mystic | 60fcc3045e1b1073753937ff8c184c464a45ea76225a406024335c07f898cf7b

Analysis

max time kernel
133s
max time network
124s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
23-05-2024 17:46

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b754f77f3f7979982512737911316ed9033bfd21616cbf6657291e3730f76b44.exe
Size

598KB
MD5

79504797282c6ffa60a377bb716c9896
SHA1

b5300d249069c36dbee175fffbcd2aca6729d5da
SHA256

b754f77f3f7979982512737911316ed9033bfd21616cbf6657291e3730f76b44
SHA512

ab2e96d05fb5510da46130882a8098432baaaf09bfeca804a8d263fba17f6eba11571ed9b1f349f1d492ec0ce678bbacdd1116c6ba2b9d5c11f3ddc587b8e036
SSDEEP

12288:ZMrDy900un5B6oTeRNKHPWbOM+ppvsasM9Ygv5pS3rM+SLqJZ0f3UddEHf:qysB6oTebsRzDEcYrvi0m3/

Score

10^/10

mystic evasion persistence stealer trojan

Malware Config

Signatures

Detect Mystic stealer payload 4 IoCs

resource	yara_rule
behavioral17/memory/2432-46-0x0000000000400000-0x0000000000428000-memory.dmp	mystic_family
behavioral17/memory/2432-48-0x0000000000400000-0x0000000000428000-memory.dmp	mystic_family
behavioral17/memory/2432-50-0x0000000000400000-0x0000000000428000-memory.dmp	mystic_family
behavioral17/memory/2432-47-0x0000000000400000-0x0000000000428000-memory.dmp	mystic_family

Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs

evasion trojan

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	1Au24Qq0.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	1Au24Qq0.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	1Au24Qq0.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	1Au24Qq0.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection	1Au24Qq0.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	1Au24Qq0.exe

Mystic
Mystic is an infostealer written in C++.
stealer mystic

Executes dropped EXE 2 IoCs

pid	Process
3844	1Au24Qq0.exe
220	2Mt9071.exe

Windows security modification 2 TTPs 2 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0"	1Au24Qq0.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features	1Au24Qq0.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	b754f77f3f7979982512737911316ed9033bfd21616cbf6657291e3730f76b44.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 220 set thread context of 2432	220	2Mt9071.exe	97

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4536	220	WerFault.exe	95

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3844	1Au24Qq0.exe
3844	1Au24Qq0.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	3844	1Au24Qq0.exe

Suspicious use of WriteProcessMemory 16 IoCs

description	pid	Process	procid_target
PID 704 wrote to memory of 3844	704	b754f77f3f7979982512737911316ed9033bfd21616cbf6657291e3730f76b44.exe	83
PID 704 wrote to memory of 3844	704	b754f77f3f7979982512737911316ed9033bfd21616cbf6657291e3730f76b44.exe	83
PID 704 wrote to memory of 3844	704	b754f77f3f7979982512737911316ed9033bfd21616cbf6657291e3730f76b44.exe	83
PID 704 wrote to memory of 220	704	b754f77f3f7979982512737911316ed9033bfd21616cbf6657291e3730f76b44.exe	95
PID 704 wrote to memory of 220	704	b754f77f3f7979982512737911316ed9033bfd21616cbf6657291e3730f76b44.exe	95
PID 704 wrote to memory of 220	704	b754f77f3f7979982512737911316ed9033bfd21616cbf6657291e3730f76b44.exe	95
PID 220 wrote to memory of 2432	220	2Mt9071.exe	97
PID 220 wrote to memory of 2432	220	2Mt9071.exe	97
PID 220 wrote to memory of 2432	220	2Mt9071.exe	97
PID 220 wrote to memory of 2432	220	2Mt9071.exe	97
PID 220 wrote to memory of 2432	220	2Mt9071.exe	97
PID 220 wrote to memory of 2432	220	2Mt9071.exe	97
PID 220 wrote to memory of 2432	220	2Mt9071.exe	97
PID 220 wrote to memory of 2432	220	2Mt9071.exe	97
PID 220 wrote to memory of 2432	220	2Mt9071.exe	97
PID 220 wrote to memory of 2432	220	2Mt9071.exe	97

C:\Users\Admin\AppData\Local\Temp\b754f77f3f7979982512737911316ed9033bfd21616cbf6657291e3730f76b44.exe
"C:\Users\Admin\AppData\Local\Temp\b754f77f3f7979982512737911316ed9033bfd21616cbf6657291e3730f76b44.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:704
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\1Au24Qq0.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\1Au24Qq0.exe
  2⤵
  - Modifies Windows Defender Real-time Protection settings
  - Executes dropped EXE
  - Windows security modification
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3844
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\2Mt9071.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\2Mt9071.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - Suspicious use of WriteProcessMemory
  PID:220
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
    3⤵
    PID:2432
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 220 -s 148
    3⤵
    - Program crash
    PID:4536

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 220 -ip 220
1⤵
PID:3128

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\1Au24Qq0.exe

Filesize
192KB

MD5
8904f85abd522c7d0cb5789d9583ccff

SHA1
5b34d8595b37c9e1fb9682b06dc5228efe07f0c6

SHA256
7624b62fe97c8e370c82bc86f69c2f627328e701ce1f3d9bed92a1e5fe11fd7f

SHA512
04dd0c4e612b6287af6a655425085d687538d756dcd639ecb6c62bcdafddde52c56ae305a6240ee1329a95d9cc59dee6de5000d273a5a560ad1adc3284e00e12

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\2Mt9071.exe

Filesize
1.4MB

MD5
d834de07b4d3f4e6c284db567326c647

SHA1
82ed90c51a2534f08323df52443b11cc95dcde25

SHA256
e40034516cca93d847b463c26d03b63974d22dab6729d2ad625c684dc1ef1d7e

SHA512
52b469b55ed929381f27ec4f2b33772a0199bb3a1d3cd794ef7b09ffa7b6aa8780c8483dd3265f7ba08ebe2a6e34b6a5dd1b4a9f8f822b6261f9fca81ba76452

Download Submit
memory/2432-47-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/2432-50-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/2432-48-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/2432-46-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/3844-26-0x0000000004AD0000-0x0000000004AE6000-memory.dmp

Filesize
88KB

Download
memory/3844-20-0x0000000004AD0000-0x0000000004AE6000-memory.dmp

Filesize
88KB

Download
memory/3844-38-0x0000000004AD0000-0x0000000004AE6000-memory.dmp

Filesize
88KB

Download
memory/3844-37-0x0000000004AD0000-0x0000000004AE6000-memory.dmp

Filesize
88KB

Download
memory/3844-34-0x0000000004AD0000-0x0000000004AE6000-memory.dmp

Filesize
88KB

Download
memory/3844-32-0x0000000004AD0000-0x0000000004AE6000-memory.dmp

Filesize
88KB

Download
memory/3844-30-0x0000000004AD0000-0x0000000004AE6000-memory.dmp

Filesize
88KB

Download
memory/3844-28-0x0000000004AD0000-0x0000000004AE6000-memory.dmp

Filesize
88KB

Download
memory/3844-12-0x00000000747B0000-0x0000000074F60000-memory.dmp

Filesize
7.7MB

Download
memory/3844-24-0x0000000004AD0000-0x0000000004AE6000-memory.dmp

Filesize
88KB

Download
memory/3844-22-0x0000000004AD0000-0x0000000004AE6000-memory.dmp

Filesize
88KB

Download
memory/3844-40-0x0000000004AD0000-0x0000000004AE6000-memory.dmp

Filesize
88KB

Download
memory/3844-18-0x0000000004AD0000-0x0000000004AE6000-memory.dmp

Filesize
88KB

Download
memory/3844-16-0x0000000004AD0000-0x0000000004AE6000-memory.dmp

Filesize
88KB

Download
memory/3844-14-0x0000000004AD0000-0x0000000004AE6000-memory.dmp

Filesize
88KB

Download
memory/3844-13-0x0000000004AD0000-0x0000000004AE6000-memory.dmp

Filesize
88KB

Download
memory/3844-42-0x00000000747B0000-0x0000000074F60000-memory.dmp

Filesize
7.7MB

Download
memory/3844-10-0x0000000004BA0000-0x0000000005144000-memory.dmp

Filesize
5.6MB

Download
memory/3844-11-0x0000000004AD0000-0x0000000004AEC000-memory.dmp

Filesize
112KB

Download
memory/3844-9-0x00000000747B0000-0x0000000074F60000-memory.dmp

Filesize
7.7MB

Download
memory/3844-8-0x00000000023F0000-0x000000000240E000-memory.dmp

Filesize
120KB

Download
memory/3844-7-0x00000000747BE000-0x00000000747BF000-memory.dmp

Filesize
4KB

Download