mystic | e19e97a334ecb39058fd976080222a46cc2159e34c85df371a9eaf0088ee80eb

Analysis

max time kernel
142s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
23-05-2024 10:44

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

cfda8adb7597e205b205c916dd913856ad96e83acc3a76ec0ca6f85b8cb33c7f.exe
Size

668KB
MD5

4cd9f4a51d4222f674cc44432ae8509c
SHA1

bf4548f30db9b5eac81fce9e0d693f7bc5b484ac
SHA256

cfda8adb7597e205b205c916dd913856ad96e83acc3a76ec0ca6f85b8cb33c7f
SHA512

e36834e17fda3fbe45ca15b149b35940f7719dc10d7406d24e06be35ffe4c0613742eafb4f61d6120aff8d128d9fd5a759cf41ec5655e3508a47b0e4f4e4516f
SSDEEP

12288:nMrty90KXqjPUic360qc6NxeFLAYjiSs06d+JcSeCg8ammGlVoOb11:iyd4Mqdc886jd+Hg8aU/L1

Score

10^/10

mystic smokeloader backdoor evasion persistence stealer trojan

Malware Config

Signatures

Detect Mystic stealer payload 3 IoCs

Processes:

resource	yara_rule
behavioral25/memory/2116-19-0x0000000000400000-0x0000000000434000-memory.dmp	mystic_family
behavioral25/memory/2116-20-0x0000000000400000-0x0000000000434000-memory.dmp	mystic_family
behavioral25/memory/2116-22-0x0000000000400000-0x0000000000434000-memory.dmp	mystic_family

Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs

evasion trojan

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

Processes:

AppLaunch.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection	AppLaunch.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	AppLaunch.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	AppLaunch.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	AppLaunch.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	AppLaunch.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	AppLaunch.exe

Mystic
Mystic is an infostealer written in C++.
stealer mystic
SmokeLoader
Modular backdoor trojan in use since 2014.
trojan backdoor smokeloader
Executes dropped EXE 4 IoCs

Processes:

Wr7xo92.exe1ve71NP8.exe2Ek8667.exe3Ev01rY.exe

pid process

1776 Wr7xo92.exe
1856 1ve71NP8.exe
3540 2Ek8667.exe
3500 3Ev01rY.exe

pid	process
1776	Wr7xo92.exe
1856	1ve71NP8.exe
3540	2Ek8667.exe
3500	3Ev01rY.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

cfda8adb7597e205b205c916dd913856ad96e83acc3a76ec0ca6f85b8cb33c7f.exeWr7xo92.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	cfda8adb7597e205b205c916dd913856ad96e83acc3a76ec0ca6f85b8cb33c7f.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	Wr7xo92.exe

Suspicious use of SetThreadContext 2 IoCs

Processes:

1ve71NP8.exe2Ek8667.exe

description	pid	process	target process
PID 1856 set thread context of 1000	1856	1ve71NP8.exe	AppLaunch.exe
PID 3540 set thread context of 2116	3540	2Ek8667.exe	AppLaunch.exe

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

3Ev01rY.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	3Ev01rY.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	3Ev01rY.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	3Ev01rY.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

AppLaunch.exe

pid process

1000 AppLaunch.exe
1000 AppLaunch.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

AppLaunch.exe

description pid process

Token: SeDebugPrivilege 1000 AppLaunch.exe

pid	process
1000	AppLaunch.exe
1000	AppLaunch.exe

description	pid	process
Token: SeDebugPrivilege	1000	AppLaunch.exe

Suspicious use of WriteProcessMemory 33 IoCs

Processes:

cfda8adb7597e205b205c916dd913856ad96e83acc3a76ec0ca6f85b8cb33c7f.exeWr7xo92.exe1ve71NP8.exe2Ek8667.exe

description	pid	process	target process
PID 3832 wrote to memory of 1776	3832	cfda8adb7597e205b205c916dd913856ad96e83acc3a76ec0ca6f85b8cb33c7f.exe	Wr7xo92.exe
PID 3832 wrote to memory of 1776	3832	cfda8adb7597e205b205c916dd913856ad96e83acc3a76ec0ca6f85b8cb33c7f.exe	Wr7xo92.exe
PID 3832 wrote to memory of 1776	3832	cfda8adb7597e205b205c916dd913856ad96e83acc3a76ec0ca6f85b8cb33c7f.exe	Wr7xo92.exe
PID 1776 wrote to memory of 1856	1776	Wr7xo92.exe	1ve71NP8.exe
PID 1776 wrote to memory of 1856	1776	Wr7xo92.exe	1ve71NP8.exe
PID 1776 wrote to memory of 1856	1776	Wr7xo92.exe	1ve71NP8.exe
PID 1856 wrote to memory of 1000	1856	1ve71NP8.exe	AppLaunch.exe
PID 1856 wrote to memory of 1000	1856	1ve71NP8.exe	AppLaunch.exe
PID 1856 wrote to memory of 1000	1856	1ve71NP8.exe	AppLaunch.exe
PID 1856 wrote to memory of 1000	1856	1ve71NP8.exe	AppLaunch.exe
PID 1856 wrote to memory of 1000	1856	1ve71NP8.exe	AppLaunch.exe
PID 1856 wrote to memory of 1000	1856	1ve71NP8.exe	AppLaunch.exe
PID 1856 wrote to memory of 1000	1856	1ve71NP8.exe	AppLaunch.exe
PID 1856 wrote to memory of 1000	1856	1ve71NP8.exe	AppLaunch.exe
PID 1776 wrote to memory of 3540	1776	Wr7xo92.exe	2Ek8667.exe
PID 1776 wrote to memory of 3540	1776	Wr7xo92.exe	2Ek8667.exe
PID 1776 wrote to memory of 3540	1776	Wr7xo92.exe	2Ek8667.exe
PID 3540 wrote to memory of 2100	3540	2Ek8667.exe	AppLaunch.exe
PID 3540 wrote to memory of 2100	3540	2Ek8667.exe	AppLaunch.exe
PID 3540 wrote to memory of 2100	3540	2Ek8667.exe	AppLaunch.exe
PID 3540 wrote to memory of 2116	3540	2Ek8667.exe	AppLaunch.exe
PID 3540 wrote to memory of 2116	3540	2Ek8667.exe	AppLaunch.exe
PID 3540 wrote to memory of 2116	3540	2Ek8667.exe	AppLaunch.exe
PID 3540 wrote to memory of 2116	3540	2Ek8667.exe	AppLaunch.exe
PID 3540 wrote to memory of 2116	3540	2Ek8667.exe	AppLaunch.exe
PID 3540 wrote to memory of 2116	3540	2Ek8667.exe	AppLaunch.exe
PID 3540 wrote to memory of 2116	3540	2Ek8667.exe	AppLaunch.exe
PID 3540 wrote to memory of 2116	3540	2Ek8667.exe	AppLaunch.exe
PID 3540 wrote to memory of 2116	3540	2Ek8667.exe	AppLaunch.exe
PID 3540 wrote to memory of 2116	3540	2Ek8667.exe	AppLaunch.exe
PID 3832 wrote to memory of 3500	3832	cfda8adb7597e205b205c916dd913856ad96e83acc3a76ec0ca6f85b8cb33c7f.exe	3Ev01rY.exe
PID 3832 wrote to memory of 3500	3832	cfda8adb7597e205b205c916dd913856ad96e83acc3a76ec0ca6f85b8cb33c7f.exe	3Ev01rY.exe
PID 3832 wrote to memory of 3500	3832	cfda8adb7597e205b205c916dd913856ad96e83acc3a76ec0ca6f85b8cb33c7f.exe	3Ev01rY.exe

C:\Users\Admin\AppData\Local\Temp\cfda8adb7597e205b205c916dd913856ad96e83acc3a76ec0ca6f85b8cb33c7f.exe
"C:\Users\Admin\AppData\Local\Temp\cfda8adb7597e205b205c916dd913856ad96e83acc3a76ec0ca6f85b8cb33c7f.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:3832
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Wr7xo92.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Wr7xo92.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:1776
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\1ve71NP8.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\1ve71NP8.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - Suspicious use of WriteProcessMemory
    PID:1856
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
      4⤵
      Modifies Windows Defender Real-time Protection settings
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:1000
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\2Ek8667.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\2Ek8667.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - Suspicious use of WriteProcessMemory
    PID:3540
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
      4⤵
      PID:2100
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
      4⤵
      PID:2116
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\3Ev01rY.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\3Ev01rY.exe
  2⤵
  - Executes dropped EXE
  - Checks SCSI registry key(s)
  PID:3500

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\3Ev01rY.exe

Filesize
31KB

MD5
9851cb7792be9fa6987f032602301246

SHA1
66f850d255aaec219836862dbe7f0aa20d2639f3

SHA256
fd678b0bb19973e0652b0b3b2176e61396842cf919f3c92f280014fd5d1bc816

SHA512
fd62e805c27ad3ffa7e145b1151e0bf395764ef80c56ac0d03e447264f3a6f1f4cce5a9b5c8b99d02589486b62e29d888f27af640097bd65f0e339c778108d81

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Wr7xo92.exe

Filesize
544KB

MD5
8585d0e4352299c99876cfef8b414070

SHA1
dca00d76457ce03461a14b22d01ef707bb0fc1d7

SHA256
dfc623ffda35bad99869f0655b9e7d7b874416554e2d47692a871318ed0c19b4

SHA512
e2f898dffc89c0da49194d2547c9f57b980b26a4f66f9ec07aaad1ce1787225e57843cd9c216614eab8e15ee0b1f2123b76905067522899fadb6bc19135d9c97

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\1ve71NP8.exe

Filesize
933KB

MD5
f6a8a247bfe4b1fd68989a8b511540e0

SHA1
8703abc93f079277c5fd3f42c599f1c9662edf35

SHA256
d7d74dbfbf20858d5bab1651ee0ed2a7003a2307be96b924a99a06a0206f69a6

SHA512
9ce17b86d9b67a117cdcccf0246a1f642764eb2202beb1aacd53275a651f630424d944fb41ad0cdd98d5c6133a6451b75e7a0e296e70e93cc744f8497747f545

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\2Ek8667.exe

Filesize
1.1MB

MD5
7f27e3beca6f4d5ddb633fc7f14ba9b3

SHA1
f0724dd591dbbb68911325037df5585687fd199e

SHA256
c05c6c42c65f0a82b57c76f35ce2400f494076b239fe86f472de9fca75799151

SHA512
556c26c91a1cbaf267ae56278122ef6466d471d440b657c5221f13c256d398370569b2141041dc67e3faa0c0af6a8d63d551fa4032fa5685f3e3d56ef02fec34

Download Submit
memory/1000-14-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/1000-18-0x000000007441E000-0x000000007441F000-memory.dmp

Filesize
4KB

Download
memory/2116-19-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2116-20-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2116-22-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3500-26-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/3500-27-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download