mystic | d423942f04ffa4dc2205cee828f97c341bdfade167cb9dd563d73b459e2e13d1

Analysis

max time kernel
240s
max time network
302s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
12-10-2023 18:56

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d423942f04ffa4dc2205cee828f97c341bdfade167cb9dd563d73b459e2e13d1.exe
Size

371KB
MD5

290c76e2181240b53c6041ba9badff71
SHA1

3f9143fe51a963858c3c4497ad9168354dcae5a8
SHA256

d423942f04ffa4dc2205cee828f97c341bdfade167cb9dd563d73b459e2e13d1
SHA512

659ba6477d58d1855ab907bf21f4e44bb19111242bbe1a40d12efdc48af47a5ef971f3de563b68446e4066b91b070e8e9368bca4a09d6a7b82b00fe193e4581b
SSDEEP

6144:FXvJm09zORs+z/TMify9DAO7gQgXA/iAtbmzG2BKCKrKFkW/EIPonnnAh8/:F/w09CK5NuTs7bmvB3KrKFkqEIPonnnr

Score

10^/10

mystic stealer

Malware Config

Signatures

Detect Mystic stealer payload 6 IoCs

resource	yara_rule
behavioral1/memory/2476-3-0x0000000000400000-0x0000000000428000-memory.dmp	family_mystic
behavioral1/memory/2476-4-0x0000000000400000-0x0000000000428000-memory.dmp	family_mystic
behavioral1/memory/2476-5-0x0000000000400000-0x0000000000428000-memory.dmp	family_mystic
behavioral1/memory/2476-7-0x0000000000400000-0x0000000000428000-memory.dmp	family_mystic
behavioral1/memory/2476-9-0x0000000000400000-0x0000000000428000-memory.dmp	family_mystic
behavioral1/memory/2476-11-0x0000000000400000-0x0000000000428000-memory.dmp	family_mystic

Mystic
Mystic is an infostealer written in C++.
stealer mystic

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2596 set thread context of 2476	2596	d423942f04ffa4dc2205cee828f97c341bdfade167cb9dd563d73b459e2e13d1.exe	27

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2692	2476	WerFault.exe	27

Suspicious use of WriteProcessMemory 21 IoCs

description	pid	Process	procid_target
PID 2596 wrote to memory of 2476	2596	d423942f04ffa4dc2205cee828f97c341bdfade167cb9dd563d73b459e2e13d1.exe	27
PID 2596 wrote to memory of 2476	2596	d423942f04ffa4dc2205cee828f97c341bdfade167cb9dd563d73b459e2e13d1.exe	27
PID 2596 wrote to memory of 2476	2596	d423942f04ffa4dc2205cee828f97c341bdfade167cb9dd563d73b459e2e13d1.exe	27
PID 2596 wrote to memory of 2476	2596	d423942f04ffa4dc2205cee828f97c341bdfade167cb9dd563d73b459e2e13d1.exe	27
PID 2596 wrote to memory of 2476	2596	d423942f04ffa4dc2205cee828f97c341bdfade167cb9dd563d73b459e2e13d1.exe	27
PID 2596 wrote to memory of 2476	2596	d423942f04ffa4dc2205cee828f97c341bdfade167cb9dd563d73b459e2e13d1.exe	27
PID 2596 wrote to memory of 2476	2596	d423942f04ffa4dc2205cee828f97c341bdfade167cb9dd563d73b459e2e13d1.exe	27
PID 2596 wrote to memory of 2476	2596	d423942f04ffa4dc2205cee828f97c341bdfade167cb9dd563d73b459e2e13d1.exe	27
PID 2596 wrote to memory of 2476	2596	d423942f04ffa4dc2205cee828f97c341bdfade167cb9dd563d73b459e2e13d1.exe	27
PID 2596 wrote to memory of 2476	2596	d423942f04ffa4dc2205cee828f97c341bdfade167cb9dd563d73b459e2e13d1.exe	27
PID 2596 wrote to memory of 2476	2596	d423942f04ffa4dc2205cee828f97c341bdfade167cb9dd563d73b459e2e13d1.exe	27
PID 2596 wrote to memory of 2476	2596	d423942f04ffa4dc2205cee828f97c341bdfade167cb9dd563d73b459e2e13d1.exe	27
PID 2596 wrote to memory of 2476	2596	d423942f04ffa4dc2205cee828f97c341bdfade167cb9dd563d73b459e2e13d1.exe	27
PID 2596 wrote to memory of 2476	2596	d423942f04ffa4dc2205cee828f97c341bdfade167cb9dd563d73b459e2e13d1.exe	27
PID 2476 wrote to memory of 2692	2476	AppLaunch.exe	28
PID 2476 wrote to memory of 2692	2476	AppLaunch.exe	28
PID 2476 wrote to memory of 2692	2476	AppLaunch.exe	28
PID 2476 wrote to memory of 2692	2476	AppLaunch.exe	28
PID 2476 wrote to memory of 2692	2476	AppLaunch.exe	28
PID 2476 wrote to memory of 2692	2476	AppLaunch.exe	28
PID 2476 wrote to memory of 2692	2476	AppLaunch.exe	28

C:\Users\Admin\AppData\Local\Temp\d423942f04ffa4dc2205cee828f97c341bdfade167cb9dd563d73b459e2e13d1.exe
"C:\Users\Admin\AppData\Local\Temp\d423942f04ffa4dc2205cee828f97c341bdfade167cb9dd563d73b459e2e13d1.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2596
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2476
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2476 -s 196
    3⤵
    - Program crash
    PID:2692

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2476-0-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/2476-2-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/2476-3-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/2476-1-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/2476-4-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/2476-5-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/2476-6-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmp

Filesize
4KB

Download
memory/2476-7-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/2476-9-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/2476-11-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads