mystic | cdff3538fac723c441ee75c5471c3ea1f25d5dec6a3b552513794ae79647d974

General

Target

NEAS.c89a27bb1bf5d48a07131b5d602ff940.exe
Size

309KB
MD5

c89a27bb1bf5d48a07131b5d602ff940
SHA1

f68c6623455972e2b919acc997eea63a291876ee
SHA256

cdff3538fac723c441ee75c5471c3ea1f25d5dec6a3b552513794ae79647d974
SHA512

2925d0e5ac0f2c608ddb3b3c55536ee8896c18a5c6bec6b5e4e76f6af69ce8509d662b5bd9c52f7379e8b4425e81f377e6fa98caf691ee14707e58dd99a0b43a
SSDEEP

6144:Key+bnr+Zkp0yN90QE1iEksrxO7LVq4bIbOLBv3Rmnz:uMryy90PusrxO7L7MOLV3Y

Score

10^/10

mystic evasion persistence stealer trojan

Malware Config

Signatures

Detect Mystic stealer payload 4 IoCs

resource	yara_rule
behavioral1/memory/1904-7-0x0000000000400000-0x0000000000433000-memory.dmp	mystic_family
behavioral1/memory/1904-8-0x0000000000400000-0x0000000000433000-memory.dmp	mystic_family
behavioral1/memory/1904-9-0x0000000000400000-0x0000000000433000-memory.dmp	mystic_family
behavioral1/memory/1904-11-0x0000000000400000-0x0000000000433000-memory.dmp	mystic_family

Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs

evasion trojan

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection	AppLaunch.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	AppLaunch.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	AppLaunch.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	AppLaunch.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	AppLaunch.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	AppLaunch.exe

Mystic
Mystic is an infostealer written in C++.
stealer mystic

Executes dropped EXE 2 IoCs

pid	Process
2272	1nA81RO9.exe
1776	6ss2dW8.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	NEAS.c89a27bb1bf5d48a07131b5d602ff940.exe

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 2272 set thread context of 1904	2272	1nA81RO9.exe	92
PID 1776 set thread context of 1356	1776	6ss2dW8.exe	95

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3004	1904	WerFault.exe	92

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1356	AppLaunch.exe
1356	AppLaunch.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1356	AppLaunch.exe

Suspicious use of WriteProcessMemory 24 IoCs

description	pid	Process	procid_target
PID 884 wrote to memory of 2272	884	NEAS.c89a27bb1bf5d48a07131b5d602ff940.exe	91
PID 884 wrote to memory of 2272	884	NEAS.c89a27bb1bf5d48a07131b5d602ff940.exe	91
PID 884 wrote to memory of 2272	884	NEAS.c89a27bb1bf5d48a07131b5d602ff940.exe	91
PID 2272 wrote to memory of 1904	2272	1nA81RO9.exe	92
PID 2272 wrote to memory of 1904	2272	1nA81RO9.exe	92
PID 2272 wrote to memory of 1904	2272	1nA81RO9.exe	92
PID 2272 wrote to memory of 1904	2272	1nA81RO9.exe	92
PID 2272 wrote to memory of 1904	2272	1nA81RO9.exe	92
PID 2272 wrote to memory of 1904	2272	1nA81RO9.exe	92
PID 2272 wrote to memory of 1904	2272	1nA81RO9.exe	92
PID 2272 wrote to memory of 1904	2272	1nA81RO9.exe	92
PID 2272 wrote to memory of 1904	2272	1nA81RO9.exe	92
PID 2272 wrote to memory of 1904	2272	1nA81RO9.exe	92
PID 884 wrote to memory of 1776	884	NEAS.c89a27bb1bf5d48a07131b5d602ff940.exe	94
PID 884 wrote to memory of 1776	884	NEAS.c89a27bb1bf5d48a07131b5d602ff940.exe	94
PID 884 wrote to memory of 1776	884	NEAS.c89a27bb1bf5d48a07131b5d602ff940.exe	94
PID 1776 wrote to memory of 1356	1776	6ss2dW8.exe	95
PID 1776 wrote to memory of 1356	1776	6ss2dW8.exe	95
PID 1776 wrote to memory of 1356	1776	6ss2dW8.exe	95
PID 1776 wrote to memory of 1356	1776	6ss2dW8.exe	95
PID 1776 wrote to memory of 1356	1776	6ss2dW8.exe	95
PID 1776 wrote to memory of 1356	1776	6ss2dW8.exe	95
PID 1776 wrote to memory of 1356	1776	6ss2dW8.exe	95
PID 1776 wrote to memory of 1356	1776	6ss2dW8.exe	95

C:\Users\Admin\AppData\Local\Temp\NEAS.c89a27bb1bf5d48a07131b5d602ff940.exe
"C:\Users\Admin\AppData\Local\Temp\NEAS.c89a27bb1bf5d48a07131b5d602ff940.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:884
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\1nA81RO9.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\1nA81RO9.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - Suspicious use of WriteProcessMemory
  PID:2272
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
    3⤵
    PID:1904
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1904 -s 192
      4⤵
      Program crash
      PID:3004
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\6ss2dW8.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\6ss2dW8.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - Suspicious use of WriteProcessMemory
  PID:1776
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
    3⤵
    - Modifies Windows Defender Real-time Protection settings
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1356

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 1904 -ip 1904
1⤵
PID:2772

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Create or Modify System Process

1

T1543

Windows Service

1

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Create or Modify System Process

1

T1543

Windows Service

1

T1543.003

Defense Evasion

Impair Defenses

1

T1562

Disable or Modify Tools

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\1nA81RO9.exe

Filesize
286KB

MD5
9f706f44b35c4827e3caf810177ba559

SHA1
423ec74a1b77869f4a9c8756f60b6c4933536a11

SHA256
96f917bd1ad6484886795509e0d0a58731fe455cb44d33022c8f69389453f740

SHA512
5333771c82485dca039c1372873bce6409c0a1c1799baedd03eed7638036e8228220349f595075f72506257f05b213ac3c2ebf6d53a8d67da3ce4c8ef05ff19c

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\1nA81RO9.exe

Filesize
286KB

MD5
9f706f44b35c4827e3caf810177ba559

SHA1
423ec74a1b77869f4a9c8756f60b6c4933536a11

SHA256
96f917bd1ad6484886795509e0d0a58731fe455cb44d33022c8f69389453f740

SHA512
5333771c82485dca039c1372873bce6409c0a1c1799baedd03eed7638036e8228220349f595075f72506257f05b213ac3c2ebf6d53a8d67da3ce4c8ef05ff19c

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\6ss2dW8.exe

Filesize
117KB

MD5
156a74b53feb59ac666b296b39a41706

SHA1
e24f65e6ecf779383b904941d1f4314bb7aa1c87

SHA256
388f7aa02edb57ac6dbae478f23660daffb64a2eca70942391b4de92a1977494

SHA512
43e202ed931799c54a9d4d0ed660cd44c43767723fd69091e174f8bee721cff6221364df0e8f902a6d59c5b0359f1cb671c5ec1eed5e56f0bfbdbeaf50faee70

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\6ss2dW8.exe

Filesize
117KB

MD5
156a74b53feb59ac666b296b39a41706

SHA1
e24f65e6ecf779383b904941d1f4314bb7aa1c87

SHA256
388f7aa02edb57ac6dbae478f23660daffb64a2eca70942391b4de92a1977494

SHA512
43e202ed931799c54a9d4d0ed660cd44c43767723fd69091e174f8bee721cff6221364df0e8f902a6d59c5b0359f1cb671c5ec1eed5e56f0bfbdbeaf50faee70

Download Submit
memory/1356-15-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/1356-16-0x0000000073AD0000-0x0000000074280000-memory.dmp

Filesize
7.7MB

Download
memory/1356-18-0x0000000073AD0000-0x0000000074280000-memory.dmp

Filesize
7.7MB

Download
memory/1904-7-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1904-8-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1904-9-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1904-11-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads