mystic | 9079101743cc5fd7f72ced94bf1dbd98374fc0cc46dd900b01c583aedf711d7e

Analysis

max time kernel
119s
max time network
139s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
13/10/2023, 04:02

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

9079101743cc5fd7f72ced94bf1dbd98374fc0cc46dd900b01c583aedf711d7e.exe
Size

358KB
MD5

60a14bb01cc5e53decaa173c741da1a9
SHA1

0d93b21f4d397322dd6f88de8e7a283b47b8fa69
SHA256

9079101743cc5fd7f72ced94bf1dbd98374fc0cc46dd900b01c583aedf711d7e
SHA512

b514af6dd7fff7b94b3ee2c43c8e9f4216485729f710557c91e3fcf4e470d6b5a70f63f9718aab280ec0cb2a0fc642ff7bcd5aacdaf5839e9ca4c8dd73667131
SSDEEP

6144:R/FXR/bOEHHkwxOSeyCKrJz4AOOvRNUtpEG2CbKZNcW8MYdQXR4Pk8fi:lFX1aEHEw94Uv7G2CbKvbDOs8fi

Score

10^/10

mystic stealer

Malware Config

Signatures

Detect Mystic stealer payload 6 IoCs

resource	yara_rule
behavioral1/memory/2084-3-0x0000000000400000-0x0000000000428000-memory.dmp	family_mystic
behavioral1/memory/2084-5-0x0000000000400000-0x0000000000428000-memory.dmp	family_mystic
behavioral1/memory/2084-4-0x0000000000400000-0x0000000000428000-memory.dmp	family_mystic
behavioral1/memory/2084-7-0x0000000000400000-0x0000000000428000-memory.dmp	family_mystic
behavioral1/memory/2084-9-0x0000000000400000-0x0000000000428000-memory.dmp	family_mystic
behavioral1/memory/2084-11-0x0000000000400000-0x0000000000428000-memory.dmp	family_mystic

Mystic
Mystic is an infostealer written in C++.
stealer mystic

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2132 set thread context of 2084	2132	9079101743cc5fd7f72ced94bf1dbd98374fc0cc46dd900b01c583aedf711d7e.exe	29

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2788	2084	WerFault.exe	29

Suspicious use of WriteProcessMemory 21 IoCs

description	pid	Process	procid_target
PID 2132 wrote to memory of 2084	2132	9079101743cc5fd7f72ced94bf1dbd98374fc0cc46dd900b01c583aedf711d7e.exe	29
PID 2132 wrote to memory of 2084	2132	9079101743cc5fd7f72ced94bf1dbd98374fc0cc46dd900b01c583aedf711d7e.exe	29
PID 2132 wrote to memory of 2084	2132	9079101743cc5fd7f72ced94bf1dbd98374fc0cc46dd900b01c583aedf711d7e.exe	29
PID 2132 wrote to memory of 2084	2132	9079101743cc5fd7f72ced94bf1dbd98374fc0cc46dd900b01c583aedf711d7e.exe	29
PID 2132 wrote to memory of 2084	2132	9079101743cc5fd7f72ced94bf1dbd98374fc0cc46dd900b01c583aedf711d7e.exe	29
PID 2132 wrote to memory of 2084	2132	9079101743cc5fd7f72ced94bf1dbd98374fc0cc46dd900b01c583aedf711d7e.exe	29
PID 2132 wrote to memory of 2084	2132	9079101743cc5fd7f72ced94bf1dbd98374fc0cc46dd900b01c583aedf711d7e.exe	29
PID 2132 wrote to memory of 2084	2132	9079101743cc5fd7f72ced94bf1dbd98374fc0cc46dd900b01c583aedf711d7e.exe	29
PID 2132 wrote to memory of 2084	2132	9079101743cc5fd7f72ced94bf1dbd98374fc0cc46dd900b01c583aedf711d7e.exe	29
PID 2132 wrote to memory of 2084	2132	9079101743cc5fd7f72ced94bf1dbd98374fc0cc46dd900b01c583aedf711d7e.exe	29
PID 2132 wrote to memory of 2084	2132	9079101743cc5fd7f72ced94bf1dbd98374fc0cc46dd900b01c583aedf711d7e.exe	29
PID 2132 wrote to memory of 2084	2132	9079101743cc5fd7f72ced94bf1dbd98374fc0cc46dd900b01c583aedf711d7e.exe	29
PID 2132 wrote to memory of 2084	2132	9079101743cc5fd7f72ced94bf1dbd98374fc0cc46dd900b01c583aedf711d7e.exe	29
PID 2132 wrote to memory of 2084	2132	9079101743cc5fd7f72ced94bf1dbd98374fc0cc46dd900b01c583aedf711d7e.exe	29
PID 2084 wrote to memory of 2788	2084	AppLaunch.exe	30
PID 2084 wrote to memory of 2788	2084	AppLaunch.exe	30
PID 2084 wrote to memory of 2788	2084	AppLaunch.exe	30
PID 2084 wrote to memory of 2788	2084	AppLaunch.exe	30
PID 2084 wrote to memory of 2788	2084	AppLaunch.exe	30
PID 2084 wrote to memory of 2788	2084	AppLaunch.exe	30
PID 2084 wrote to memory of 2788	2084	AppLaunch.exe	30

C:\Users\Admin\AppData\Local\Temp\9079101743cc5fd7f72ced94bf1dbd98374fc0cc46dd900b01c583aedf711d7e.exe
"C:\Users\Admin\AppData\Local\Temp\9079101743cc5fd7f72ced94bf1dbd98374fc0cc46dd900b01c583aedf711d7e.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2132
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2084
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2084 -s 196
    3⤵
    - Program crash
    PID:2788

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2084-1-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/2084-0-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/2084-2-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/2084-3-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/2084-5-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/2084-4-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/2084-6-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmp

Filesize
4KB

Download
memory/2084-7-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/2084-9-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/2084-11-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads