mystic | 71542e0aeb643a2ba9537b2c450ac0bb11605df669a3428d5d85fd343ab403c7

Analysis

max time kernel
120s
max time network
135s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
12/10/2023, 16:44

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

71542e0aeb643a2ba9537b2c450ac0bb11605df669a3428d5d85fd343ab403c7.exe
Size

371KB
MD5

da7600a6636ad129023237624f156c81
SHA1

e351f624b923c953ba780d244b082f453556e0ce
SHA256

71542e0aeb643a2ba9537b2c450ac0bb11605df669a3428d5d85fd343ab403c7
SHA512

51444b2d4205ac16eccfb0d56b6fe923de3a81b1b1a321d92baaddd0cb017477b9da2290418409fa81583f96929d1fd49b94dd3829461beb066b5c2d650d9763
SSDEEP

6144:SOvJm09zORs+z/TMify9DAOagQFWaN6tjTK7kGTryB38/:S2w09CK5NZe3N6tje7k78/

Score

10^/10

mystic stealer

Malware Config

Signatures

Detect Mystic stealer payload 6 IoCs

resource	yara_rule
behavioral1/memory/2836-5-0x0000000000400000-0x0000000000428000-memory.dmp	family_mystic
behavioral1/memory/2836-4-0x0000000000400000-0x0000000000428000-memory.dmp	family_mystic
behavioral1/memory/2836-6-0x0000000000400000-0x0000000000428000-memory.dmp	family_mystic
behavioral1/memory/2836-8-0x0000000000400000-0x0000000000428000-memory.dmp	family_mystic
behavioral1/memory/2836-10-0x0000000000400000-0x0000000000428000-memory.dmp	family_mystic
behavioral1/memory/2836-12-0x0000000000400000-0x0000000000428000-memory.dmp	family_mystic

Mystic
Mystic is an infostealer written in C++.
stealer mystic

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2448 set thread context of 2836	2448	71542e0aeb643a2ba9537b2c450ac0bb11605df669a3428d5d85fd343ab403c7.exe	28

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2724	2836	WerFault.exe	28

Suspicious use of WriteProcessMemory 21 IoCs

description	pid	Process	procid_target
PID 2448 wrote to memory of 2836	2448	71542e0aeb643a2ba9537b2c450ac0bb11605df669a3428d5d85fd343ab403c7.exe	28
PID 2448 wrote to memory of 2836	2448	71542e0aeb643a2ba9537b2c450ac0bb11605df669a3428d5d85fd343ab403c7.exe	28
PID 2448 wrote to memory of 2836	2448	71542e0aeb643a2ba9537b2c450ac0bb11605df669a3428d5d85fd343ab403c7.exe	28
PID 2448 wrote to memory of 2836	2448	71542e0aeb643a2ba9537b2c450ac0bb11605df669a3428d5d85fd343ab403c7.exe	28
PID 2448 wrote to memory of 2836	2448	71542e0aeb643a2ba9537b2c450ac0bb11605df669a3428d5d85fd343ab403c7.exe	28
PID 2448 wrote to memory of 2836	2448	71542e0aeb643a2ba9537b2c450ac0bb11605df669a3428d5d85fd343ab403c7.exe	28
PID 2448 wrote to memory of 2836	2448	71542e0aeb643a2ba9537b2c450ac0bb11605df669a3428d5d85fd343ab403c7.exe	28
PID 2448 wrote to memory of 2836	2448	71542e0aeb643a2ba9537b2c450ac0bb11605df669a3428d5d85fd343ab403c7.exe	28
PID 2448 wrote to memory of 2836	2448	71542e0aeb643a2ba9537b2c450ac0bb11605df669a3428d5d85fd343ab403c7.exe	28
PID 2448 wrote to memory of 2836	2448	71542e0aeb643a2ba9537b2c450ac0bb11605df669a3428d5d85fd343ab403c7.exe	28
PID 2448 wrote to memory of 2836	2448	71542e0aeb643a2ba9537b2c450ac0bb11605df669a3428d5d85fd343ab403c7.exe	28
PID 2448 wrote to memory of 2836	2448	71542e0aeb643a2ba9537b2c450ac0bb11605df669a3428d5d85fd343ab403c7.exe	28
PID 2448 wrote to memory of 2836	2448	71542e0aeb643a2ba9537b2c450ac0bb11605df669a3428d5d85fd343ab403c7.exe	28
PID 2448 wrote to memory of 2836	2448	71542e0aeb643a2ba9537b2c450ac0bb11605df669a3428d5d85fd343ab403c7.exe	28
PID 2836 wrote to memory of 2724	2836	AppLaunch.exe	29
PID 2836 wrote to memory of 2724	2836	AppLaunch.exe	29
PID 2836 wrote to memory of 2724	2836	AppLaunch.exe	29
PID 2836 wrote to memory of 2724	2836	AppLaunch.exe	29
PID 2836 wrote to memory of 2724	2836	AppLaunch.exe	29
PID 2836 wrote to memory of 2724	2836	AppLaunch.exe	29
PID 2836 wrote to memory of 2724	2836	AppLaunch.exe	29

C:\Users\Admin\AppData\Local\Temp\71542e0aeb643a2ba9537b2c450ac0bb11605df669a3428d5d85fd343ab403c7.exe
"C:\Users\Admin\AppData\Local\Temp\71542e0aeb643a2ba9537b2c450ac0bb11605df669a3428d5d85fd343ab403c7.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2448
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2836
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2836 -s 196
    3⤵
    - Program crash
    PID:2724

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2836-0-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/2836-1-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/2836-5-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/2836-4-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/2836-6-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/2836-2-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/2836-8-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/2836-7-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmp

Filesize
4KB

Download
memory/2836-10-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/2836-12-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads