mystic | d3fe6a59c1a3513c32f9f4a9213f0238f83c5d051e306b17dfef2d840d314b6a

Resubmissions

19-12-2023 13:59

231219-ral3hscgb3 10

12-10-2023 04:43

231012-fb9peshf62 5

Analysis

max time kernel
137s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
19-12-2023 13:59

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

SecuriteInfo.com.Trojan.Inject4.62316.3026.27216.exe
Size

1.1MB
MD5

63e139e6777408781e81a119d8162f1f
SHA1

0d5906860a90d6f2bd74c83cdc3441fb6127c658
SHA256

d3fe6a59c1a3513c32f9f4a9213f0238f83c5d051e306b17dfef2d840d314b6a
SHA512

588710ba5b110c26f8ec47d5f7e08da727d62888809468d0d45208aff6988277a74f08cb0b26034e1ea01bcf3e0ac8cfc62f30225972c5d0a5a4c18aac19718d
SSDEEP

24576:HnMFp4xeIzuj3nEG8jaZ5AUPc0Bmew+nK:sFIzuj3nbZFc0wexnK

Score

10^/10

mystic stealer

Malware Config

Extracted

Family

mystic

http://5.42.92.211/

Signatures

Detect Mystic stealer payload 5 IoCs

resource	yara_rule
behavioral2/memory/2304-3-0x0000000000400000-0x0000000000433000-memory.dmp	mystic_family
behavioral2/memory/2304-4-0x0000000000400000-0x0000000000433000-memory.dmp	mystic_family
behavioral2/memory/2304-2-0x0000000000400000-0x0000000000433000-memory.dmp	mystic_family
behavioral2/memory/2304-1-0x0000000000400000-0x0000000000433000-memory.dmp	mystic_family
behavioral2/memory/2304-0-0x0000000000400000-0x0000000000433000-memory.dmp	mystic_family

Mystic
Mystic is an infostealer written in C++.
stealer mystic

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 400 set thread context of 2304	400	SecuriteInfo.com.Trojan.Inject4.62316.3026.27216.exe	93

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4480	400	WerFault.exe	16

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 400 wrote to memory of 2304	400	SecuriteInfo.com.Trojan.Inject4.62316.3026.27216.exe	93
PID 400 wrote to memory of 2304	400	SecuriteInfo.com.Trojan.Inject4.62316.3026.27216.exe	93
PID 400 wrote to memory of 2304	400	SecuriteInfo.com.Trojan.Inject4.62316.3026.27216.exe	93
PID 400 wrote to memory of 2304	400	SecuriteInfo.com.Trojan.Inject4.62316.3026.27216.exe	93
PID 400 wrote to memory of 2304	400	SecuriteInfo.com.Trojan.Inject4.62316.3026.27216.exe	93
PID 400 wrote to memory of 2304	400	SecuriteInfo.com.Trojan.Inject4.62316.3026.27216.exe	93
PID 400 wrote to memory of 2304	400	SecuriteInfo.com.Trojan.Inject4.62316.3026.27216.exe	93
PID 400 wrote to memory of 2304	400	SecuriteInfo.com.Trojan.Inject4.62316.3026.27216.exe	93
PID 400 wrote to memory of 2304	400	SecuriteInfo.com.Trojan.Inject4.62316.3026.27216.exe	93
PID 400 wrote to memory of 2304	400	SecuriteInfo.com.Trojan.Inject4.62316.3026.27216.exe	93

C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.Inject4.62316.3026.27216.exe
"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.Inject4.62316.3026.27216.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:400
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
  2⤵
  PID:2304
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 400 -s 236
  2⤵
  - Program crash
  PID:4480

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 400 -ip 400
1⤵
PID:1376

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2304-3-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2304-4-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2304-2-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2304-1-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2304-0-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download