mystic | d3fe6a59c1a3513c32f9f4a9213f0238f83c5d051e306b17dfef2d840d314b6a

Resubmissions

19-12-2023 13:59

12-10-2023 04:43

max time kernel
137s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
19-12-2023 13:59

Target

SecuriteInfo.com.Trojan.Inject4.62316.3026.27216.exe
Size

1.1MB
MD5

63e139e6777408781e81a119d8162f1f
SHA1

0d5906860a90d6f2bd74c83cdc3441fb6127c658
SHA256

d3fe6a59c1a3513c32f9f4a9213f0238f83c5d051e306b17dfef2d840d314b6a
SHA512

588710ba5b110c26f8ec47d5f7e08da727d62888809468d0d45208aff6988277a74f08cb0b26034e1ea01bcf3e0ac8cfc62f30225972c5d0a5a4c18aac19718d
SSDEEP

24576:HnMFp4xeIzuj3nEG8jaZ5AUPc0Bmew+nK:sFIzuj3nbZFc0wexnK

Score

10^/10

mystic stealer

Family

mystic

http://5.42.92.211/

Detect Mystic stealer payload 5 IoCs

Processes:

resource	yara_rule
behavioral2/memory/2304-3-0x0000000000400000-0x0000000000433000-memory.dmp	mystic_family
behavioral2/memory/2304-4-0x0000000000400000-0x0000000000433000-memory.dmp	mystic_family
behavioral2/memory/2304-2-0x0000000000400000-0x0000000000433000-memory.dmp	mystic_family
behavioral2/memory/2304-1-0x0000000000400000-0x0000000000433000-memory.dmp	mystic_family
behavioral2/memory/2304-0-0x0000000000400000-0x0000000000433000-memory.dmp	mystic_family

Mystic
Mystic is an infostealer written in C++.
stealer mystic
Suspicious use of SetThreadContext 1 IoCs

Processes:

SecuriteInfo.com.Trojan.Inject4.62316.3026.27216.exe

description pid process target process

PID 400 set thread context of 2304 400 SecuriteInfo.com.Trojan.Inject4.62316.3026.27216.exe AppLaunch.exe
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

4480 400 WerFault.exe SecuriteInfo.com.Trojan.Inject4.62316.3026.27216.exe

description	pid	process	target process
PID 400 set thread context of 2304	400	SecuriteInfo.com.Trojan.Inject4.62316.3026.27216.exe	AppLaunch.exe

pid	pid_target	process	target process
4480	400	WerFault.exe	SecuriteInfo.com.Trojan.Inject4.62316.3026.27216.exe

Suspicious use of WriteProcessMemory 10 IoCs

Processes:

SecuriteInfo.com.Trojan.Inject4.62316.3026.27216.exe

description	pid	process	target process
PID 400 wrote to memory of 2304	400	SecuriteInfo.com.Trojan.Inject4.62316.3026.27216.exe	AppLaunch.exe
PID 400 wrote to memory of 2304	400	SecuriteInfo.com.Trojan.Inject4.62316.3026.27216.exe	AppLaunch.exe
PID 400 wrote to memory of 2304	400	SecuriteInfo.com.Trojan.Inject4.62316.3026.27216.exe	AppLaunch.exe
PID 400 wrote to memory of 2304	400	SecuriteInfo.com.Trojan.Inject4.62316.3026.27216.exe	AppLaunch.exe
PID 400 wrote to memory of 2304	400	SecuriteInfo.com.Trojan.Inject4.62316.3026.27216.exe	AppLaunch.exe
PID 400 wrote to memory of 2304	400	SecuriteInfo.com.Trojan.Inject4.62316.3026.27216.exe	AppLaunch.exe
PID 400 wrote to memory of 2304	400	SecuriteInfo.com.Trojan.Inject4.62316.3026.27216.exe	AppLaunch.exe
PID 400 wrote to memory of 2304	400	SecuriteInfo.com.Trojan.Inject4.62316.3026.27216.exe	AppLaunch.exe
PID 400 wrote to memory of 2304	400	SecuriteInfo.com.Trojan.Inject4.62316.3026.27216.exe	AppLaunch.exe
PID 400 wrote to memory of 2304	400	SecuriteInfo.com.Trojan.Inject4.62316.3026.27216.exe	AppLaunch.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
2⤵
PID:2304

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 400 -s 236
2⤵
- Program crash
PID:4480

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 400 -ip 400
1⤵
PID:1376

memory/2304-3-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2304-4-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2304-2-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2304-1-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2304-0-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download