mystic | 67f70b1309a4a6b86359028bf95e47e36e984c04e00a6723090c371ba202e27d

Analysis

max time kernel
121s
max time network
138s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
13-10-2023 00:18

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

67f70b1309a4a6b86359028bf95e47e36e984c04e00a6723090c371ba202e27d.exe
Size

359KB
MD5

5d57d90d1088c00983ddd5b9d585b06b
SHA1

69875085fa751f525e052fcf281e0ccef9d03f9f
SHA256

67f70b1309a4a6b86359028bf95e47e36e984c04e00a6723090c371ba202e27d
SHA512

0239b9a9bd819c50084d5120a302b5060ddd912492d8d2a02a98a73e74ea84d52fec780d7635550c19e2c667530b72db7ec9d8366c0292d929976bfb884e218e
SSDEEP

6144:ricaGEZt20ZSwbz8+Dxe8kVAOslOELpF6LP6W7OI3Ajh8Ey:riFzZtT78TWEqojv7O8Ajh8Ey

Score

10^/10

mystic stealer

Malware Config

Signatures

Detect Mystic stealer payload 6 IoCs

resource	yara_rule
behavioral1/memory/1716-7-0x0000000000400000-0x0000000000428000-memory.dmp	family_mystic
behavioral1/memory/1716-5-0x0000000000400000-0x0000000000428000-memory.dmp	family_mystic
behavioral1/memory/1716-4-0x0000000000400000-0x0000000000428000-memory.dmp	family_mystic
behavioral1/memory/1716-3-0x0000000000400000-0x0000000000428000-memory.dmp	family_mystic
behavioral1/memory/1716-9-0x0000000000400000-0x0000000000428000-memory.dmp	family_mystic
behavioral1/memory/1716-11-0x0000000000400000-0x0000000000428000-memory.dmp	family_mystic

Mystic
Mystic is an infostealer written in C++.
stealer mystic

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2012 set thread context of 1716	2012	67f70b1309a4a6b86359028bf95e47e36e984c04e00a6723090c371ba202e27d.exe	28

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2648	1716	WerFault.exe	28

Suspicious use of WriteProcessMemory 21 IoCs

description	pid	Process	procid_target
PID 2012 wrote to memory of 1716	2012	67f70b1309a4a6b86359028bf95e47e36e984c04e00a6723090c371ba202e27d.exe	28
PID 2012 wrote to memory of 1716	2012	67f70b1309a4a6b86359028bf95e47e36e984c04e00a6723090c371ba202e27d.exe	28
PID 2012 wrote to memory of 1716	2012	67f70b1309a4a6b86359028bf95e47e36e984c04e00a6723090c371ba202e27d.exe	28
PID 2012 wrote to memory of 1716	2012	67f70b1309a4a6b86359028bf95e47e36e984c04e00a6723090c371ba202e27d.exe	28
PID 2012 wrote to memory of 1716	2012	67f70b1309a4a6b86359028bf95e47e36e984c04e00a6723090c371ba202e27d.exe	28
PID 2012 wrote to memory of 1716	2012	67f70b1309a4a6b86359028bf95e47e36e984c04e00a6723090c371ba202e27d.exe	28
PID 2012 wrote to memory of 1716	2012	67f70b1309a4a6b86359028bf95e47e36e984c04e00a6723090c371ba202e27d.exe	28
PID 2012 wrote to memory of 1716	2012	67f70b1309a4a6b86359028bf95e47e36e984c04e00a6723090c371ba202e27d.exe	28
PID 2012 wrote to memory of 1716	2012	67f70b1309a4a6b86359028bf95e47e36e984c04e00a6723090c371ba202e27d.exe	28
PID 2012 wrote to memory of 1716	2012	67f70b1309a4a6b86359028bf95e47e36e984c04e00a6723090c371ba202e27d.exe	28
PID 2012 wrote to memory of 1716	2012	67f70b1309a4a6b86359028bf95e47e36e984c04e00a6723090c371ba202e27d.exe	28
PID 2012 wrote to memory of 1716	2012	67f70b1309a4a6b86359028bf95e47e36e984c04e00a6723090c371ba202e27d.exe	28
PID 2012 wrote to memory of 1716	2012	67f70b1309a4a6b86359028bf95e47e36e984c04e00a6723090c371ba202e27d.exe	28
PID 2012 wrote to memory of 1716	2012	67f70b1309a4a6b86359028bf95e47e36e984c04e00a6723090c371ba202e27d.exe	28
PID 1716 wrote to memory of 2648	1716	AppLaunch.exe	29
PID 1716 wrote to memory of 2648	1716	AppLaunch.exe	29
PID 1716 wrote to memory of 2648	1716	AppLaunch.exe	29
PID 1716 wrote to memory of 2648	1716	AppLaunch.exe	29
PID 1716 wrote to memory of 2648	1716	AppLaunch.exe	29
PID 1716 wrote to memory of 2648	1716	AppLaunch.exe	29
PID 1716 wrote to memory of 2648	1716	AppLaunch.exe	29

C:\Users\Admin\AppData\Local\Temp\67f70b1309a4a6b86359028bf95e47e36e984c04e00a6723090c371ba202e27d.exe
"C:\Users\Admin\AppData\Local\Temp\67f70b1309a4a6b86359028bf95e47e36e984c04e00a6723090c371ba202e27d.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2012
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1716
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1716 -s 196
    3⤵
    - Program crash
    PID:2648

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1716-6-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmp

Filesize
4KB

Download
memory/1716-7-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/1716-5-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/1716-4-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/1716-3-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/1716-2-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/1716-1-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/1716-0-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/1716-9-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/1716-11-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads