mystic | 18568d82c04621ae703a790a9ccfc4f2672b105681ab694f1b4bac1854200557

Analysis

max time kernel
118s
max time network
126s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
13-10-2023 01:58

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

18568d82c04621ae703a790a9ccfc4f2672b105681ab694f1b4bac1854200557.exe
Size

359KB
MD5

c1aec9c8bc0cf3ef297e1fdd4bf3fd50
SHA1

0e41190948afa551f67efdd3ef7ef88376a6d83a
SHA256

18568d82c04621ae703a790a9ccfc4f2672b105681ab694f1b4bac1854200557
SHA512

2a4a0ebd0f7e4fe0dad253bf994b9d66287105262e8521958f071518f60cd2fd80c83ee1fba1d641a4da9513673b955c5d40131b335e773a479172f53cd6014a
SSDEEP

6144:wqcaGEZt20ZSwbz8+Dxe8kVAO3lUtNEtvpQFbTdSQuYjnicVZh8Ey:wqFzZtT78Tp2kDQNlueni0h8Ey

Score

10^/10

mystic stealer

Malware Config

Signatures

Detect Mystic stealer payload 6 IoCs

resource	yara_rule
behavioral1/memory/2600-3-0x0000000000400000-0x0000000000428000-memory.dmp	family_mystic
behavioral1/memory/2600-4-0x0000000000400000-0x0000000000428000-memory.dmp	family_mystic
behavioral1/memory/2600-5-0x0000000000400000-0x0000000000428000-memory.dmp	family_mystic
behavioral1/memory/2600-7-0x0000000000400000-0x0000000000428000-memory.dmp	family_mystic
behavioral1/memory/2600-9-0x0000000000400000-0x0000000000428000-memory.dmp	family_mystic
behavioral1/memory/2600-11-0x0000000000400000-0x0000000000428000-memory.dmp	family_mystic

Mystic
Mystic is an infostealer written in C++.
stealer mystic

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2732 set thread context of 2600	2732	18568d82c04621ae703a790a9ccfc4f2672b105681ab694f1b4bac1854200557.exe	30

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2596	2600	WerFault.exe	30

Suspicious use of WriteProcessMemory 28 IoCs

description	pid	Process	procid_target
PID 2732 wrote to memory of 2580	2732	18568d82c04621ae703a790a9ccfc4f2672b105681ab694f1b4bac1854200557.exe	29
PID 2732 wrote to memory of 2580	2732	18568d82c04621ae703a790a9ccfc4f2672b105681ab694f1b4bac1854200557.exe	29
PID 2732 wrote to memory of 2580	2732	18568d82c04621ae703a790a9ccfc4f2672b105681ab694f1b4bac1854200557.exe	29
PID 2732 wrote to memory of 2580	2732	18568d82c04621ae703a790a9ccfc4f2672b105681ab694f1b4bac1854200557.exe	29
PID 2732 wrote to memory of 2580	2732	18568d82c04621ae703a790a9ccfc4f2672b105681ab694f1b4bac1854200557.exe	29
PID 2732 wrote to memory of 2580	2732	18568d82c04621ae703a790a9ccfc4f2672b105681ab694f1b4bac1854200557.exe	29
PID 2732 wrote to memory of 2580	2732	18568d82c04621ae703a790a9ccfc4f2672b105681ab694f1b4bac1854200557.exe	29
PID 2732 wrote to memory of 2600	2732	18568d82c04621ae703a790a9ccfc4f2672b105681ab694f1b4bac1854200557.exe	30
PID 2732 wrote to memory of 2600	2732	18568d82c04621ae703a790a9ccfc4f2672b105681ab694f1b4bac1854200557.exe	30
PID 2732 wrote to memory of 2600	2732	18568d82c04621ae703a790a9ccfc4f2672b105681ab694f1b4bac1854200557.exe	30
PID 2732 wrote to memory of 2600	2732	18568d82c04621ae703a790a9ccfc4f2672b105681ab694f1b4bac1854200557.exe	30
PID 2732 wrote to memory of 2600	2732	18568d82c04621ae703a790a9ccfc4f2672b105681ab694f1b4bac1854200557.exe	30
PID 2732 wrote to memory of 2600	2732	18568d82c04621ae703a790a9ccfc4f2672b105681ab694f1b4bac1854200557.exe	30
PID 2732 wrote to memory of 2600	2732	18568d82c04621ae703a790a9ccfc4f2672b105681ab694f1b4bac1854200557.exe	30
PID 2732 wrote to memory of 2600	2732	18568d82c04621ae703a790a9ccfc4f2672b105681ab694f1b4bac1854200557.exe	30
PID 2732 wrote to memory of 2600	2732	18568d82c04621ae703a790a9ccfc4f2672b105681ab694f1b4bac1854200557.exe	30
PID 2732 wrote to memory of 2600	2732	18568d82c04621ae703a790a9ccfc4f2672b105681ab694f1b4bac1854200557.exe	30
PID 2732 wrote to memory of 2600	2732	18568d82c04621ae703a790a9ccfc4f2672b105681ab694f1b4bac1854200557.exe	30
PID 2732 wrote to memory of 2600	2732	18568d82c04621ae703a790a9ccfc4f2672b105681ab694f1b4bac1854200557.exe	30
PID 2732 wrote to memory of 2600	2732	18568d82c04621ae703a790a9ccfc4f2672b105681ab694f1b4bac1854200557.exe	30
PID 2732 wrote to memory of 2600	2732	18568d82c04621ae703a790a9ccfc4f2672b105681ab694f1b4bac1854200557.exe	30
PID 2600 wrote to memory of 2596	2600	AppLaunch.exe	31
PID 2600 wrote to memory of 2596	2600	AppLaunch.exe	31
PID 2600 wrote to memory of 2596	2600	AppLaunch.exe	31
PID 2600 wrote to memory of 2596	2600	AppLaunch.exe	31
PID 2600 wrote to memory of 2596	2600	AppLaunch.exe	31
PID 2600 wrote to memory of 2596	2600	AppLaunch.exe	31
PID 2600 wrote to memory of 2596	2600	AppLaunch.exe	31

C:\Users\Admin\AppData\Local\Temp\18568d82c04621ae703a790a9ccfc4f2672b105681ab694f1b4bac1854200557.exe
"C:\Users\Admin\AppData\Local\Temp\18568d82c04621ae703a790a9ccfc4f2672b105681ab694f1b4bac1854200557.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2732
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
  2⤵
  PID:2580
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2600
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2600 -s 196
    3⤵
    - Program crash
    PID:2596

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2600-0-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/2600-1-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/2600-2-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/2600-3-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/2600-4-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/2600-5-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/2600-6-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmp

Filesize
4KB

Download
memory/2600-7-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/2600-9-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/2600-11-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads