mystic | b38d5f695a430bf14e650839152e0fe32a9f0a4b702213f5223d5f0136ff1343 | Triage

Analysis

max time kernel
142s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20230915-en
resource tags

arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
submitted
12/10/2023, 14:54

Sharing

Report Analysis Logs

General

Target

file.exe
Size

365KB
MD5

43bce7aea19356915c2cf3a2c0f48157
SHA1

efac2e159bce12c8c9a471d265e2dd51b8776a94
SHA256

b38d5f695a430bf14e650839152e0fe32a9f0a4b702213f5223d5f0136ff1343
SHA512

63a272ab4ab31b0eb8fc0df172f6f9914944f5ee8e4eeecff79e2599b140e47bd95f79f5c88936a79e9fb560de93e7ae317059b727a7de1058a5688ac93b0fa1
SSDEEP

6144:NbEjEc2jicP5iOo2T8VrSd/sUAOXUlty4NsdzCRW5D/ToTmxh10Y1Sa:NbERqiG59ouhUjy4KdAW5DLumxh131Sa

Score

10^/10

mystic stealer

Malware Config

Signatures

Detect Mystic stealer payload 4 IoCs

resource	yara_rule
behavioral2/memory/4492-0-0x0000000000400000-0x0000000000428000-memory.dmp	family_mystic
behavioral2/memory/4492-1-0x0000000000400000-0x0000000000428000-memory.dmp	family_mystic
behavioral2/memory/4492-2-0x0000000000400000-0x0000000000428000-memory.dmp	family_mystic
behavioral2/memory/4492-3-0x0000000000400000-0x0000000000428000-memory.dmp	family_mystic

Mystic
Mystic is an infostealer written in C++.
stealer mystic

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4456 set thread context of 4492	4456	file.exe	85

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 4456 wrote to memory of 4492	4456	file.exe	85
PID 4456 wrote to memory of 4492	4456	file.exe	85
PID 4456 wrote to memory of 4492	4456	file.exe	85
PID 4456 wrote to memory of 4492	4456	file.exe	85
PID 4456 wrote to memory of 4492	4456	file.exe	85
PID 4456 wrote to memory of 4492	4456	file.exe	85
PID 4456 wrote to memory of 4492	4456	file.exe	85
PID 4456 wrote to memory of 4492	4456	file.exe	85
PID 4456 wrote to memory of 4492	4456	file.exe	85
PID 4456 wrote to memory of 4492	4456	file.exe	85

C:\Users\Admin\AppData\Local\Temp\file.exe
"C:\Users\Admin\AppData\Local\Temp\file.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4456
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
  2⤵
  PID:4492

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4492-0-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/4492-1-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/4492-2-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/4492-3-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download