mystic | 42401d1ba19adea1617162e7740f9a1a1118324858ade98dac8c0461cdfe01f5

Analysis

max time kernel
121s
max time network
145s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
13-10-2023 21:06

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

42401d1ba19adea1617162e7740f9a1a1118324858ade98dac8c0461cdfe01f5.exe
Size

372KB
MD5

3b9d89e287f8d7b559f8bc55a0097092
SHA1

598ba3c7d1828322b7a12dbe4a550423b583c2ad
SHA256

42401d1ba19adea1617162e7740f9a1a1118324858ade98dac8c0461cdfe01f5
SHA512

132403095982a502149c0ba372089226279ff50d12b853416f1d9071f92dc6ed4e46a30abd200c802f47569e1f4ba9b009e443837d1723600ef19b55fef08515
SSDEEP

6144:wqv07fpNNmpkx1Sop1W/bJt9K4BAORit+fs7BzAvqGxlpmCAOB:wn7fpNNbGK4B3UnAvqGxlpmhOB

Score

10^/10

mystic stealer

Malware Config

Signatures

Detect Mystic stealer payload 6 IoCs

resource	yara_rule
behavioral1/memory/2528-3-0x0000000000400000-0x0000000000428000-memory.dmp	family_mystic
behavioral1/memory/2528-5-0x0000000000400000-0x0000000000428000-memory.dmp	family_mystic
behavioral1/memory/2528-4-0x0000000000400000-0x0000000000428000-memory.dmp	family_mystic
behavioral1/memory/2528-7-0x0000000000400000-0x0000000000428000-memory.dmp	family_mystic
behavioral1/memory/2528-9-0x0000000000400000-0x0000000000428000-memory.dmp	family_mystic
behavioral1/memory/2528-11-0x0000000000400000-0x0000000000428000-memory.dmp	family_mystic

Mystic
Mystic is an infostealer written in C++.
stealer mystic

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2816 set thread context of 2528	2816	42401d1ba19adea1617162e7740f9a1a1118324858ade98dac8c0461cdfe01f5.exe	30

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2544	2528	WerFault.exe	30

Suspicious use of WriteProcessMemory 21 IoCs

description	pid	Process	procid_target
PID 2816 wrote to memory of 2528	2816	42401d1ba19adea1617162e7740f9a1a1118324858ade98dac8c0461cdfe01f5.exe	30
PID 2816 wrote to memory of 2528	2816	42401d1ba19adea1617162e7740f9a1a1118324858ade98dac8c0461cdfe01f5.exe	30
PID 2816 wrote to memory of 2528	2816	42401d1ba19adea1617162e7740f9a1a1118324858ade98dac8c0461cdfe01f5.exe	30
PID 2816 wrote to memory of 2528	2816	42401d1ba19adea1617162e7740f9a1a1118324858ade98dac8c0461cdfe01f5.exe	30
PID 2816 wrote to memory of 2528	2816	42401d1ba19adea1617162e7740f9a1a1118324858ade98dac8c0461cdfe01f5.exe	30
PID 2816 wrote to memory of 2528	2816	42401d1ba19adea1617162e7740f9a1a1118324858ade98dac8c0461cdfe01f5.exe	30
PID 2816 wrote to memory of 2528	2816	42401d1ba19adea1617162e7740f9a1a1118324858ade98dac8c0461cdfe01f5.exe	30
PID 2816 wrote to memory of 2528	2816	42401d1ba19adea1617162e7740f9a1a1118324858ade98dac8c0461cdfe01f5.exe	30
PID 2816 wrote to memory of 2528	2816	42401d1ba19adea1617162e7740f9a1a1118324858ade98dac8c0461cdfe01f5.exe	30
PID 2816 wrote to memory of 2528	2816	42401d1ba19adea1617162e7740f9a1a1118324858ade98dac8c0461cdfe01f5.exe	30
PID 2816 wrote to memory of 2528	2816	42401d1ba19adea1617162e7740f9a1a1118324858ade98dac8c0461cdfe01f5.exe	30
PID 2816 wrote to memory of 2528	2816	42401d1ba19adea1617162e7740f9a1a1118324858ade98dac8c0461cdfe01f5.exe	30
PID 2816 wrote to memory of 2528	2816	42401d1ba19adea1617162e7740f9a1a1118324858ade98dac8c0461cdfe01f5.exe	30
PID 2816 wrote to memory of 2528	2816	42401d1ba19adea1617162e7740f9a1a1118324858ade98dac8c0461cdfe01f5.exe	30
PID 2528 wrote to memory of 2544	2528	AppLaunch.exe	31
PID 2528 wrote to memory of 2544	2528	AppLaunch.exe	31
PID 2528 wrote to memory of 2544	2528	AppLaunch.exe	31
PID 2528 wrote to memory of 2544	2528	AppLaunch.exe	31
PID 2528 wrote to memory of 2544	2528	AppLaunch.exe	31
PID 2528 wrote to memory of 2544	2528	AppLaunch.exe	31
PID 2528 wrote to memory of 2544	2528	AppLaunch.exe	31

C:\Users\Admin\AppData\Local\Temp\42401d1ba19adea1617162e7740f9a1a1118324858ade98dac8c0461cdfe01f5.exe
"C:\Users\Admin\AppData\Local\Temp\42401d1ba19adea1617162e7740f9a1a1118324858ade98dac8c0461cdfe01f5.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2816
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2528
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2528 -s 196
    3⤵
    - Program crash
    PID:2544

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2528-1-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/2528-0-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/2528-2-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/2528-3-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/2528-5-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/2528-4-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/2528-6-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmp

Filesize
4KB

Download
memory/2528-7-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/2528-9-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/2528-11-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads