mystic | 92023f346ccc819d9c52da2af751cda1bc5396b5d745c68d99d1d2ff99db093a

Analysis

max time kernel
132s
max time network
124s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
23/05/2024, 10:08

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

44dedbcb8ac06abbb0645f455edb582c6bc3a229eb0f288d6e63c6181d50d65f.exe
Size

642KB
MD5

6d1a0affbbb9d7130d459291ba4d1f53
SHA1

89aad26f45b8dc2366ff70f087b00bb91dd11726
SHA256

44dedbcb8ac06abbb0645f455edb582c6bc3a229eb0f288d6e63c6181d50d65f
SHA512

502a5dcc0ecfe9498e96529da91c646df3f0820e99f99f736f0360f45021ffd81a8417a328ed6be1f3252a49ed06e5facf9c363420e3e3e8e03a33066f6c95a3
SSDEEP

12288:uMrLy90MFXwbExD25uQaHJnRuUP3KJeIVbIgB0dL:JyzXwcD25ulnRTPKJeWIga

Score

10^/10

mystic smokeloader backdoor evasion persistence stealer trojan

Malware Config

Signatures

Detect Mystic stealer payload 3 IoCs

resource	yara_rule
behavioral13/memory/760-18-0x0000000000400000-0x0000000000434000-memory.dmp	mystic_family
behavioral13/memory/760-21-0x0000000000400000-0x0000000000434000-memory.dmp	mystic_family
behavioral13/memory/760-19-0x0000000000400000-0x0000000000434000-memory.dmp	mystic_family

Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs

evasion trojan

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	AppLaunch.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	AppLaunch.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection	AppLaunch.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	AppLaunch.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	AppLaunch.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	AppLaunch.exe

Mystic
Mystic is an infostealer written in C++.
stealer mystic
SmokeLoader
Modular backdoor trojan in use since 2014.
trojan backdoor smokeloader

Executes dropped EXE 4 IoCs

pid	Process
2532	qR0ye36.exe
3284	1Ln69ad0.exe
1088	2CC7975.exe
4396	3Hx23EO.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	44dedbcb8ac06abbb0645f455edb582c6bc3a229eb0f288d6e63c6181d50d65f.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	qR0ye36.exe

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 3284 set thread context of 2300	3284	1Ln69ad0.exe	85
PID 1088 set thread context of 760	1088	2CC7975.exe	90

Launches sc.exe 1 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
4648	sc.exe

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	3Hx23EO.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	3Hx23EO.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	3Hx23EO.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2300	AppLaunch.exe
2300	AppLaunch.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2300	AppLaunch.exe

Suspicious use of WriteProcessMemory 30 IoCs

description	pid	Process	procid_target
PID 2592 wrote to memory of 2532	2592	44dedbcb8ac06abbb0645f455edb582c6bc3a229eb0f288d6e63c6181d50d65f.exe	83
PID 2592 wrote to memory of 2532	2592	44dedbcb8ac06abbb0645f455edb582c6bc3a229eb0f288d6e63c6181d50d65f.exe	83
PID 2592 wrote to memory of 2532	2592	44dedbcb8ac06abbb0645f455edb582c6bc3a229eb0f288d6e63c6181d50d65f.exe	83
PID 2532 wrote to memory of 3284	2532	qR0ye36.exe	84
PID 2532 wrote to memory of 3284	2532	qR0ye36.exe	84
PID 2532 wrote to memory of 3284	2532	qR0ye36.exe	84
PID 3284 wrote to memory of 2300	3284	1Ln69ad0.exe	85
PID 3284 wrote to memory of 2300	3284	1Ln69ad0.exe	85
PID 3284 wrote to memory of 2300	3284	1Ln69ad0.exe	85
PID 3284 wrote to memory of 2300	3284	1Ln69ad0.exe	85
PID 3284 wrote to memory of 2300	3284	1Ln69ad0.exe	85
PID 3284 wrote to memory of 2300	3284	1Ln69ad0.exe	85
PID 3284 wrote to memory of 2300	3284	1Ln69ad0.exe	85
PID 3284 wrote to memory of 2300	3284	1Ln69ad0.exe	85
PID 2532 wrote to memory of 1088	2532	qR0ye36.exe	87
PID 2532 wrote to memory of 1088	2532	qR0ye36.exe	87
PID 2532 wrote to memory of 1088	2532	qR0ye36.exe	87
PID 1088 wrote to memory of 760	1088	2CC7975.exe	90
PID 1088 wrote to memory of 760	1088	2CC7975.exe	90
PID 1088 wrote to memory of 760	1088	2CC7975.exe	90
PID 1088 wrote to memory of 760	1088	2CC7975.exe	90
PID 1088 wrote to memory of 760	1088	2CC7975.exe	90
PID 1088 wrote to memory of 760	1088	2CC7975.exe	90
PID 1088 wrote to memory of 760	1088	2CC7975.exe	90
PID 1088 wrote to memory of 760	1088	2CC7975.exe	90
PID 1088 wrote to memory of 760	1088	2CC7975.exe	90
PID 1088 wrote to memory of 760	1088	2CC7975.exe	90
PID 2592 wrote to memory of 4396	2592	44dedbcb8ac06abbb0645f455edb582c6bc3a229eb0f288d6e63c6181d50d65f.exe	91
PID 2592 wrote to memory of 4396	2592	44dedbcb8ac06abbb0645f455edb582c6bc3a229eb0f288d6e63c6181d50d65f.exe	91
PID 2592 wrote to memory of 4396	2592	44dedbcb8ac06abbb0645f455edb582c6bc3a229eb0f288d6e63c6181d50d65f.exe	91

C:\Users\Admin\AppData\Local\Temp\44dedbcb8ac06abbb0645f455edb582c6bc3a229eb0f288d6e63c6181d50d65f.exe
"C:\Users\Admin\AppData\Local\Temp\44dedbcb8ac06abbb0645f455edb582c6bc3a229eb0f288d6e63c6181d50d65f.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2592
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\qR0ye36.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\qR0ye36.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:2532
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\1Ln69ad0.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\1Ln69ad0.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - Suspicious use of WriteProcessMemory
    PID:3284
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
      4⤵
      Modifies Windows Defender Real-time Protection settings
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2300
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\2CC7975.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\2CC7975.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - Suspicious use of WriteProcessMemory
    PID:1088
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
      4⤵
      PID:760
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\3Hx23EO.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\3Hx23EO.exe
  2⤵
  - Executes dropped EXE
  - Checks SCSI registry key(s)
  PID:4396

C:\Windows\system32\sc.exe
C:\Windows\system32\sc.exe start wuauserv
1⤵
- Launches sc.exe
PID:4648

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\3Hx23EO.exe

Filesize
30KB

MD5
2b417ffa65351342c11370cf7373a14c

SHA1
8bc10a2624a456498e6deceb2fe070c830d19dac

SHA256
bee9739ee16f84321b5a7f8fbba4c8ff758660fdce5d4e8a1ffbb0c34c051475

SHA512
adbbad06a90eb742e0b46f780982e749914f4f96e9face900a18af2f87028c59cfb0549ed2d1f0a2701d7b63e417943ea5a403dc1f2883cb301c14f16ca1b4dc

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\qR0ye36.exe

Filesize
518KB

MD5
1f65850100bf6a3a85988fe3dadd5c0a

SHA1
3c1073babe065e11273ee02c796091a911eb084c

SHA256
f29015917e91ca8387ed55df0654f84c352cc6c8db8798393cccc3f36c26e251

SHA512
bc93abda4c2a5cae8de18e3e32f7c18df5601b64723c1cca087b37f48965313879ec21d48b9fb27237b68e510c7746b44468491e7d227f1c3114291613d2b453

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\1Ln69ad0.exe

Filesize
874KB

MD5
9eee364499677bcd3f52ac655db1097b

SHA1
d65d31912b259e60c71af9358b743f3e137c8936

SHA256
1ba694e249e4faca92ccce8670b5d6e2a5e6ac0d1f523220a91f75aab3d78155

SHA512
1364dece0df02e181c2feb9a3b9e559662945991d3919ae0c1db2fcc091de3ceb349dcf4e4921b904e265263e6a2cca9c83a6a914ca9544850f8d2bb2fe41678

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\2CC7975.exe

Filesize
1.1MB

MD5
7e88670e893f284a13a2d88af7295317

SHA1
4bc0d76245e9d6ca8fe69daa23c46b2b8f770f1a

SHA256
d5e9e8612572f4586bc94b4475503558b7c4cd9329d3ade5b86f45018957deb9

SHA512
01541840ee2aa44de1f5f41bee31409560c481c10ed07d854239c0c9bdb648c86857a6a83a907e23f3b2865043b175689aa5f4f13fd0fd5f5444756b9ddfcdc2

Download Submit
memory/760-18-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/760-21-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/760-19-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2300-14-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/4396-24-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/4396-26-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download