mystic | 1a9a996d2a2788c74e225e99512e6a0b7632db5a94cfbed6bf1f22e711048e4f

Analysis

max time kernel
118s
max time network
124s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
12/10/2023, 11:09

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

86f8c238c65d1448ac953222698cc05c0f65bff598f4c650559df487f7d2203c.exe
Size

371KB
MD5

5ad689358932b17f6752bb7a060f5aa2
SHA1

88c04797697ba644da1ba42e7d81ca55ce926dfd
SHA256

86f8c238c65d1448ac953222698cc05c0f65bff598f4c650559df487f7d2203c
SHA512

92d0ddc54b8c0f58ab7536bb5684db27d50356b97cc8394a93e3277e6a3e6e99c4f097c03f86d2d6b1b54984bb17f59c3763d5c38b23b3040b0abb82e180cec1
SSDEEP

6144:+RLpmE9POTt+wqWbiC+9DAOviQhuBSGxjPsPojJIfPzxgvZ4xJg8f:+5QE9GTcN4lhlmPzxA4rg8f

Score

10^/10

mystic stealer

Malware Config

Signatures

Detect Mystic stealer payload 6 IoCs

resource	yara_rule
behavioral1/memory/2436-3-0x0000000000400000-0x0000000000428000-memory.dmp	family_mystic
behavioral1/memory/2436-4-0x0000000000400000-0x0000000000428000-memory.dmp	family_mystic
behavioral1/memory/2436-7-0x0000000000400000-0x0000000000428000-memory.dmp	family_mystic
behavioral1/memory/2436-5-0x0000000000400000-0x0000000000428000-memory.dmp	family_mystic
behavioral1/memory/2436-9-0x0000000000400000-0x0000000000428000-memory.dmp	family_mystic
behavioral1/memory/2436-11-0x0000000000400000-0x0000000000428000-memory.dmp	family_mystic

Mystic
Mystic is an infostealer written in C++.
stealer mystic

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2224 set thread context of 2436	2224	86f8c238c65d1448ac953222698cc05c0f65bff598f4c650559df487f7d2203c.exe	28

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2120	2436	WerFault.exe	28

Suspicious use of WriteProcessMemory 21 IoCs

description	pid	Process	procid_target
PID 2224 wrote to memory of 2436	2224	86f8c238c65d1448ac953222698cc05c0f65bff598f4c650559df487f7d2203c.exe	28
PID 2224 wrote to memory of 2436	2224	86f8c238c65d1448ac953222698cc05c0f65bff598f4c650559df487f7d2203c.exe	28
PID 2224 wrote to memory of 2436	2224	86f8c238c65d1448ac953222698cc05c0f65bff598f4c650559df487f7d2203c.exe	28
PID 2224 wrote to memory of 2436	2224	86f8c238c65d1448ac953222698cc05c0f65bff598f4c650559df487f7d2203c.exe	28
PID 2224 wrote to memory of 2436	2224	86f8c238c65d1448ac953222698cc05c0f65bff598f4c650559df487f7d2203c.exe	28
PID 2224 wrote to memory of 2436	2224	86f8c238c65d1448ac953222698cc05c0f65bff598f4c650559df487f7d2203c.exe	28
PID 2224 wrote to memory of 2436	2224	86f8c238c65d1448ac953222698cc05c0f65bff598f4c650559df487f7d2203c.exe	28
PID 2224 wrote to memory of 2436	2224	86f8c238c65d1448ac953222698cc05c0f65bff598f4c650559df487f7d2203c.exe	28
PID 2224 wrote to memory of 2436	2224	86f8c238c65d1448ac953222698cc05c0f65bff598f4c650559df487f7d2203c.exe	28
PID 2224 wrote to memory of 2436	2224	86f8c238c65d1448ac953222698cc05c0f65bff598f4c650559df487f7d2203c.exe	28
PID 2224 wrote to memory of 2436	2224	86f8c238c65d1448ac953222698cc05c0f65bff598f4c650559df487f7d2203c.exe	28
PID 2224 wrote to memory of 2436	2224	86f8c238c65d1448ac953222698cc05c0f65bff598f4c650559df487f7d2203c.exe	28
PID 2224 wrote to memory of 2436	2224	86f8c238c65d1448ac953222698cc05c0f65bff598f4c650559df487f7d2203c.exe	28
PID 2224 wrote to memory of 2436	2224	86f8c238c65d1448ac953222698cc05c0f65bff598f4c650559df487f7d2203c.exe	28
PID 2436 wrote to memory of 2120	2436	AppLaunch.exe	29
PID 2436 wrote to memory of 2120	2436	AppLaunch.exe	29
PID 2436 wrote to memory of 2120	2436	AppLaunch.exe	29
PID 2436 wrote to memory of 2120	2436	AppLaunch.exe	29
PID 2436 wrote to memory of 2120	2436	AppLaunch.exe	29
PID 2436 wrote to memory of 2120	2436	AppLaunch.exe	29
PID 2436 wrote to memory of 2120	2436	AppLaunch.exe	29

C:\Users\Admin\AppData\Local\Temp\86f8c238c65d1448ac953222698cc05c0f65bff598f4c650559df487f7d2203c.exe
"C:\Users\Admin\AppData\Local\Temp\86f8c238c65d1448ac953222698cc05c0f65bff598f4c650559df487f7d2203c.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2224
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2436
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2436 -s 196
    3⤵
    - Program crash
    PID:2120

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2436-0-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/2436-1-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/2436-3-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/2436-4-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/2436-7-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/2436-5-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/2436-6-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmp

Filesize
4KB

Download
memory/2436-2-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/2436-9-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/2436-11-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads