860	7a266b1d528127259dc89f9d9410b19c5ab55247034db6e4ec8f37c1b51bee79.exe	28
PID 2860 wrote to memory of 2404	2860	7a266b1d528127259dc89f9d9410b19c5ab55247034db6e4ec8f37c1b51bee79.exe	28
PID 2404 wrote to memory of 2844	2404	AppLaunch.exe	29
PID 2404 wrote to memory of 2844	2404	AppLaunch.exe	29
PID 2404 wrote to memory of 2844	2404	AppLaunch.exe	29
PID 2404 wrote to memory of 2844	2404	AppLaunch.exe	29
PID 2404 wrote to memory of 2844	2404	AppLaunch.exe	29
PID 2404 wrote to memory of 2844	2404	AppLaunch.exe	29
PID 2404 wrote to memory of 2844	2404	AppLaunch.exe	29

C:\Users\Admin\AppData\Local\Temp\7a266b1d528127259dc89f9d9410b19c5ab55247034db6e4ec8f37c1b51bee79.exe
"C:\Users\Admin\AppData\Local\Temp\7a266b1d528127259dc89f9d9410b19c5ab55247034db6e4ec8f37c1b51bee79.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2860
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2404
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2404 -s 196
    3⤵
    - Program crash
    PID:2844

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2404-0-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/2404-6-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmp

Filesize
4KB

Download
memory/2404-5-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/2404-7-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/2404-9-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/2404-4-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/2404-3-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/2404-2-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/2404-1-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/2404-11-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads