mystic | 835704f5f60f193feb9ca8cdd6d968243ebc2fa2c263f8281e4dd45b27b22504

Analysis

max time kernel
119s
max time network
123s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
12/10/2023, 16:43

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

835704f5f60f193feb9ca8cdd6d968243ebc2fa2c263f8281e4dd45b27b22504.exe
Size

371KB
MD5

551ecb88185fb0a79f81f0e126a27dd4
SHA1

7791b6f5c3907e61a7f87c3977d7738fd15b8459
SHA256

835704f5f60f193feb9ca8cdd6d968243ebc2fa2c263f8281e4dd45b27b22504
SHA512

a05d647f1fea2714efca3c087d7eb91844149df895c52f6cdc0c624ec48b22f22dcf46da4f2e264152ac4d58d3a6d946316a4c65893652b26419834465e86dba
SSDEEP

6144:0OvJm09zORs+z/TMify9DAOQgQi7mJ2L8Kh6L0wbZkcjJB3+O8/:02w09CK5NPT7UA2pvV8/

Score

10^/10

mystic stealer

Malware Config

Signatures

Detect Mystic stealer payload 6 IoCs

resource	yara_rule
behavioral1/memory/2596-3-0x0000000000400000-0x0000000000428000-memory.dmp	family_mystic
behavioral1/memory/2596-4-0x0000000000400000-0x0000000000428000-memory.dmp	family_mystic
behavioral1/memory/2596-5-0x0000000000400000-0x0000000000428000-memory.dmp	family_mystic
behavioral1/memory/2596-7-0x0000000000400000-0x0000000000428000-memory.dmp	family_mystic
behavioral1/memory/2596-9-0x0000000000400000-0x0000000000428000-memory.dmp	family_mystic
behavioral1/memory/2596-11-0x0000000000400000-0x0000000000428000-memory.dmp	family_mystic

Mystic
Mystic is an infostealer written in C++.
stealer mystic

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2456 set thread context of 2596	2456	835704f5f60f193feb9ca8cdd6d968243ebc2fa2c263f8281e4dd45b27b22504.exe	28

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1728	2596	WerFault.exe	28

Suspicious use of WriteProcessMemory 21 IoCs

description	pid	Process	procid_target
PID 2456 wrote to memory of 2596	2456	835704f5f60f193feb9ca8cdd6d968243ebc2fa2c263f8281e4dd45b27b22504.exe	28
PID 2456 wrote to memory of 2596	2456	835704f5f60f193feb9ca8cdd6d968243ebc2fa2c263f8281e4dd45b27b22504.exe	28
PID 2456 wrote to memory of 2596	2456	835704f5f60f193feb9ca8cdd6d968243ebc2fa2c263f8281e4dd45b27b22504.exe	28
PID 2456 wrote to memory of 2596	2456	835704f5f60f193feb9ca8cdd6d968243ebc2fa2c263f8281e4dd45b27b22504.exe	28
PID 2456 wrote to memory of 2596	2456	835704f5f60f193feb9ca8cdd6d968243ebc2fa2c263f8281e4dd45b27b22504.exe	28
PID 2456 wrote to memory of 2596	2456	835704f5f60f193feb9ca8cdd6d968243ebc2fa2c263f8281e4dd45b27b22504.exe	28
PID 2456 wrote to memory of 2596	2456	835704f5f60f193feb9ca8cdd6d968243ebc2fa2c263f8281e4dd45b27b22504.exe	28
PID 2456 wrote to memory of 2596	2456	835704f5f60f193feb9ca8cdd6d968243ebc2fa2c263f8281e4dd45b27b22504.exe	28
PID 2456 wrote to memory of 2596	2456	835704f5f60f193feb9ca8cdd6d968243ebc2fa2c263f8281e4dd45b27b22504.exe	28
PID 2456 wrote to memory of 2596	2456	835704f5f60f193feb9ca8cdd6d968243ebc2fa2c263f8281e4dd45b27b22504.exe	28
PID 2456 wrote to memory of 2596	2456	835704f5f60f193feb9ca8cdd6d968243ebc2fa2c263f8281e4dd45b27b22504.exe	28
PID 2456 wrote to memory of 2596	2456	835704f5f60f193feb9ca8cdd6d968243ebc2fa2c263f8281e4dd45b27b22504.exe	28
PID 2456 wrote to memory of 2596	2456	835704f5f60f193feb9ca8cdd6d968243ebc2fa2c263f8281e4dd45b27b22504.exe	28
PID 2456 wrote to memory of 2596	2456	835704f5f60f193feb9ca8cdd6d968243ebc2fa2c263f8281e4dd45b27b22504.exe	28
PID 2596 wrote to memory of 1728	2596	AppLaunch.exe	29
PID 2596 wrote to memory of 1728	2596	AppLaunch.exe	29
PID 2596 wrote to memory of 1728	2596	AppLaunch.exe	29
PID 2596 wrote to memory of 1728	2596	AppLaunch.exe	29
PID 2596 wrote to memory of 1728	2596	AppLaunch.exe	29
PID 2596 wrote to memory of 1728	2596	AppLaunch.exe	29
PID 2596 wrote to memory of 1728	2596	AppLaunch.exe	29

C:\Users\Admin\AppData\Local\Temp\835704f5f60f193feb9ca8cdd6d968243ebc2fa2c263f8281e4dd45b27b22504.exe
"C:\Users\Admin\AppData\Local\Temp\835704f5f60f193feb9ca8cdd6d968243ebc2fa2c263f8281e4dd45b27b22504.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2456
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2596
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2596 -s 196
    3⤵
    - Program crash
    PID:1728

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2596-0-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/2596-1-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/2596-2-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/2596-3-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/2596-4-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/2596-5-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/2596-6-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmp

Filesize
4KB

Download
memory/2596-7-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/2596-9-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/2596-11-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads