mystic | 75edb521bbb0ae12b7c2c52fa6e3ed769f4e764e26b92ef2dc4d7cb78ed92fd9

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
23-05-2024 18:30

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6ba7aab10ca9c6b1705b9de79a2e324a956c2ef5b8210ba6a6fff04274d5a4ba.exe
Size

760KB
MD5

611d7feaeb5914a5e51cbcfb67f0736a
SHA1

f8fbc7b3d0924083169fb7669df028c618e5fe21
SHA256

6ba7aab10ca9c6b1705b9de79a2e324a956c2ef5b8210ba6a6fff04274d5a4ba
SHA512

bbe10e8e6f5a565b3bba76833a91f25651a1a2e823383ca4634225d99a27907a6c98a680ff0772b88bc0524e51fc881452826d675eef509995ce9e0431248f5c
SSDEEP

12288:lMrGy90sxN59718Z6IsiQp3FauvvFV/1nDjbFfL9i1RxZComUNiuUWgB2KG8va3f:zyd97Syp3Fr9l1nbVL9sxZCoLiua2KF6

Score

10^/10

mystic evasion persistence stealer trojan

Malware Config

Signatures

Detect Mystic stealer payload 3 IoCs

resource	yara_rule
behavioral8/memory/2700-49-0x0000000000400000-0x0000000000428000-memory.dmp	mystic_family
behavioral8/memory/2700-52-0x0000000000400000-0x0000000000428000-memory.dmp	mystic_family
behavioral8/memory/2700-50-0x0000000000400000-0x0000000000428000-memory.dmp	mystic_family

Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs

evasion trojan

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection	AppLaunch.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	AppLaunch.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	AppLaunch.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	AppLaunch.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	AppLaunch.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	AppLaunch.exe

Mystic
Mystic is an infostealer written in C++.
stealer mystic

Executes dropped EXE 2 IoCs

pid	Process
964	1pS95oz4.exe
3740	2mS8119.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	6ba7aab10ca9c6b1705b9de79a2e324a956c2ef5b8210ba6a6fff04274d5a4ba.exe

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 964 set thread context of 2208	964	1pS95oz4.exe	86
PID 3740 set thread context of 2700	3740	2mS8119.exe	92

Program crash 2 IoCs

pid	pid_target	Process	procid_target
652	964	WerFault.exe	84
4076	3740	WerFault.exe	91

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2208	AppLaunch.exe
2208	AppLaunch.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2208	AppLaunch.exe

Suspicious use of WriteProcessMemory 25 IoCs

description	pid	Process	procid_target
PID 464 wrote to memory of 964	464	6ba7aab10ca9c6b1705b9de79a2e324a956c2ef5b8210ba6a6fff04274d5a4ba.exe	84
PID 464 wrote to memory of 964	464	6ba7aab10ca9c6b1705b9de79a2e324a956c2ef5b8210ba6a6fff04274d5a4ba.exe	84
PID 464 wrote to memory of 964	464	6ba7aab10ca9c6b1705b9de79a2e324a956c2ef5b8210ba6a6fff04274d5a4ba.exe	84
PID 964 wrote to memory of 2208	964	1pS95oz4.exe	86
PID 964 wrote to memory of 2208	964	1pS95oz4.exe	86
PID 964 wrote to memory of 2208	964	1pS95oz4.exe	86
PID 964 wrote to memory of 2208	964	1pS95oz4.exe	86
PID 964 wrote to memory of 2208	964	1pS95oz4.exe	86
PID 964 wrote to memory of 2208	964	1pS95oz4.exe	86
PID 964 wrote to memory of 2208	964	1pS95oz4.exe	86
PID 964 wrote to memory of 2208	964	1pS95oz4.exe	86
PID 964 wrote to memory of 2208	964	1pS95oz4.exe	86
PID 464 wrote to memory of 3740	464	6ba7aab10ca9c6b1705b9de79a2e324a956c2ef5b8210ba6a6fff04274d5a4ba.exe	91
PID 464 wrote to memory of 3740	464	6ba7aab10ca9c6b1705b9de79a2e324a956c2ef5b8210ba6a6fff04274d5a4ba.exe	91
PID 464 wrote to memory of 3740	464	6ba7aab10ca9c6b1705b9de79a2e324a956c2ef5b8210ba6a6fff04274d5a4ba.exe	91
PID 3740 wrote to memory of 2700	3740	2mS8119.exe	92
PID 3740 wrote to memory of 2700	3740	2mS8119.exe	92
PID 3740 wrote to memory of 2700	3740	2mS8119.exe	92
PID 3740 wrote to memory of 2700	3740	2mS8119.exe	92
PID 3740 wrote to memory of 2700	3740	2mS8119.exe	92
PID 3740 wrote to memory of 2700	3740	2mS8119.exe	92
PID 3740 wrote to memory of 2700	3740	2mS8119.exe	92
PID 3740 wrote to memory of 2700	3740	2mS8119.exe	92
PID 3740 wrote to memory of 2700	3740	2mS8119.exe	92
PID 3740 wrote to memory of 2700	3740	2mS8119.exe	92

C:\Users\Admin\AppData\Local\Temp\6ba7aab10ca9c6b1705b9de79a2e324a956c2ef5b8210ba6a6fff04274d5a4ba.exe
"C:\Users\Admin\AppData\Local\Temp\6ba7aab10ca9c6b1705b9de79a2e324a956c2ef5b8210ba6a6fff04274d5a4ba.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:464
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\1pS95oz4.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\1pS95oz4.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - Suspicious use of WriteProcessMemory
  PID:964
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
    3⤵
    - Modifies Windows Defender Real-time Protection settings
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2208
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 964 -s 572
    3⤵
    - Program crash
    PID:652
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\2mS8119.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\2mS8119.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - Suspicious use of WriteProcessMemory
  PID:3740
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
    3⤵
    PID:2700
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3740 -s 572
    3⤵
    - Program crash
    PID:4076

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 964 -ip 964
1⤵
PID:2064

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 360 -p 3740 -ip 3740
1⤵
PID:3308

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\1pS95oz4.exe

Filesize
1.8MB

MD5
94e5ac711ef8088f9903d7fa01878481

SHA1
b6b035806157204b16635d465c84629cea420d60

SHA256
893491b0738c3ca1cc8cf66b1bb80803ceeb331dc5498315aa60d98f0484d320

SHA512
545e3dcc86cd9fec9c74e4ceb0f76b823e44574b2f00659225dd15ae866c7f7dbf38e2a1f242db00ff1e9c082ca67ff3b2fb2532d1cd2fcce3e47b9b2667563b

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\2mS8119.exe

Filesize
1.8MB

MD5
f3f2f8b5752ef75807bb50f7cdca9813

SHA1
0b4c8a7da527a45432922e8f6eaddc5959165ae1

SHA256
0fef3487fff91a01030ad443e6e548c323825a6c9d354d406c5d224b25dc880d

SHA512
6bd7f737e4490756f520f21d3f3c5c08b36f70c001f861c6cea9b75ae59254a1fa42d265f121c2ba54d0f12bdfd6b03580cf5a4a8e037fd0331732bddd95d09e

Download Submit
memory/2208-41-0x0000000005600000-0x0000000005616000-memory.dmp

Filesize
88KB

Download
memory/2208-13-0x0000000005530000-0x000000000554E000-memory.dmp

Filesize
120KB

Download
memory/2208-38-0x0000000005600000-0x0000000005616000-memory.dmp

Filesize
88KB

Download
memory/2208-12-0x00000000743EE000-0x00000000743EF000-memory.dmp

Filesize
4KB

Download
memory/2208-35-0x0000000005600000-0x0000000005616000-memory.dmp

Filesize
88KB

Download
memory/2208-14-0x00000000743E0000-0x0000000074B90000-memory.dmp

Filesize
7.7MB

Download
memory/2208-15-0x0000000005C20000-0x00000000061C4000-memory.dmp

Filesize
5.6MB

Download
memory/2208-16-0x0000000005600000-0x000000000561C000-memory.dmp

Filesize
112KB

Download
memory/2208-17-0x00000000743E0000-0x0000000074B90000-memory.dmp

Filesize
7.7MB

Download
memory/2208-29-0x0000000005600000-0x0000000005616000-memory.dmp

Filesize
88KB

Download
memory/2208-45-0x0000000005600000-0x0000000005616000-memory.dmp

Filesize
88KB

Download
memory/2208-33-0x0000000005600000-0x0000000005616000-memory.dmp

Filesize
88KB

Download
memory/2208-8-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/2208-39-0x0000000005600000-0x0000000005616000-memory.dmp

Filesize
88KB

Download
memory/2208-9-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/2208-11-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/2208-43-0x0000000005600000-0x0000000005616000-memory.dmp

Filesize
88KB

Download
memory/2208-31-0x0000000005600000-0x0000000005616000-memory.dmp

Filesize
88KB

Download
memory/2208-27-0x0000000005600000-0x0000000005616000-memory.dmp

Filesize
88KB

Download
memory/2208-25-0x0000000005600000-0x0000000005616000-memory.dmp

Filesize
88KB

Download
memory/2208-23-0x0000000005600000-0x0000000005616000-memory.dmp

Filesize
88KB

Download
memory/2208-21-0x0000000005600000-0x0000000005616000-memory.dmp

Filesize
88KB

Download
memory/2208-19-0x0000000005600000-0x0000000005616000-memory.dmp

Filesize
88KB

Download
memory/2208-18-0x0000000005600000-0x0000000005616000-memory.dmp

Filesize
88KB

Download
memory/2208-7-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/2208-54-0x00000000743E0000-0x0000000074B90000-memory.dmp

Filesize
7.7MB

Download
memory/2700-52-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/2700-50-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/2700-49-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download