mystic | d3fe6a59c1a3513c32f9f4a9213f0238f83c5d051e306b17dfef2d840d314b6a

Resubmissions

19-12-2023 13:59

231219-ral3hscgb3 10

12-10-2023 04:43

231012-fb9peshf62 5

Analysis

max time kernel
122s
max time network
125s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
19-12-2023 13:59

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

SecuriteInfo.com.Trojan.Inject4.62316.3026.27216.exe
Size

1.1MB
MD5

63e139e6777408781e81a119d8162f1f
SHA1

0d5906860a90d6f2bd74c83cdc3441fb6127c658
SHA256

d3fe6a59c1a3513c32f9f4a9213f0238f83c5d051e306b17dfef2d840d314b6a
SHA512

588710ba5b110c26f8ec47d5f7e08da727d62888809468d0d45208aff6988277a74f08cb0b26034e1ea01bcf3e0ac8cfc62f30225972c5d0a5a4c18aac19718d
SSDEEP

24576:HnMFp4xeIzuj3nEG8jaZ5AUPc0Bmew+nK:sFIzuj3nbZFc0wexnK

Score

10^/10

mystic stealer

Malware Config

Extracted

Family

mystic

http://5.42.92.211/

Signatures

Detect Mystic stealer payload 6 IoCs

resource	yara_rule
behavioral1/memory/2896-3-0x0000000000400000-0x0000000000433000-memory.dmp	mystic_family
behavioral1/memory/2896-5-0x0000000000400000-0x0000000000433000-memory.dmp	mystic_family
behavioral1/memory/2896-4-0x0000000000400000-0x0000000000433000-memory.dmp	mystic_family
behavioral1/memory/2896-7-0x0000000000400000-0x0000000000433000-memory.dmp	mystic_family
behavioral1/memory/2896-9-0x0000000000400000-0x0000000000433000-memory.dmp	mystic_family
behavioral1/memory/2896-11-0x0000000000400000-0x0000000000433000-memory.dmp	mystic_family

Mystic
Mystic is an infostealer written in C++.
stealer mystic

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2596 set thread context of 2896	2596	SecuriteInfo.com.Trojan.Inject4.62316.3026.27216.exe	29

Program crash 2 IoCs

pid	pid_target	Process	procid_target
2644	2596	WerFault.exe	27
2732	2896	WerFault.exe	29

Suspicious use of WriteProcessMemory 25 IoCs

description	pid	Process	procid_target
PID 2596 wrote to memory of 2896	2596	SecuriteInfo.com.Trojan.Inject4.62316.3026.27216.exe	29
PID 2596 wrote to memory of 2896	2596	SecuriteInfo.com.Trojan.Inject4.62316.3026.27216.exe	29
PID 2596 wrote to memory of 2896	2596	SecuriteInfo.com.Trojan.Inject4.62316.3026.27216.exe	29
PID 2596 wrote to memory of 2896	2596	SecuriteInfo.com.Trojan.Inject4.62316.3026.27216.exe	29
PID 2596 wrote to memory of 2896	2596	SecuriteInfo.com.Trojan.Inject4.62316.3026.27216.exe	29
PID 2596 wrote to memory of 2896	2596	SecuriteInfo.com.Trojan.Inject4.62316.3026.27216.exe	29
PID 2596 wrote to memory of 2896	2596	SecuriteInfo.com.Trojan.Inject4.62316.3026.27216.exe	29
PID 2596 wrote to memory of 2896	2596	SecuriteInfo.com.Trojan.Inject4.62316.3026.27216.exe	29
PID 2596 wrote to memory of 2896	2596	SecuriteInfo.com.Trojan.Inject4.62316.3026.27216.exe	29
PID 2596 wrote to memory of 2896	2596	SecuriteInfo.com.Trojan.Inject4.62316.3026.27216.exe	29
PID 2596 wrote to memory of 2896	2596	SecuriteInfo.com.Trojan.Inject4.62316.3026.27216.exe	29
PID 2596 wrote to memory of 2896	2596	SecuriteInfo.com.Trojan.Inject4.62316.3026.27216.exe	29
PID 2596 wrote to memory of 2896	2596	SecuriteInfo.com.Trojan.Inject4.62316.3026.27216.exe	29
PID 2596 wrote to memory of 2896	2596	SecuriteInfo.com.Trojan.Inject4.62316.3026.27216.exe	29
PID 2596 wrote to memory of 2644	2596	SecuriteInfo.com.Trojan.Inject4.62316.3026.27216.exe	30
PID 2596 wrote to memory of 2644	2596	SecuriteInfo.com.Trojan.Inject4.62316.3026.27216.exe	30
PID 2596 wrote to memory of 2644	2596	SecuriteInfo.com.Trojan.Inject4.62316.3026.27216.exe	30
PID 2596 wrote to memory of 2644	2596	SecuriteInfo.com.Trojan.Inject4.62316.3026.27216.exe	30
PID 2896 wrote to memory of 2732	2896	AppLaunch.exe	31
PID 2896 wrote to memory of 2732	2896	AppLaunch.exe	31
PID 2896 wrote to memory of 2732	2896	AppLaunch.exe	31
PID 2896 wrote to memory of 2732	2896	AppLaunch.exe	31
PID 2896 wrote to memory of 2732	2896	AppLaunch.exe	31
PID 2896 wrote to memory of 2732	2896	AppLaunch.exe	31
PID 2896 wrote to memory of 2732	2896	AppLaunch.exe	31

C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.Inject4.62316.3026.27216.exe
"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.Inject4.62316.3026.27216.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2596
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2896
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2896 -s 196
    3⤵
    - Program crash
    PID:2732
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2596 -s 52
  2⤵
  - Program crash
  PID:2644

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2896-3-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2896-5-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2896-4-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2896-2-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2896-1-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2896-0-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2896-7-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2896-6-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmp

Filesize
4KB

Download
memory/2896-9-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2896-11-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download