mystic | 47203fc7445c1e0e06643f363dd7d86ccc46b70ab234e5fbfe72badfdd6704ae

Analysis

max time kernel
131s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
24-05-2024 08:22

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b84e93b22256809e5241bcee59acc31b9865bdae579891d641826e1e159b15f7.exe
Size

744KB
MD5

bd482d8ccefbb511b7c14817c174619b
SHA1

23d0bd597726387f3efb5e5d7f1949250fa4f60e
SHA256

b84e93b22256809e5241bcee59acc31b9865bdae579891d641826e1e159b15f7
SHA512

07f6d45da2b34949c843dad1d125569ba9cc52601eaa3d45eee7c327aa058cb9a6ab2265509d1dbf59bc16e68860bf77313e0f04e015a86bc74f87a608207fbe
SSDEEP

12288:5Mrhy90qaiTvT1+x73gyrtJ1gMwJZnMiTc6ihgJBbFU2DaURZeS8aT:0y8irT1+xbgy/mhMW4ubFU2DFXe3aT

Score

10^/10

mystic smokeloader backdoor evasion persistence stealer trojan

Malware Config

Signatures

Detect Mystic stealer payload 3 IoCs

resource	yara_rule
behavioral14/memory/1876-53-0x0000000000400000-0x0000000000433000-memory.dmp	mystic_family
behavioral14/memory/1876-54-0x0000000000400000-0x0000000000433000-memory.dmp	mystic_family
behavioral14/memory/1876-56-0x0000000000400000-0x0000000000433000-memory.dmp	mystic_family

Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs

evasion trojan

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	1lr08VH4.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	1lr08VH4.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	1lr08VH4.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection	1lr08VH4.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	1lr08VH4.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	1lr08VH4.exe

Mystic
Mystic is an infostealer written in C++.
stealer mystic
SmokeLoader
Modular backdoor trojan in use since 2014.
trojan backdoor smokeloader

Executes dropped EXE 4 IoCs

pid	Process
3076	cu4nz73.exe
4904	1lr08VH4.exe
3148	2jp4899.exe
1168	3oD19qb.exe

Windows security modification 2 TTPs 2 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features	1lr08VH4.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0"	1lr08VH4.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	cu4nz73.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	b84e93b22256809e5241bcee59acc31b9865bdae579891d641826e1e159b15f7.exe

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 3148 set thread context of 1876	3148	2jp4899.exe	94
PID 1168 set thread context of 2164	1168	3oD19qb.exe	99

Program crash 2 IoCs

pid	pid_target	Process	procid_target
4144	3148	WerFault.exe	93
1280	1168	WerFault.exe	98

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	AppLaunch.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	AppLaunch.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	AppLaunch.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4904	1lr08VH4.exe
4904	1lr08VH4.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4904	1lr08VH4.exe

Suspicious use of WriteProcessMemory 28 IoCs

description	pid	Process	procid_target
PID 1596 wrote to memory of 3076	1596	b84e93b22256809e5241bcee59acc31b9865bdae579891d641826e1e159b15f7.exe	82
PID 1596 wrote to memory of 3076	1596	b84e93b22256809e5241bcee59acc31b9865bdae579891d641826e1e159b15f7.exe	82
PID 1596 wrote to memory of 3076	1596	b84e93b22256809e5241bcee59acc31b9865bdae579891d641826e1e159b15f7.exe	82
PID 3076 wrote to memory of 4904	3076	cu4nz73.exe	83
PID 3076 wrote to memory of 4904	3076	cu4nz73.exe	83
PID 3076 wrote to memory of 4904	3076	cu4nz73.exe	83
PID 3076 wrote to memory of 3148	3076	cu4nz73.exe	93
PID 3076 wrote to memory of 3148	3076	cu4nz73.exe	93
PID 3076 wrote to memory of 3148	3076	cu4nz73.exe	93
PID 3148 wrote to memory of 1876	3148	2jp4899.exe	94
PID 3148 wrote to memory of 1876	3148	2jp4899.exe	94
PID 3148 wrote to memory of 1876	3148	2jp4899.exe	94
PID 3148 wrote to memory of 1876	3148	2jp4899.exe	94
PID 3148 wrote to memory of 1876	3148	2jp4899.exe	94
PID 3148 wrote to memory of 1876	3148	2jp4899.exe	94
PID 3148 wrote to memory of 1876	3148	2jp4899.exe	94
PID 3148 wrote to memory of 1876	3148	2jp4899.exe	94
PID 3148 wrote to memory of 1876	3148	2jp4899.exe	94
PID 3148 wrote to memory of 1876	3148	2jp4899.exe	94
PID 1596 wrote to memory of 1168	1596	b84e93b22256809e5241bcee59acc31b9865bdae579891d641826e1e159b15f7.exe	98
PID 1596 wrote to memory of 1168	1596	b84e93b22256809e5241bcee59acc31b9865bdae579891d641826e1e159b15f7.exe	98
PID 1596 wrote to memory of 1168	1596	b84e93b22256809e5241bcee59acc31b9865bdae579891d641826e1e159b15f7.exe	98
PID 1168 wrote to memory of 2164	1168	3oD19qb.exe	99
PID 1168 wrote to memory of 2164	1168	3oD19qb.exe	99
PID 1168 wrote to memory of 2164	1168	3oD19qb.exe	99
PID 1168 wrote to memory of 2164	1168	3oD19qb.exe	99
PID 1168 wrote to memory of 2164	1168	3oD19qb.exe	99
PID 1168 wrote to memory of 2164	1168	3oD19qb.exe	99

C:\Users\Admin\AppData\Local\Temp\b84e93b22256809e5241bcee59acc31b9865bdae579891d641826e1e159b15f7.exe
"C:\Users\Admin\AppData\Local\Temp\b84e93b22256809e5241bcee59acc31b9865bdae579891d641826e1e159b15f7.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1596
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\cu4nz73.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\cu4nz73.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:3076
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\1lr08VH4.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\1lr08VH4.exe
    3⤵
    - Modifies Windows Defender Real-time Protection settings
    - Executes dropped EXE
    - Windows security modification
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4904
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\2jp4899.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\2jp4899.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - Suspicious use of WriteProcessMemory
    PID:3148
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
      4⤵
      PID:1876
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3148 -s 600
      4⤵
      Program crash
      PID:4144
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\3oD19qb.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\3oD19qb.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - Suspicious use of WriteProcessMemory
  PID:1168
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
    3⤵
    - Checks SCSI registry key(s)
    PID:2164
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1168 -s 580
    3⤵
    - Program crash
    PID:1280

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 3148 -ip 3148
1⤵
PID:3852

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 1168 -ip 1168
1⤵
PID:3156

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\3oD19qb.exe

Filesize
294KB

MD5
2a274ac1c009119ddadf4e90f30eb629

SHA1
ed5ba70232b13445bbba73019c9afa3bea53788e

SHA256
cd1587b74d94e87733c68f606d39d34898803dee9cb16aa87c0ce09b9c804b55

SHA512
aa474b94210aa40599541bc56795a509076920036a543fa0b140b7bae517d870c6d777cde5617c4731c1d1288ff6d80842a054832d03f6ba0946f82f3202ec0a

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\cu4nz73.exe

Filesize
493KB

MD5
56c9df7d6d0aad2e1d07719e953acffa

SHA1
72ef85c62a94e0977b7f9f5384ddef6f95a64e75

SHA256
27e38995cd3a28ba8ab2e254bfe5346fa672b5be55f3f0a3037683679b1867ac

SHA512
0b6ad9190b79f8e5aad03ba01a4ccb9fc11cff2c1a6e030694b89bc30f710914674f3610e7ce7c24b83b5af86c4a0f24a025c80d8b863b139e291d585f19a5aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\1lr08VH4.exe

Filesize
194KB

MD5
6241b03d68a610324ecda52f0f84e287

SHA1
da80280b6e3925e455925efd6c6e59a6118269c4

SHA256
ec74de9416b8ef2c3bdb1a9835e54548b3185524210d1aeffa91c98f74f751e2

SHA512
a60fe447cb0bed8e6cbd7c344b19a4602553209cbda7a40993f0fdf01e096bda4b79de0b528ecebf2efa0007f81d7bd6c7ef84252b2a160c93d642a78f0095f9

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\2jp4899.exe

Filesize
448KB

MD5
218046ecb246024529d46697c6016a0b

SHA1
3c19e905606b34e3242d0ed4c9e04e00bfe7fe13

SHA256
434b3313a82426766e5c6f1c0bb48cbc9fb59fd37949b0e11b639970bf9f1b40

SHA512
365ff6e93caf3cccf50743a5c053833552bd9bf5265afaf58a69d80dfdda6a6fad085ae305b16ec042c00a1595065eee64df5b525aec4d8b87b98a5c5033eba6

Download Submit
memory/1876-56-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1876-54-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1876-53-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2164-60-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/4904-30-0x0000000004AD0000-0x0000000004AE6000-memory.dmp

Filesize
88KB

Download
memory/4904-20-0x0000000004AD0000-0x0000000004AE6000-memory.dmp

Filesize
88KB

Download
memory/4904-42-0x0000000004AD0000-0x0000000004AE6000-memory.dmp

Filesize
88KB

Download
memory/4904-40-0x0000000004AD0000-0x0000000004AE6000-memory.dmp

Filesize
88KB

Download
memory/4904-34-0x0000000004AD0000-0x0000000004AE6000-memory.dmp

Filesize
88KB

Download
memory/4904-32-0x0000000004AD0000-0x0000000004AE6000-memory.dmp

Filesize
88KB

Download
memory/4904-46-0x0000000004AD0000-0x0000000004AE6000-memory.dmp

Filesize
88KB

Download
memory/4904-28-0x0000000004AD0000-0x0000000004AE6000-memory.dmp

Filesize
88KB

Download
memory/4904-26-0x0000000004AD0000-0x0000000004AE6000-memory.dmp

Filesize
88KB

Download
memory/4904-24-0x0000000004AD0000-0x0000000004AE6000-memory.dmp

Filesize
88KB

Download
memory/4904-22-0x0000000004AD0000-0x0000000004AE6000-memory.dmp

Filesize
88KB

Download
memory/4904-44-0x0000000004AD0000-0x0000000004AE6000-memory.dmp

Filesize
88KB

Download
memory/4904-19-0x0000000004AD0000-0x0000000004AE6000-memory.dmp

Filesize
88KB

Download
memory/4904-36-0x0000000004AD0000-0x0000000004AE6000-memory.dmp

Filesize
88KB

Download
memory/4904-47-0x00000000749E0000-0x0000000075190000-memory.dmp

Filesize
7.7MB

Download
memory/4904-49-0x00000000749E0000-0x0000000075190000-memory.dmp

Filesize
7.7MB

Download
memory/4904-38-0x0000000004AD0000-0x0000000004AE6000-memory.dmp

Filesize
88KB

Download
memory/4904-18-0x0000000004AD0000-0x0000000004AEC000-memory.dmp

Filesize
112KB

Download
memory/4904-16-0x00000000749E0000-0x0000000075190000-memory.dmp

Filesize
7.7MB

Download
memory/4904-17-0x0000000004B20000-0x00000000050C4000-memory.dmp

Filesize
5.6MB

Download
memory/4904-15-0x0000000002570000-0x000000000258E000-memory.dmp

Filesize
120KB

Download
memory/4904-14-0x00000000749EE000-0x00000000749EF000-memory.dmp

Filesize
4KB

Download