mystic | cc5e37d73955fc0316a074c4b20f0296dee40952f8d275b2c6c6eb4eb0947059

Analysis

max time kernel
137s
max time network
106s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
24-05-2024 05:30

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

da85318c86e347642de41ee65fd6363813b5e0b29587b390f0258c819f35ec60.exe
Size

479KB
MD5

a36f65f317ac41f8fd835d9472e54596
SHA1

0770f7e17bee482e980bde6157d36ab6612eafa5
SHA256

da85318c86e347642de41ee65fd6363813b5e0b29587b390f0258c819f35ec60
SHA512

8dbfcc1b252a305f435b289ba4433e3c6c6256a8bfe99b73e1b323270c174885ad6ed3917607b1fc81573f79ce6e07ed7bb91dbae1d693ed9a04d948d58eb32d
SSDEEP

12288:QMr5y90ud12LTOXvHR3swsWf4yLlnzmXJ:5yeTOXvHRLsWQ4lnzA

Score

10^/10

mystic evasion persistence stealer trojan

Malware Config

Signatures

Detect Mystic stealer payload 4 IoCs

resource	yara_rule
behavioral16/memory/2372-46-0x0000000000400000-0x0000000000433000-memory.dmp	mystic_family
behavioral16/memory/2372-48-0x0000000000400000-0x0000000000433000-memory.dmp	mystic_family
behavioral16/memory/2372-50-0x0000000000400000-0x0000000000433000-memory.dmp	mystic_family
behavioral16/memory/2372-47-0x0000000000400000-0x0000000000433000-memory.dmp	mystic_family

Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs

evasion trojan

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection	1iL26jR8.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	1iL26jR8.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	1iL26jR8.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	1iL26jR8.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	1iL26jR8.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	1iL26jR8.exe

Mystic
Mystic is an infostealer written in C++.
stealer mystic

Executes dropped EXE 2 IoCs

pid	Process
2448	1iL26jR8.exe
1920	2wR4164.exe

Windows security modification 2 TTPs 2 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0"	1iL26jR8.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features	1iL26jR8.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	da85318c86e347642de41ee65fd6363813b5e0b29587b390f0258c819f35ec60.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1920 set thread context of 2372	1920	2wR4164.exe	98

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4296	1920	WerFault.exe	97

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2448	1iL26jR8.exe
2448	1iL26jR8.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2448	1iL26jR8.exe

Suspicious use of WriteProcessMemory 16 IoCs

description	pid	Process	procid_target
PID 4060 wrote to memory of 2448	4060	da85318c86e347642de41ee65fd6363813b5e0b29587b390f0258c819f35ec60.exe	83
PID 4060 wrote to memory of 2448	4060	da85318c86e347642de41ee65fd6363813b5e0b29587b390f0258c819f35ec60.exe	83
PID 4060 wrote to memory of 2448	4060	da85318c86e347642de41ee65fd6363813b5e0b29587b390f0258c819f35ec60.exe	83
PID 4060 wrote to memory of 1920	4060	da85318c86e347642de41ee65fd6363813b5e0b29587b390f0258c819f35ec60.exe	97
PID 4060 wrote to memory of 1920	4060	da85318c86e347642de41ee65fd6363813b5e0b29587b390f0258c819f35ec60.exe	97
PID 4060 wrote to memory of 1920	4060	da85318c86e347642de41ee65fd6363813b5e0b29587b390f0258c819f35ec60.exe	97
PID 1920 wrote to memory of 2372	1920	2wR4164.exe	98
PID 1920 wrote to memory of 2372	1920	2wR4164.exe	98
PID 1920 wrote to memory of 2372	1920	2wR4164.exe	98
PID 1920 wrote to memory of 2372	1920	2wR4164.exe	98
PID 1920 wrote to memory of 2372	1920	2wR4164.exe	98
PID 1920 wrote to memory of 2372	1920	2wR4164.exe	98
PID 1920 wrote to memory of 2372	1920	2wR4164.exe	98
PID 1920 wrote to memory of 2372	1920	2wR4164.exe	98
PID 1920 wrote to memory of 2372	1920	2wR4164.exe	98
PID 1920 wrote to memory of 2372	1920	2wR4164.exe	98

C:\Users\Admin\AppData\Local\Temp\da85318c86e347642de41ee65fd6363813b5e0b29587b390f0258c819f35ec60.exe
"C:\Users\Admin\AppData\Local\Temp\da85318c86e347642de41ee65fd6363813b5e0b29587b390f0258c819f35ec60.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4060
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\1iL26jR8.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\1iL26jR8.exe
  2⤵
  - Modifies Windows Defender Real-time Protection settings
  - Executes dropped EXE
  - Windows security modification
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2448
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\2wR4164.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\2wR4164.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - Suspicious use of WriteProcessMemory
  PID:1920
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
    3⤵
    PID:2372
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1920 -s 576
    3⤵
    - Program crash
    PID:4296

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 1920 -ip 1920
1⤵
PID:2104

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\1iL26jR8.exe

Filesize
194KB

MD5
35d718538c3e1346cb4fcf54aaa0f141

SHA1
234c0aa0465c27c190a83936e8e3aa3c4b991224

SHA256
97e62bfa90aca06c595fb150e36f56b4a285f58cc072b8c458ae79805523fc36

SHA512
4bcf5cabe93ec54608ccb95d80822f411bb32c2746be609873a493045913fb53e0a953e75f82dfe620d661f049437da7a70d34995dc915bb0b09426e97f0aec3

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\2wR4164.exe

Filesize
423KB

MD5
4c2bad1fd96c888ce1fe27e206e3f656

SHA1
9daab8534f7de7bb43472fc9c9672da31567fa0e

SHA256
e6f399a2b4b56b0bd7a9402e01ff13554fbae7195df6ec1e6faeafdc04f72537

SHA512
7174cba5194c8ea273d0ff3dce0a426eecb0ac86b4ad8defb1b5f29ad33f9f55a7fbb9d0ded82dfdcb2846963aabc8a23ad319568b6a379fdd27715fd4071976

Download Submit
memory/2372-47-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2372-50-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2372-48-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2372-46-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2448-25-0x00000000049A0000-0x00000000049B6000-memory.dmp

Filesize
88KB

Download
memory/2448-12-0x00000000049A0000-0x00000000049B6000-memory.dmp

Filesize
88KB

Download
memory/2448-39-0x00000000049A0000-0x00000000049B6000-memory.dmp

Filesize
88KB

Download
memory/2448-37-0x00000000049A0000-0x00000000049B6000-memory.dmp

Filesize
88KB

Download
memory/2448-35-0x00000000049A0000-0x00000000049B6000-memory.dmp

Filesize
88KB

Download
memory/2448-40-0x0000000073B70000-0x0000000074320000-memory.dmp

Filesize
7.7MB

Download
memory/2448-33-0x00000000049A0000-0x00000000049B6000-memory.dmp

Filesize
88KB

Download
memory/2448-27-0x00000000049A0000-0x00000000049B6000-memory.dmp

Filesize
88KB

Download
memory/2448-31-0x00000000049A0000-0x00000000049B6000-memory.dmp

Filesize
88KB

Download
memory/2448-23-0x00000000049A0000-0x00000000049B6000-memory.dmp

Filesize
88KB

Download
memory/2448-15-0x00000000049A0000-0x00000000049B6000-memory.dmp

Filesize
88KB

Download
memory/2448-29-0x00000000049A0000-0x00000000049B6000-memory.dmp

Filesize
88KB

Download
memory/2448-21-0x00000000049A0000-0x00000000049B6000-memory.dmp

Filesize
88KB

Download
memory/2448-19-0x00000000049A0000-0x00000000049B6000-memory.dmp

Filesize
88KB

Download
memory/2448-17-0x00000000049A0000-0x00000000049B6000-memory.dmp

Filesize
88KB

Download
memory/2448-13-0x00000000049A0000-0x00000000049B6000-memory.dmp

Filesize
88KB

Download
memory/2448-42-0x0000000073B70000-0x0000000074320000-memory.dmp

Filesize
7.7MB

Download
memory/2448-11-0x00000000049A0000-0x00000000049BC000-memory.dmp

Filesize
112KB

Download
memory/2448-10-0x0000000004A20000-0x0000000004FC4000-memory.dmp

Filesize
5.6MB

Download
memory/2448-9-0x0000000073B70000-0x0000000074320000-memory.dmp

Filesize
7.7MB

Download
memory/2448-8-0x00000000021A0000-0x00000000021BE000-memory.dmp

Filesize
120KB

Download
memory/2448-7-0x0000000073B7E000-0x0000000073B7F000-memory.dmp

Filesize
4KB

Download