mystic | d3fe6a59c1a3513c32f9f4a9213f0238f83c5d051e306b17dfef2d840d314b6a

Resubmissions

19-12-2023 13:59

231219-ral3hscgb3 10

12-10-2023 04:43

231012-fb9peshf62 5

Analysis

max time kernel
122s
max time network
125s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
19-12-2023 13:59

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

SecuriteInfo.com.Trojan.Inject4.62316.3026.27216.exe
Size

1.1MB
MD5

63e139e6777408781e81a119d8162f1f
SHA1

0d5906860a90d6f2bd74c83cdc3441fb6127c658
SHA256

d3fe6a59c1a3513c32f9f4a9213f0238f83c5d051e306b17dfef2d840d314b6a
SHA512

588710ba5b110c26f8ec47d5f7e08da727d62888809468d0d45208aff6988277a74f08cb0b26034e1ea01bcf3e0ac8cfc62f30225972c5d0a5a4c18aac19718d
SSDEEP

24576:HnMFp4xeIzuj3nEG8jaZ5AUPc0Bmew+nK:sFIzuj3nbZFc0wexnK

Score

10^/10

mystic stealer

Malware Config

Extracted

Family

mystic

http://5.42.92.211/

Signatures

Detect Mystic stealer payload 6 IoCs

Processes:

resource	yara_rule
behavioral1/memory/2896-3-0x0000000000400000-0x0000000000433000-memory.dmp	mystic_family
behavioral1/memory/2896-5-0x0000000000400000-0x0000000000433000-memory.dmp	mystic_family
behavioral1/memory/2896-4-0x0000000000400000-0x0000000000433000-memory.dmp	mystic_family
behavioral1/memory/2896-7-0x0000000000400000-0x0000000000433000-memory.dmp	mystic_family
behavioral1/memory/2896-9-0x0000000000400000-0x0000000000433000-memory.dmp	mystic_family
behavioral1/memory/2896-11-0x0000000000400000-0x0000000000433000-memory.dmp	mystic_family

Mystic
Mystic is an infostealer written in C++.
stealer mystic
Suspicious use of SetThreadContext 1 IoCs

Processes:

SecuriteInfo.com.Trojan.Inject4.62316.3026.27216.exe

description pid process target process

PID 2596 set thread context of 2896 2596 SecuriteInfo.com.Trojan.Inject4.62316.3026.27216.exe AppLaunch.exe
Program crash 2 IoCs

Processes:

WerFault.exeWerFault.exe

pid pid_target process target process

2644 2596 WerFault.exe SecuriteInfo.com.Trojan.Inject4.62316.3026.27216.exe
2732 2896 WerFault.exe AppLaunch.exe

description	pid	process	target process
PID 2596 set thread context of 2896	2596	SecuriteInfo.com.Trojan.Inject4.62316.3026.27216.exe	AppLaunch.exe

pid	pid_target	process	target process
2644	2596	WerFault.exe	SecuriteInfo.com.Trojan.Inject4.62316.3026.27216.exe
2732	2896	WerFault.exe	AppLaunch.exe

Suspicious use of WriteProcessMemory 25 IoCs

Processes:

SecuriteInfo.com.Trojan.Inject4.62316.3026.27216.exeAppLaunch.exe

description	pid	process	target process
PID 2596 wrote to memory of 2896	2596	SecuriteInfo.com.Trojan.Inject4.62316.3026.27216.exe	AppLaunch.exe
PID 2596 wrote to memory of 2896	2596	SecuriteInfo.com.Trojan.Inject4.62316.3026.27216.exe	AppLaunch.exe
PID 2596 wrote to memory of 2896	2596	SecuriteInfo.com.Trojan.Inject4.62316.3026.27216.exe	AppLaunch.exe
PID 2596 wrote to memory of 2896	2596	SecuriteInfo.com.Trojan.Inject4.62316.3026.27216.exe	AppLaunch.exe
PID 2596 wrote to memory of 2896	2596	SecuriteInfo.com.Trojan.Inject4.62316.3026.27216.exe	AppLaunch.exe
PID 2596 wrote to memory of 2896	2596	SecuriteInfo.com.Trojan.Inject4.62316.3026.27216.exe	AppLaunch.exe
PID 2596 wrote to memory of 2896	2596	SecuriteInfo.com.Trojan.Inject4.62316.3026.27216.exe	AppLaunch.exe
PID 2596 wrote to memory of 2896	2596	SecuriteInfo.com.Trojan.Inject4.62316.3026.27216.exe	AppLaunch.exe
PID 2596 wrote to memory of 2896	2596	SecuriteInfo.com.Trojan.Inject4.62316.3026.27216.exe	AppLaunch.exe
PID 2596 wrote to memory of 2896	2596	SecuriteInfo.com.Trojan.Inject4.62316.3026.27216.exe	AppLaunch.exe
PID 2596 wrote to memory of 2896	2596	SecuriteInfo.com.Trojan.Inject4.62316.3026.27216.exe	AppLaunch.exe
PID 2596 wrote to memory of 2896	2596	SecuriteInfo.com.Trojan.Inject4.62316.3026.27216.exe	AppLaunch.exe
PID 2596 wrote to memory of 2896	2596	SecuriteInfo.com.Trojan.Inject4.62316.3026.27216.exe	AppLaunch.exe
PID 2596 wrote to memory of 2896	2596	SecuriteInfo.com.Trojan.Inject4.62316.3026.27216.exe	AppLaunch.exe
PID 2596 wrote to memory of 2644	2596	SecuriteInfo.com.Trojan.Inject4.62316.3026.27216.exe	WerFault.exe
PID 2596 wrote to memory of 2644	2596	SecuriteInfo.com.Trojan.Inject4.62316.3026.27216.exe	WerFault.exe
PID 2596 wrote to memory of 2644	2596	SecuriteInfo.com.Trojan.Inject4.62316.3026.27216.exe	WerFault.exe
PID 2596 wrote to memory of 2644	2596	SecuriteInfo.com.Trojan.Inject4.62316.3026.27216.exe	WerFault.exe
PID 2896 wrote to memory of 2732	2896	AppLaunch.exe	WerFault.exe
PID 2896 wrote to memory of 2732	2896	AppLaunch.exe	WerFault.exe
PID 2896 wrote to memory of 2732	2896	AppLaunch.exe	WerFault.exe
PID 2896 wrote to memory of 2732	2896	AppLaunch.exe	WerFault.exe
PID 2896 wrote to memory of 2732	2896	AppLaunch.exe	WerFault.exe
PID 2896 wrote to memory of 2732	2896	AppLaunch.exe	WerFault.exe
PID 2896 wrote to memory of 2732	2896	AppLaunch.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.Inject4.62316.3026.27216.exe
"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.Inject4.62316.3026.27216.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2596

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
2⤵
- Suspicious use of WriteProcessMemory
PID:2896

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2896 -s 196
3⤵
- Program crash
PID:2732

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2596 -s 52
2⤵
- Program crash
PID:2644

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2896-3-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2896-5-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2896-4-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2896-2-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2896-1-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2896-0-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2896-7-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2896-6-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmp

Filesize
4KB

Download
memory/2896-9-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2896-11-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download