mystic | bcc30d4eb27a526ce1d2677b75641cff5e3406da1853e3053a80b6d84e51fb58

Analysis

max time kernel
117s
max time network
123s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
12/10/2023, 11:17

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

7deac712ad74eb7f7c017378bcffa748684c1df7fd6a1729d4f64c2eef58e73c.exe
Size

365KB
MD5

0650de5edc2b3a6df1122382d092db57
SHA1

d1555178026bd4fc174c8c7ec470ccc842d5edff
SHA256

7deac712ad74eb7f7c017378bcffa748684c1df7fd6a1729d4f64c2eef58e73c
SHA512

3e786019d138c302a915217e309ff1923bbb6c1e180f032624101f27f8d84031fd856b3e2d1d23b9c9bb907e3ba76c7147ec8c62d03e3a8a53a55955dfe7eb6d
SSDEEP

6144:nXzjEw2jicP5iOo2T8VrSd/sUAOlUl1moDD77rNfD19mJnprR9guV1Sa:nXzZqiG59ou3UXmoDD775fjmjFauV1Sa

Score

10^/10

mystic stealer

Malware Config

Signatures

Detect Mystic stealer payload 6 IoCs

resource	yara_rule
behavioral1/memory/1724-3-0x0000000000400000-0x0000000000428000-memory.dmp	family_mystic
behavioral1/memory/1724-4-0x0000000000400000-0x0000000000428000-memory.dmp	family_mystic
behavioral1/memory/1724-5-0x0000000000400000-0x0000000000428000-memory.dmp	family_mystic
behavioral1/memory/1724-7-0x0000000000400000-0x0000000000428000-memory.dmp	family_mystic
behavioral1/memory/1724-9-0x0000000000400000-0x0000000000428000-memory.dmp	family_mystic
behavioral1/memory/1724-11-0x0000000000400000-0x0000000000428000-memory.dmp	family_mystic

Mystic
Mystic is an infostealer written in C++.
stealer mystic

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2044 set thread context of 1724	2044	7deac712ad74eb7f7c017378bcffa748684c1df7fd6a1729d4f64c2eef58e73c.exe	29

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2384	1724	WerFault.exe	29

Suspicious use of WriteProcessMemory 21 IoCs

description	pid	Process	procid_target
PID 2044 wrote to memory of 1724	2044	7deac712ad74eb7f7c017378bcffa748684c1df7fd6a1729d4f64c2eef58e73c.exe	29
PID 2044 wrote to memory of 1724	2044	7deac712ad74eb7f7c017378bcffa748684c1df7fd6a1729d4f64c2eef58e73c.exe	29
PID 2044 wrote to memory of 1724	2044	7deac712ad74eb7f7c017378bcffa748684c1df7fd6a1729d4f64c2eef58e73c.exe	29
PID 2044 wrote to memory of 1724	2044	7deac712ad74eb7f7c017378bcffa748684c1df7fd6a1729d4f64c2eef58e73c.exe	29
PID 2044 wrote to memory of 1724	2044	7deac712ad74eb7f7c017378bcffa748684c1df7fd6a1729d4f64c2eef58e73c.exe	29
PID 2044 wrote to memory of 1724	2044	7deac712ad74eb7f7c017378bcffa748684c1df7fd6a1729d4f64c2eef58e73c.exe	29
PID 2044 wrote to memory of 1724	2044	7deac712ad74eb7f7c017378bcffa748684c1df7fd6a1729d4f64c2eef58e73c.exe	29
PID 2044 wrote to memory of 1724	2044	7deac712ad74eb7f7c017378bcffa748684c1df7fd6a1729d4f64c2eef58e73c.exe	29
PID 2044 wrote to memory of 1724	2044	7deac712ad74eb7f7c017378bcffa748684c1df7fd6a1729d4f64c2eef58e73c.exe	29
PID 2044 wrote to memory of 1724	2044	7deac712ad74eb7f7c017378bcffa748684c1df7fd6a1729d4f64c2eef58e73c.exe	29
PID 2044 wrote to memory of 1724	2044	7deac712ad74eb7f7c017378bcffa748684c1df7fd6a1729d4f64c2eef58e73c.exe	29
PID 2044 wrote to memory of 1724	2044	7deac712ad74eb7f7c017378bcffa748684c1df7fd6a1729d4f64c2eef58e73c.exe	29
PID 2044 wrote to memory of 1724	2044	7deac712ad74eb7f7c017378bcffa748684c1df7fd6a1729d4f64c2eef58e73c.exe	29
PID 2044 wrote to memory of 1724	2044	7deac712ad74eb7f7c017378bcffa748684c1df7fd6a1729d4f64c2eef58e73c.exe	29
PID 1724 wrote to memory of 2384	1724	AppLaunch.exe	30
PID 1724 wrote to memory of 2384	1724	AppLaunch.exe	30
PID 1724 wrote to memory of 2384	1724	AppLaunch.exe	30
PID 1724 wrote to memory of 2384	1724	AppLaunch.exe	30
PID 1724 wrote to memory of 2384	1724	AppLaunch.exe	30
PID 1724 wrote to memory of 2384	1724	AppLaunch.exe	30
PID 1724 wrote to memory of 2384	1724	AppLaunch.exe	30

C:\Users\Admin\AppData\Local\Temp\7deac712ad74eb7f7c017378bcffa748684c1df7fd6a1729d4f64c2eef58e73c.exe
"C:\Users\Admin\AppData\Local\Temp\7deac712ad74eb7f7c017378bcffa748684c1df7fd6a1729d4f64c2eef58e73c.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2044
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1724
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1724 -s 196
    3⤵
    - Program crash
    PID:2384

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1724-0-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/1724-1-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/1724-3-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/1724-2-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/1724-4-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/1724-5-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/1724-7-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/1724-6-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmp

Filesize
4KB

Download
memory/1724-9-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/1724-11-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads