mystic | 914615fc2a86a1a3aa8a108084dd30cc54e8b935b2f14f7def84c51a049c95c2

Analysis

max time kernel
148s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
23-05-2024 10:05

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

8744deeac7c3aff839db1009ce9ff2e37892105dcc730c203816f9be8df214a9.exe
Size

721KB
MD5

9a26c20f51835cb007fdff0db4ce43cb
SHA1

d367a8eb9da2192c49270744ddea30989279ca92
SHA256

8744deeac7c3aff839db1009ce9ff2e37892105dcc730c203816f9be8df214a9
SHA512

1fb9ffb86556d6c4f1b32379322920583ceaa41829103982aa5f07f8b52782d7e7425f9433084825588727cda7a483c88cf8acda53a8ce8ee624a7ab3261d04d
SSDEEP

12288:CMr4y905oyLLefbcmB20yALGAUMUjeueJ9Sd6ufO2/HXdKsbiNBlFK9rB:6yXW0AnHAbhFDujNKsbiNJK9t

Score

10^/10

mystic smokeloader backdoor evasion persistence stealer trojan

Malware Config

Signatures

Detect Mystic stealer payload 1 IoCs

resource	yara_rule
behavioral7/files/0x0007000000023411-17.dat	mystic_family

Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs

evasion trojan

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	1Wr56jI5.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	1Wr56jI5.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	1Wr56jI5.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	1Wr56jI5.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	1Wr56jI5.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	1Wr56jI5.exe

Mystic
Mystic is an infostealer written in C++.
stealer mystic
SmokeLoader
Modular backdoor trojan in use since 2014.
trojan backdoor smokeloader

Executes dropped EXE 4 IoCs

pid	Process
2696	fW2SR70.exe
4248	1Wr56jI5.exe
5056	2nN2635.exe
3716	3EK78uC.exe

Windows security modification 2 TTPs 2 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features	1Wr56jI5.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0"	1Wr56jI5.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	8744deeac7c3aff839db1009ce9ff2e37892105dcc730c203816f9be8df214a9.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	fW2SR70.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3716 set thread context of 4156	3716	3EK78uC.exe	99

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	AppLaunch.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	AppLaunch.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	AppLaunch.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
4248	1Wr56jI5.exe
4248	1Wr56jI5.exe
4248	1Wr56jI5.exe
4248	1Wr56jI5.exe

Suspicious use of WriteProcessMemory 19 IoCs

description	pid	Process	procid_target
PID 2040 wrote to memory of 2696	2040	8744deeac7c3aff839db1009ce9ff2e37892105dcc730c203816f9be8df214a9.exe	83
PID 2040 wrote to memory of 2696	2040	8744deeac7c3aff839db1009ce9ff2e37892105dcc730c203816f9be8df214a9.exe	83
PID 2040 wrote to memory of 2696	2040	8744deeac7c3aff839db1009ce9ff2e37892105dcc730c203816f9be8df214a9.exe	83
PID 2696 wrote to memory of 4248	2696	fW2SR70.exe	84
PID 2696 wrote to memory of 4248	2696	fW2SR70.exe	84
PID 3624 wrote to memory of 536	3624	cmd.exe	90
PID 3624 wrote to memory of 536	3624	cmd.exe	90
PID 2696 wrote to memory of 5056	2696	fW2SR70.exe	96
PID 2696 wrote to memory of 5056	2696	fW2SR70.exe	96
PID 2696 wrote to memory of 5056	2696	fW2SR70.exe	96
PID 2040 wrote to memory of 3716	2040	8744deeac7c3aff839db1009ce9ff2e37892105dcc730c203816f9be8df214a9.exe	97
PID 2040 wrote to memory of 3716	2040	8744deeac7c3aff839db1009ce9ff2e37892105dcc730c203816f9be8df214a9.exe	97
PID 2040 wrote to memory of 3716	2040	8744deeac7c3aff839db1009ce9ff2e37892105dcc730c203816f9be8df214a9.exe	97
PID 3716 wrote to memory of 4156	3716	3EK78uC.exe	99
PID 3716 wrote to memory of 4156	3716	3EK78uC.exe	99
PID 3716 wrote to memory of 4156	3716	3EK78uC.exe	99
PID 3716 wrote to memory of 4156	3716	3EK78uC.exe	99
PID 3716 wrote to memory of 4156	3716	3EK78uC.exe	99
PID 3716 wrote to memory of 4156	3716	3EK78uC.exe	99

C:\Users\Admin\AppData\Local\Temp\8744deeac7c3aff839db1009ce9ff2e37892105dcc730c203816f9be8df214a9.exe
"C:\Users\Admin\AppData\Local\Temp\8744deeac7c3aff839db1009ce9ff2e37892105dcc730c203816f9be8df214a9.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2040
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\fW2SR70.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\fW2SR70.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:2696
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\1Wr56jI5.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\1Wr56jI5.exe
    3⤵
    - Modifies Windows Defender Real-time Protection settings
    - Executes dropped EXE
    - Windows security modification
    - Suspicious behavior: EnumeratesProcesses
    PID:4248
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\2nN2635.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\2nN2635.exe
    3⤵
    - Executes dropped EXE
    PID:5056
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\3EK78uC.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\3EK78uC.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - Suspicious use of WriteProcessMemory
  PID:3716
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
    3⤵
    - Checks SCSI registry key(s)
    PID:4156

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c regini "C:\Users\Admin\AppData\Roaming\random_1716458807.txt"
1⤵
- Suspicious use of WriteProcessMemory
PID:3624
- C:\Windows\system32\regini.exe
  regini "C:\Users\Admin\AppData\Roaming\random_1716458807.txt"
  2⤵
  PID:536

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\3EK78uC.exe

Filesize
916KB

MD5
788be6a311582a44182f6d9d172f0f9a

SHA1
5932e09819401428474670ea3a21216f5702897e

SHA256
3f06bfdfeafbdc36fc543165c92fd3ee1ca020b21f4c0135f66664ac47e5f79c

SHA512
d1e2263cf857b76819adb51a9caf31555b276ab465815d890effb87159a10a8ca39836c1a5f6b3b94da270811b0db1c1342a8ed7d73d87e6451a48dbd19e4edc

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\fW2SR70.exe

Filesize
354KB

MD5
a6f785f708371065b133cfa60015d409

SHA1
b26c8bc485a0921683b5f95fbed394950b934492

SHA256
6179e00197ae153783bd271bfedab22af3ae2d77c04a7eeeeedb8f36eac43543

SHA512
105dfc4c130a9e0ff7b7dd59d776ad07cae49ed84f8e166eb0c2a74b0d249393bb2a0e23c305bd480a8b1f6f9ea9c3c11f17776c8c04d8ede6e3db70c4a3a33d

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\1Wr56jI5.exe

Filesize
265KB

MD5
15fe972bcfd9189d826083838645b850

SHA1
d2bf7fee68e358fa71b942b8ae92e483536abf86

SHA256
ec739f26f487bcc65718bb8c28a5e3adf817a18e01952bd888f618a57c1e61d4

SHA512
30f7c8daa78ba9bb32d5dca56440fd9b1d36336f496521920ab41737787c1c8e0bcdd714b72249e0ab52908d7918afcaf9e0b3f5ba2a8a2888e9adb538810cfe

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\2nN2635.exe

Filesize
180KB

MD5
53e28e07671d832a65fbfe3aa38b6678

SHA1
6f9ea0ed8109030511c2c09c848f66bd0d16d1e1

SHA256
5c59db3277aefb761d4b814aaf5f5acd1fd1a0ea154dc565c78b082a3df4566e

SHA512
053f8048230583e741c34f6714c9684ed1312c064cd0c81d99f09e20192b7ddecb53c9c55e4aceac774315315be7e13de98f2cea4e5487f2d9e9dfa2ce3979c9

Download Submit
C:\Users\Admin\AppData\Roaming\random_1716458807.txt

Filesize
78B

MD5
2d245696c73134b0a9a2ac296ea7c170

SHA1
f234419d7a09920a46ad291b98d7dca5a11f0da8

SHA256
ed83e1f6850e48029654e9829cbf6e2cdff82f55f61d1449f822e448f75e8930

SHA512
af0b981ef20aa94aff080fbd2030556fe47c4cc563885b162e604f72bc70c4a0eee4ee57ce4ea8964e6363a32ba34f8bee933db30d3d61392c42299621a4fc79

Download Submit
memory/4156-22-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download