mystic | c35b2a353f3f737fd5d522bda8150c7fe11a4c4773ad1702d174b480462784c6

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
23-05-2024 17:26

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6c30cb007997032e419ad510193eb667e3f0e2f8af929be8fc9c20b3ae8f0467.exe
Size

378KB
MD5

99cbd861f83a58b6f9e44032d4809098
SHA1

a3830e857406f1fb963bf090a46daaf88b06e27e
SHA256

6c30cb007997032e419ad510193eb667e3f0e2f8af929be8fc9c20b3ae8f0467
SHA512

6b4088070017f838f07115d3aca431447ad78f001bedb26637b1bdd14e312d246d986fb35bbdbf39a7c8cb0d38ffb11773814264dec3ba06f2b6ca444c8505d6
SSDEEP

6144:f49SP92pCryG4kfjSGwEi56AOLGFIramMeulPZbsrww0D:f49Q2wryNSoF8apeul1sED

Score

10^/10

mystic stealer

Malware Config

Signatures

Detect Mystic stealer payload 6 IoCs

resource	yara_rule
behavioral7/memory/1740-9-0x0000000000400000-0x0000000000428000-memory.dmp	mystic_family
behavioral7/memory/1740-8-0x0000000000400000-0x0000000000428000-memory.dmp	mystic_family
behavioral7/memory/1740-5-0x0000000000400000-0x0000000000428000-memory.dmp	mystic_family
behavioral7/memory/1740-4-0x0000000000400000-0x0000000000428000-memory.dmp	mystic_family
behavioral7/memory/1740-3-0x0000000000400000-0x0000000000428000-memory.dmp	mystic_family
behavioral7/memory/1740-11-0x0000000000400000-0x0000000000428000-memory.dmp	mystic_family

Mystic
Mystic is an infostealer written in C++.
stealer mystic

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2320 set thread context of 1740	2320	6c30cb007997032e419ad510193eb667e3f0e2f8af929be8fc9c20b3ae8f0467.exe	29

Program crash 2 IoCs

pid	pid_target	Process	procid_target
2168	2320	WerFault.exe	27
2136	1740	WerFault.exe	29

Suspicious use of WriteProcessMemory 25 IoCs

description	pid	Process	procid_target
PID 2320 wrote to memory of 1740	2320	6c30cb007997032e419ad510193eb667e3f0e2f8af929be8fc9c20b3ae8f0467.exe	29
PID 2320 wrote to memory of 1740	2320	6c30cb007997032e419ad510193eb667e3f0e2f8af929be8fc9c20b3ae8f0467.exe	29
PID 2320 wrote to memory of 1740	2320	6c30cb007997032e419ad510193eb667e3f0e2f8af929be8fc9c20b3ae8f0467.exe	29
PID 2320 wrote to memory of 1740	2320	6c30cb007997032e419ad510193eb667e3f0e2f8af929be8fc9c20b3ae8f0467.exe	29
PID 2320 wrote to memory of 1740	2320	6c30cb007997032e419ad510193eb667e3f0e2f8af929be8fc9c20b3ae8f0467.exe	29
PID 2320 wrote to memory of 1740	2320	6c30cb007997032e419ad510193eb667e3f0e2f8af929be8fc9c20b3ae8f0467.exe	29
PID 2320 wrote to memory of 1740	2320	6c30cb007997032e419ad510193eb667e3f0e2f8af929be8fc9c20b3ae8f0467.exe	29
PID 2320 wrote to memory of 1740	2320	6c30cb007997032e419ad510193eb667e3f0e2f8af929be8fc9c20b3ae8f0467.exe	29
PID 2320 wrote to memory of 1740	2320	6c30cb007997032e419ad510193eb667e3f0e2f8af929be8fc9c20b3ae8f0467.exe	29
PID 2320 wrote to memory of 1740	2320	6c30cb007997032e419ad510193eb667e3f0e2f8af929be8fc9c20b3ae8f0467.exe	29
PID 2320 wrote to memory of 1740	2320	6c30cb007997032e419ad510193eb667e3f0e2f8af929be8fc9c20b3ae8f0467.exe	29
PID 2320 wrote to memory of 1740	2320	6c30cb007997032e419ad510193eb667e3f0e2f8af929be8fc9c20b3ae8f0467.exe	29
PID 2320 wrote to memory of 1740	2320	6c30cb007997032e419ad510193eb667e3f0e2f8af929be8fc9c20b3ae8f0467.exe	29
PID 2320 wrote to memory of 1740	2320	6c30cb007997032e419ad510193eb667e3f0e2f8af929be8fc9c20b3ae8f0467.exe	29
PID 2320 wrote to memory of 2168	2320	6c30cb007997032e419ad510193eb667e3f0e2f8af929be8fc9c20b3ae8f0467.exe	30
PID 2320 wrote to memory of 2168	2320	6c30cb007997032e419ad510193eb667e3f0e2f8af929be8fc9c20b3ae8f0467.exe	30
PID 2320 wrote to memory of 2168	2320	6c30cb007997032e419ad510193eb667e3f0e2f8af929be8fc9c20b3ae8f0467.exe	30
PID 2320 wrote to memory of 2168	2320	6c30cb007997032e419ad510193eb667e3f0e2f8af929be8fc9c20b3ae8f0467.exe	30
PID 1740 wrote to memory of 2136	1740	AppLaunch.exe	31
PID 1740 wrote to memory of 2136	1740	AppLaunch.exe	31
PID 1740 wrote to memory of 2136	1740	AppLaunch.exe	31
PID 1740 wrote to memory of 2136	1740	AppLaunch.exe	31
PID 1740 wrote to memory of 2136	1740	AppLaunch.exe	31
PID 1740 wrote to memory of 2136	1740	AppLaunch.exe	31
PID 1740 wrote to memory of 2136	1740	AppLaunch.exe	31

C:\Users\Admin\AppData\Local\Temp\6c30cb007997032e419ad510193eb667e3f0e2f8af929be8fc9c20b3ae8f0467.exe
"C:\Users\Admin\AppData\Local\Temp\6c30cb007997032e419ad510193eb667e3f0e2f8af929be8fc9c20b3ae8f0467.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2320
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1740
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1740 -s 196
    3⤵
    - Program crash
    PID:2136
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2320 -s 136
  2⤵
  - Program crash
  PID:2168

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1740-9-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/1740-8-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/1740-5-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/1740-4-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/1740-3-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/1740-2-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/1740-1-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/1740-0-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/1740-6-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmp

Filesize
4KB

Download
memory/1740-11-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads