mystic | bf647f6f7303e223d26582a7af8efaf60f92e34fa7a85eb0fc6171e39cf5fe7a

Analysis

max time kernel
120s
max time network
124s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
13/10/2023, 02:21

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

bf647f6f7303e223d26582a7af8efaf60f92e34fa7a85eb0fc6171e39cf5fe7a_JC.exe
Size

372KB
MD5

980f3a07d0d201cfd49f0e63852852c2
SHA1

64bcfa8b1165d31be0c5c6b930df2da4edc70248
SHA256

bf647f6f7303e223d26582a7af8efaf60f92e34fa7a85eb0fc6171e39cf5fe7a
SHA512

f89d901fe7db8ae5654506c1cd1f3e4cc00ee1137a96808e3cae9a4ebb7fe05917960cb4aa4e7f7396a4404c3a25afdf611dae0faac5470ee83caa6f849dd768
SSDEEP

6144:8NP/FCF1NaNyNgAl8gfC93K4BAOHUWifA/ighdp6svArG8FWF9ZRTOBT:8NFCF1NnMK4B1BifAfpjvgGhFpTOBT

Score

10^/10

mystic stealer

Malware Config

Signatures

Detect Mystic stealer payload 8 IoCs

resource	yara_rule
behavioral1/memory/3060-6-0x0000000000400000-0x0000000000428000-memory.dmp	family_mystic
behavioral1/memory/3060-15-0x0000000000400000-0x0000000000428000-memory.dmp	family_mystic
behavioral1/memory/3060-17-0x0000000000400000-0x0000000000428000-memory.dmp	family_mystic
behavioral1/memory/3060-19-0x0000000000400000-0x0000000000428000-memory.dmp	family_mystic
behavioral1/memory/3060-18-0x0000000000400000-0x0000000000428000-memory.dmp	family_mystic
behavioral1/memory/3060-13-0x0000000000400000-0x0000000000428000-memory.dmp	family_mystic
behavioral1/memory/3060-10-0x0000000000400000-0x0000000000428000-memory.dmp	family_mystic
behavioral1/memory/3060-8-0x0000000000400000-0x0000000000428000-memory.dmp	family_mystic

Mystic
Mystic is an infostealer written in C++.
stealer mystic

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1984 set thread context of 3060	1984	bf647f6f7303e223d26582a7af8efaf60f92e34fa7a85eb0fc6171e39cf5fe7a_JC.exe	29

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 1984 wrote to memory of 3060	1984	bf647f6f7303e223d26582a7af8efaf60f92e34fa7a85eb0fc6171e39cf5fe7a_JC.exe	29
PID 1984 wrote to memory of 3060	1984	bf647f6f7303e223d26582a7af8efaf60f92e34fa7a85eb0fc6171e39cf5fe7a_JC.exe	29
PID 1984 wrote to memory of 3060	1984	bf647f6f7303e223d26582a7af8efaf60f92e34fa7a85eb0fc6171e39cf5fe7a_JC.exe	29
PID 1984 wrote to memory of 3060	1984	bf647f6f7303e223d26582a7af8efaf60f92e34fa7a85eb0fc6171e39cf5fe7a_JC.exe	29
PID 1984 wrote to memory of 3060	1984	bf647f6f7303e223d26582a7af8efaf60f92e34fa7a85eb0fc6171e39cf5fe7a_JC.exe	29
PID 1984 wrote to memory of 3060	1984	bf647f6f7303e223d26582a7af8efaf60f92e34fa7a85eb0fc6171e39cf5fe7a_JC.exe	29
PID 1984 wrote to memory of 3060	1984	bf647f6f7303e223d26582a7af8efaf60f92e34fa7a85eb0fc6171e39cf5fe7a_JC.exe	29
PID 1984 wrote to memory of 3060	1984	bf647f6f7303e223d26582a7af8efaf60f92e34fa7a85eb0fc6171e39cf5fe7a_JC.exe	29
PID 1984 wrote to memory of 3060	1984	bf647f6f7303e223d26582a7af8efaf60f92e34fa7a85eb0fc6171e39cf5fe7a_JC.exe	29
PID 1984 wrote to memory of 3060	1984	bf647f6f7303e223d26582a7af8efaf60f92e34fa7a85eb0fc6171e39cf5fe7a_JC.exe	29
PID 1984 wrote to memory of 3060	1984	bf647f6f7303e223d26582a7af8efaf60f92e34fa7a85eb0fc6171e39cf5fe7a_JC.exe	29
PID 1984 wrote to memory of 3060	1984	bf647f6f7303e223d26582a7af8efaf60f92e34fa7a85eb0fc6171e39cf5fe7a_JC.exe	29
PID 1984 wrote to memory of 3060	1984	bf647f6f7303e223d26582a7af8efaf60f92e34fa7a85eb0fc6171e39cf5fe7a_JC.exe	29
PID 1984 wrote to memory of 3060	1984	bf647f6f7303e223d26582a7af8efaf60f92e34fa7a85eb0fc6171e39cf5fe7a_JC.exe	29

C:\Users\Admin\AppData\Local\Temp\bf647f6f7303e223d26582a7af8efaf60f92e34fa7a85eb0fc6171e39cf5fe7a_JC.exe
"C:\Users\Admin\AppData\Local\Temp\bf647f6f7303e223d26582a7af8efaf60f92e34fa7a85eb0fc6171e39cf5fe7a_JC.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1984
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
  2⤵
  PID:3060

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3060-6-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/3060-15-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/3060-17-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/3060-19-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/3060-18-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/3060-13-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/3060-12-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmp

Filesize
4KB

Download
memory/3060-10-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/3060-8-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/3060-4-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/3060-2-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/3060-0-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads