mystic | 3c91163ea40ad7e35bac48ded16235cfe9003c914f570e27b4e2d7b3c9c46c05

Analysis

max time kernel
135s
max time network
107s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
23-05-2024 18:29

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

481a0f4fa42355dcab4b326284346186f8ec693263f829b30f6083be86538ab6.exe
Size

725KB
MD5

92fa0c8a34a4b40892e461df85d70580
SHA1

f7141dd42442351ea2c67a386f53cb32e909072a
SHA256

481a0f4fa42355dcab4b326284346186f8ec693263f829b30f6083be86538ab6
SHA512

b717ff2d7d9e397604fd0d18dfb2d8e0aedd715d70f63cac0dd0559eaeabb393dd67a414db83cfb8a296a3cab90c46b7a9fea2d9c349d09cc00076fc3334526f
SSDEEP

12288:4Mrny90/ONoGBpP8dN21TMXvsRxswsfMwyalVzmDWQcPnu427cWQX+pWd8k:Py0UpfTMXvsR9sfTrlVzrJPulQWJUd8k

Score

10^/10

mystic smokeloader backdoor evasion persistence stealer trojan

Malware Config

Signatures

Detect Mystic stealer payload 3 IoCs

resource	yara_rule
behavioral6/memory/2596-54-0x0000000000400000-0x0000000000433000-memory.dmp	mystic_family
behavioral6/memory/2596-57-0x0000000000400000-0x0000000000433000-memory.dmp	mystic_family
behavioral6/memory/2596-55-0x0000000000400000-0x0000000000433000-memory.dmp	mystic_family

Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs

evasion trojan

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	1iL26jR8.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection	1iL26jR8.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	1iL26jR8.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	1iL26jR8.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	1iL26jR8.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	1iL26jR8.exe

Mystic
Mystic is an infostealer written in C++.
stealer mystic
SmokeLoader
Modular backdoor trojan in use since 2014.
trojan backdoor smokeloader

Executes dropped EXE 4 IoCs

pid	Process
3700	kq2OE70.exe
4688	1iL26jR8.exe
1108	2wR4164.exe
2584	3bD82wu.exe

Windows security modification 2 TTPs 2 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features	1iL26jR8.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0"	1iL26jR8.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	481a0f4fa42355dcab4b326284346186f8ec693263f829b30f6083be86538ab6.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	kq2OE70.exe

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 1108 set thread context of 2596	1108	2wR4164.exe	98
PID 2584 set thread context of 2016	2584	3bD82wu.exe	103

Program crash 2 IoCs

pid	pid_target	Process	procid_target
4288	1108	WerFault.exe	97
3544	2584	WerFault.exe	102

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	AppLaunch.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	AppLaunch.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	AppLaunch.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4688	1iL26jR8.exe
4688	1iL26jR8.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4688	1iL26jR8.exe

Suspicious use of WriteProcessMemory 28 IoCs

description	pid	Process	procid_target
PID 3356 wrote to memory of 3700	3356	481a0f4fa42355dcab4b326284346186f8ec693263f829b30f6083be86538ab6.exe	83
PID 3356 wrote to memory of 3700	3356	481a0f4fa42355dcab4b326284346186f8ec693263f829b30f6083be86538ab6.exe	83
PID 3356 wrote to memory of 3700	3356	481a0f4fa42355dcab4b326284346186f8ec693263f829b30f6083be86538ab6.exe	83
PID 3700 wrote to memory of 4688	3700	kq2OE70.exe	84
PID 3700 wrote to memory of 4688	3700	kq2OE70.exe	84
PID 3700 wrote to memory of 4688	3700	kq2OE70.exe	84
PID 3700 wrote to memory of 1108	3700	kq2OE70.exe	97
PID 3700 wrote to memory of 1108	3700	kq2OE70.exe	97
PID 3700 wrote to memory of 1108	3700	kq2OE70.exe	97
PID 1108 wrote to memory of 2596	1108	2wR4164.exe	98
PID 1108 wrote to memory of 2596	1108	2wR4164.exe	98
PID 1108 wrote to memory of 2596	1108	2wR4164.exe	98
PID 1108 wrote to memory of 2596	1108	2wR4164.exe	98
PID 1108 wrote to memory of 2596	1108	2wR4164.exe	98
PID 1108 wrote to memory of 2596	1108	2wR4164.exe	98
PID 1108 wrote to memory of 2596	1108	2wR4164.exe	98
PID 1108 wrote to memory of 2596	1108	2wR4164.exe	98
PID 1108 wrote to memory of 2596	1108	2wR4164.exe	98
PID 1108 wrote to memory of 2596	1108	2wR4164.exe	98
PID 3356 wrote to memory of 2584	3356	481a0f4fa42355dcab4b326284346186f8ec693263f829b30f6083be86538ab6.exe	102
PID 3356 wrote to memory of 2584	3356	481a0f4fa42355dcab4b326284346186f8ec693263f829b30f6083be86538ab6.exe	102
PID 3356 wrote to memory of 2584	3356	481a0f4fa42355dcab4b326284346186f8ec693263f829b30f6083be86538ab6.exe	102
PID 2584 wrote to memory of 2016	2584	3bD82wu.exe	103
PID 2584 wrote to memory of 2016	2584	3bD82wu.exe	103
PID 2584 wrote to memory of 2016	2584	3bD82wu.exe	103
PID 2584 wrote to memory of 2016	2584	3bD82wu.exe	103
PID 2584 wrote to memory of 2016	2584	3bD82wu.exe	103
PID 2584 wrote to memory of 2016	2584	3bD82wu.exe	103

C:\Users\Admin\AppData\Local\Temp\481a0f4fa42355dcab4b326284346186f8ec693263f829b30f6083be86538ab6.exe
"C:\Users\Admin\AppData\Local\Temp\481a0f4fa42355dcab4b326284346186f8ec693263f829b30f6083be86538ab6.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:3356
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\kq2OE70.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\kq2OE70.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:3700
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\1iL26jR8.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\1iL26jR8.exe
    3⤵
    - Modifies Windows Defender Real-time Protection settings
    - Executes dropped EXE
    - Windows security modification
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4688
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\2wR4164.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\2wR4164.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - Suspicious use of WriteProcessMemory
    PID:1108
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
      4⤵
      PID:2596
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1108 -s 576
      4⤵
      Program crash
      PID:4288
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\3bD82wu.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\3bD82wu.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - Suspicious use of WriteProcessMemory
  PID:2584
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
    3⤵
    - Checks SCSI registry key(s)
    PID:2016
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2584 -s 196
    3⤵
    - Program crash
    PID:3544

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 1108 -ip 1108
1⤵
PID:3412

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 2584 -ip 2584
1⤵
PID:5104

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\3bD82wu.exe

Filesize
271KB

MD5
36ef3e2a4aa62514039526559f318fb0

SHA1
4062d1727e99a687a76ece7c8e6a11da33ed97da

SHA256
f229cb277d7c162d246b31115b5b1249f1a5c5cf355849c3d62b328078ec0a66

SHA512
d25574d3940b4ca730c8c266882ef214dd3fe39085302a1282e936eb8bd70af803ea88c21757e2353b8c4f192bb04ed447b84b1de4f00adac0089d8a123ef503

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\kq2OE70.exe

Filesize
479KB

MD5
a36f65f317ac41f8fd835d9472e54596

SHA1
0770f7e17bee482e980bde6157d36ab6612eafa5

SHA256
da85318c86e347642de41ee65fd6363813b5e0b29587b390f0258c819f35ec60

SHA512
8dbfcc1b252a305f435b289ba4433e3c6c6256a8bfe99b73e1b323270c174885ad6ed3917607b1fc81573f79ce6e07ed7bb91dbae1d693ed9a04d948d58eb32d

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\1iL26jR8.exe

Filesize
194KB

MD5
35d718538c3e1346cb4fcf54aaa0f141

SHA1
234c0aa0465c27c190a83936e8e3aa3c4b991224

SHA256
97e62bfa90aca06c595fb150e36f56b4a285f58cc072b8c458ae79805523fc36

SHA512
4bcf5cabe93ec54608ccb95d80822f411bb32c2746be609873a493045913fb53e0a953e75f82dfe620d661f049437da7a70d34995dc915bb0b09426e97f0aec3

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\2wR4164.exe

Filesize
423KB

MD5
4c2bad1fd96c888ce1fe27e206e3f656

SHA1
9daab8534f7de7bb43472fc9c9672da31567fa0e

SHA256
e6f399a2b4b56b0bd7a9402e01ff13554fbae7195df6ec1e6faeafdc04f72537

SHA512
7174cba5194c8ea273d0ff3dce0a426eecb0ac86b4ad8defb1b5f29ad33f9f55a7fbb9d0ded82dfdcb2846963aabc8a23ad319568b6a379fdd27715fd4071976

Download Submit
memory/2016-61-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2596-55-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2596-57-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2596-54-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4688-27-0x0000000002450000-0x0000000002466000-memory.dmp

Filesize
88KB

Download
memory/4688-31-0x0000000002450000-0x0000000002466000-memory.dmp

Filesize
88KB

Download
memory/4688-43-0x0000000002450000-0x0000000002466000-memory.dmp

Filesize
88KB

Download
memory/4688-41-0x0000000002450000-0x0000000002466000-memory.dmp

Filesize
88KB

Download
memory/4688-39-0x0000000002450000-0x0000000002466000-memory.dmp

Filesize
88KB

Download
memory/4688-37-0x0000000002450000-0x0000000002466000-memory.dmp

Filesize
88KB

Download
memory/4688-47-0x0000000002450000-0x0000000002466000-memory.dmp

Filesize
88KB

Download
memory/4688-25-0x0000000002450000-0x0000000002466000-memory.dmp

Filesize
88KB

Download
memory/4688-21-0x0000000002450000-0x0000000002466000-memory.dmp

Filesize
88KB

Download
memory/4688-20-0x0000000002450000-0x0000000002466000-memory.dmp

Filesize
88KB

Download
memory/4688-33-0x0000000002450000-0x0000000002466000-memory.dmp

Filesize
88KB

Download
memory/4688-45-0x0000000002450000-0x0000000002466000-memory.dmp

Filesize
88KB

Download
memory/4688-29-0x0000000002450000-0x0000000002466000-memory.dmp

Filesize
88KB

Download
memory/4688-23-0x0000000002450000-0x0000000002466000-memory.dmp

Filesize
88KB

Download
memory/4688-19-0x0000000073EF0000-0x00000000746A0000-memory.dmp

Filesize
7.7MB

Download
memory/4688-48-0x0000000073EF0000-0x00000000746A0000-memory.dmp

Filesize
7.7MB

Download
memory/4688-50-0x0000000073EF0000-0x00000000746A0000-memory.dmp

Filesize
7.7MB

Download
memory/4688-35-0x0000000002450000-0x0000000002466000-memory.dmp

Filesize
88KB

Download
memory/4688-18-0x0000000002450000-0x000000000246C000-memory.dmp

Filesize
112KB

Download
memory/4688-17-0x0000000004BA0000-0x0000000005144000-memory.dmp

Filesize
5.6MB

Download
memory/4688-16-0x0000000073EF0000-0x00000000746A0000-memory.dmp

Filesize
7.7MB

Download
memory/4688-15-0x0000000002060000-0x000000000207E000-memory.dmp

Filesize
120KB

Download
memory/4688-14-0x0000000073EFE000-0x0000000073EFF000-memory.dmp

Filesize
4KB

Download