mystic | 92023f346ccc819d9c52da2af751cda1bc5396b5d745c68d99d1d2ff99db093a

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
23/05/2024, 10:08

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

30a7bebd46e90f9faf44a72b002a8447cd4d7a0f4982658f32e50b6ad9e400c4.exe
Size

656KB
MD5

656f3e6f6efd1cdb63ddca773f272823
SHA1

3fd19d3a0b9340272115d779416555a87502a5ab
SHA256

30a7bebd46e90f9faf44a72b002a8447cd4d7a0f4982658f32e50b6ad9e400c4
SHA512

651f1d36ebce930680784331b23882cf598cb420404a62a02314b6c08e66c6298b9689e544bb80fd3202c8f13c465c26f5229a4eda9f4b64c68287abe05ee596
SSDEEP

12288:cMr/y90/e09RBbmnTKwwIv4A5NUGg1c8Pn9//4dkL3q/sVs2Y:7y4e4RaKKNUjRP9FD8sVs

Score

10^/10

mystic smokeloader backdoor evasion persistence stealer trojan

Malware Config

Signatures

Detect Mystic stealer payload 3 IoCs

resource	yara_rule
behavioral7/memory/3672-19-0x0000000000400000-0x0000000000433000-memory.dmp	mystic_family
behavioral7/memory/3672-22-0x0000000000400000-0x0000000000433000-memory.dmp	mystic_family
behavioral7/memory/3672-20-0x0000000000400000-0x0000000000433000-memory.dmp	mystic_family

Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs

evasion trojan

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection	AppLaunch.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	AppLaunch.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	AppLaunch.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	AppLaunch.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	AppLaunch.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	AppLaunch.exe

Mystic
Mystic is an infostealer written in C++.
stealer mystic
SmokeLoader
Modular backdoor trojan in use since 2014.
trojan backdoor smokeloader

Executes dropped EXE 4 IoCs

pid	Process
4224	Ph9ks96.exe
2548	1Bp37pu8.exe
3880	2Nz7405.exe
1884	3dl41ab.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	30a7bebd46e90f9faf44a72b002a8447cd4d7a0f4982658f32e50b6ad9e400c4.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	Ph9ks96.exe

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 2548 set thread context of 4564	2548	1Bp37pu8.exe	87
PID 3880 set thread context of 3672	3880	2Nz7405.exe	97

Program crash 2 IoCs

pid	pid_target	Process	procid_target
5112	2548	WerFault.exe	84
1748	3880	WerFault.exe	93

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	3dl41ab.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	3dl41ab.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	3dl41ab.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4564	AppLaunch.exe
4564	AppLaunch.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4564	AppLaunch.exe

Suspicious use of WriteProcessMemory 33 IoCs

description	pid	Process	procid_target
PID 1060 wrote to memory of 4224	1060	30a7bebd46e90f9faf44a72b002a8447cd4d7a0f4982658f32e50b6ad9e400c4.exe	83
PID 1060 wrote to memory of 4224	1060	30a7bebd46e90f9faf44a72b002a8447cd4d7a0f4982658f32e50b6ad9e400c4.exe	83
PID 1060 wrote to memory of 4224	1060	30a7bebd46e90f9faf44a72b002a8447cd4d7a0f4982658f32e50b6ad9e400c4.exe	83
PID 4224 wrote to memory of 2548	4224	Ph9ks96.exe	84
PID 4224 wrote to memory of 2548	4224	Ph9ks96.exe	84
PID 4224 wrote to memory of 2548	4224	Ph9ks96.exe	84
PID 2548 wrote to memory of 4564	2548	1Bp37pu8.exe	87
PID 2548 wrote to memory of 4564	2548	1Bp37pu8.exe	87
PID 2548 wrote to memory of 4564	2548	1Bp37pu8.exe	87
PID 2548 wrote to memory of 4564	2548	1Bp37pu8.exe	87
PID 2548 wrote to memory of 4564	2548	1Bp37pu8.exe	87
PID 2548 wrote to memory of 4564	2548	1Bp37pu8.exe	87
PID 2548 wrote to memory of 4564	2548	1Bp37pu8.exe	87
PID 2548 wrote to memory of 4564	2548	1Bp37pu8.exe	87
PID 4224 wrote to memory of 3880	4224	Ph9ks96.exe	93
PID 4224 wrote to memory of 3880	4224	Ph9ks96.exe	93
PID 4224 wrote to memory of 3880	4224	Ph9ks96.exe	93
PID 3880 wrote to memory of 2972	3880	2Nz7405.exe	96
PID 3880 wrote to memory of 2972	3880	2Nz7405.exe	96
PID 3880 wrote to memory of 2972	3880	2Nz7405.exe	96
PID 3880 wrote to memory of 3672	3880	2Nz7405.exe	97
PID 3880 wrote to memory of 3672	3880	2Nz7405.exe	97
PID 3880 wrote to memory of 3672	3880	2Nz7405.exe	97
PID 3880 wrote to memory of 3672	3880	2Nz7405.exe	97
PID 3880 wrote to memory of 3672	3880	2Nz7405.exe	97
PID 3880 wrote to memory of 3672	3880	2Nz7405.exe	97
PID 3880 wrote to memory of 3672	3880	2Nz7405.exe	97
PID 3880 wrote to memory of 3672	3880	2Nz7405.exe	97
PID 3880 wrote to memory of 3672	3880	2Nz7405.exe	97
PID 3880 wrote to memory of 3672	3880	2Nz7405.exe	97
PID 1060 wrote to memory of 1884	1060	30a7bebd46e90f9faf44a72b002a8447cd4d7a0f4982658f32e50b6ad9e400c4.exe	100
PID 1060 wrote to memory of 1884	1060	30a7bebd46e90f9faf44a72b002a8447cd4d7a0f4982658f32e50b6ad9e400c4.exe	100
PID 1060 wrote to memory of 1884	1060	30a7bebd46e90f9faf44a72b002a8447cd4d7a0f4982658f32e50b6ad9e400c4.exe	100

C:\Users\Admin\AppData\Local\Temp\30a7bebd46e90f9faf44a72b002a8447cd4d7a0f4982658f32e50b6ad9e400c4.exe
"C:\Users\Admin\AppData\Local\Temp\30a7bebd46e90f9faf44a72b002a8447cd4d7a0f4982658f32e50b6ad9e400c4.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1060
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Ph9ks96.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Ph9ks96.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:4224
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\1Bp37pu8.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\1Bp37pu8.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - Suspicious use of WriteProcessMemory
    PID:2548
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
      4⤵
      Modifies Windows Defender Real-time Protection settings
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4564
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2548 -s 600
      4⤵
      Program crash
      PID:5112
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\2Nz7405.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\2Nz7405.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - Suspicious use of WriteProcessMemory
    PID:3880
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
      4⤵
      PID:2972
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
      4⤵
      PID:3672
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3880 -s 620
      4⤵
      Program crash
      PID:1748
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\3dl41ab.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\3dl41ab.exe
  2⤵
  - Executes dropped EXE
  - Checks SCSI registry key(s)
  PID:1884

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2548 -ip 2548
1⤵
PID:3452

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 3880 -ip 3880
1⤵
PID:3924

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\3dl41ab.exe

Filesize
31KB

MD5
d244d68ce151750c83d24b853a593c9d

SHA1
6949c09a18c9c2aa074ebc0436f545dd6ddeaa53

SHA256
d9b7b47f7beb6094bc1765430530b0054d96e9a2299a894b8e7941d9048a1281

SHA512
160240fd2d60dae6c780c0d7f2910e9cef44a11973fbe28409b53b7260a1ece9889babbfc9ea37827d37eebf2c63b22a8315a8e8ba6c9e7e7171aec9ff567b49

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Ph9ks96.exe

Filesize
532KB

MD5
6d9cf47b1989389ec2ae305ee3125ae1

SHA1
dda0206f91773935d9babda1c4b9bc7781e1b825

SHA256
1229159b578b50752b1dd15c861835b195d0d6ad39d5209f7e2feb59212cdb21

SHA512
82bcdc47c69ef9d81b1c08e0c53f1ecda04551b7e7c5e36bd4f0eac4278659eabf7712d1abd73a1cfa5babfd6a42200ccaed07f339e261b580a30e0838bffc98

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\1Bp37pu8.exe

Filesize
935KB

MD5
772ab6297686be1f8f062fd8a7c5a2b5

SHA1
c37536b4b3ce75bbd0170d3dfbbef93a84dc1603

SHA256
c70920841d5a5ad3af370b1be96526ac52df457c0be334e3f630a31c4f6fde69

SHA512
12cbc056868de40a7c05e117ce7e953b0fa228c3693284cf93b6485a2a12d07113dca26770e8e08af260c383f1e77ee91293f1756108ed5c99f1ab337c4a3a7e

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\2Nz7405.exe

Filesize
1.1MB

MD5
b93742cee9ae55c7f53d32f7f5e90ee2

SHA1
1b523f0eed176c517ac9e4d8d6739fc317c80aa0

SHA256
0d7eb59ff0c3a66554f065a12a27f2a92e0fef13c1bae819128461dd6548681c

SHA512
208322dff0d7ca7c4b8ea7749e28de899799c9b01d5d3ed1328d5eebda05838282bc1b5ee3bbdc6488847ae8d53eef5cf036f9de9808a91601cba46e8c3866c1

Download Submit
memory/1884-26-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/3672-19-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3672-22-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3672-20-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4564-14-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/4564-15-0x000000007404E000-0x000000007404F000-memory.dmp

Filesize
4KB

Download