mystic | bd5cb5ed04f67f5a6f2f5411e9ad5c457c0c3e3bf3a38e4996624bdfba01d98d

Analysis

max time kernel
129s
max time network
137s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
24/05/2024, 07:42

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d3f2262a94435b8347df3ab935ed8eca2004e7db1ebf5da5384c7f7fe78efe31.exe
Size

628KB
MD5

6340ed1fce00bcbde6403d9959542a3a
SHA1

f3388f75be6c3ae8a42145035d0d9167752d0fb4
SHA256

d3f2262a94435b8347df3ab935ed8eca2004e7db1ebf5da5384c7f7fe78efe31
SHA512

86198d3184b33172adb74875dd5159c90fe51a83604b58ed9d150dff96757abb1dd4f45fd7076cf91e04fc2cb25bf1534af754521a47e1fd64fc1cc278c17a7d
SSDEEP

12288:tMrQy90kQIiE3Zs19zg/ShSbDoHH/ECPK46mb:RyIIiamvzUGSbMH8IX6mb

Score

10^/10

mystic smokeloader backdoor persistence stealer trojan

Malware Config

Signatures

Detect Mystic stealer payload 3 IoCs

resource	yara_rule
behavioral18/memory/5000-30-0x0000000000400000-0x0000000000432000-memory.dmp	mystic_family
behavioral18/memory/5000-28-0x0000000000400000-0x0000000000432000-memory.dmp	mystic_family
behavioral18/memory/5000-27-0x0000000000400000-0x0000000000432000-memory.dmp	mystic_family

Mystic
Mystic is an infostealer written in C++.
stealer mystic
SmokeLoader
Modular backdoor trojan in use since 2014.
trojan backdoor smokeloader

.NET Reactor proctector 2 IoCs

Detects an executable protected by an unregistered version of Eziriz's .NET Reactor.

resource	yara_rule
behavioral18/memory/464-20-0x0000000002C30000-0x0000000002C50000-memory.dmp	net_reactor
behavioral18/memory/464-22-0x00000000052D0000-0x00000000052EE000-memory.dmp	net_reactor

Executes dropped EXE 4 IoCs

pid	Process
752	Ir7Fp32.exe
3308	1Kk43lc3.exe
2008	2qh0304.exe
920	3wW07DC.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	d3f2262a94435b8347df3ab935ed8eca2004e7db1ebf5da5384c7f7fe78efe31.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	Ir7Fp32.exe

Suspicious use of SetThreadContext 3 IoCs

description	pid	Process	procid_target
PID 3308 set thread context of 464	3308	1Kk43lc3.exe	97
PID 2008 set thread context of 5000	2008	2qh0304.exe	104
PID 920 set thread context of 2708	920	3wW07DC.exe	109

Program crash 3 IoCs

pid	pid_target	Process	procid_target
3352	3308	WerFault.exe	86
2128	2008	WerFault.exe	102
2776	920	WerFault.exe	107

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	AppLaunch.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	AppLaunch.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	AppLaunch.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	464	AppLaunch.exe

Suspicious use of WriteProcessMemory 37 IoCs

description	pid	Process	procid_target
PID 2168 wrote to memory of 752	2168	d3f2262a94435b8347df3ab935ed8eca2004e7db1ebf5da5384c7f7fe78efe31.exe	85
PID 2168 wrote to memory of 752	2168	d3f2262a94435b8347df3ab935ed8eca2004e7db1ebf5da5384c7f7fe78efe31.exe	85
PID 2168 wrote to memory of 752	2168	d3f2262a94435b8347df3ab935ed8eca2004e7db1ebf5da5384c7f7fe78efe31.exe	85
PID 752 wrote to memory of 3308	752	Ir7Fp32.exe	86
PID 752 wrote to memory of 3308	752	Ir7Fp32.exe	86
PID 752 wrote to memory of 3308	752	Ir7Fp32.exe	86
PID 3308 wrote to memory of 464	3308	1Kk43lc3.exe	97
PID 3308 wrote to memory of 464	3308	1Kk43lc3.exe	97
PID 3308 wrote to memory of 464	3308	1Kk43lc3.exe	97
PID 3308 wrote to memory of 464	3308	1Kk43lc3.exe	97
PID 3308 wrote to memory of 464	3308	1Kk43lc3.exe	97
PID 3308 wrote to memory of 464	3308	1Kk43lc3.exe	97
PID 3308 wrote to memory of 464	3308	1Kk43lc3.exe	97
PID 3308 wrote to memory of 464	3308	1Kk43lc3.exe	97
PID 3308 wrote to memory of 464	3308	1Kk43lc3.exe	97
PID 752 wrote to memory of 2008	752	Ir7Fp32.exe	102
PID 752 wrote to memory of 2008	752	Ir7Fp32.exe	102
PID 752 wrote to memory of 2008	752	Ir7Fp32.exe	102
PID 2008 wrote to memory of 5000	2008	2qh0304.exe	104
PID 2008 wrote to memory of 5000	2008	2qh0304.exe	104
PID 2008 wrote to memory of 5000	2008	2qh0304.exe	104
PID 2008 wrote to memory of 5000	2008	2qh0304.exe	104
PID 2008 wrote to memory of 5000	2008	2qh0304.exe	104
PID 2008 wrote to memory of 5000	2008	2qh0304.exe	104
PID 2008 wrote to memory of 5000	2008	2qh0304.exe	104
PID 2008 wrote to memory of 5000	2008	2qh0304.exe	104
PID 2008 wrote to memory of 5000	2008	2qh0304.exe	104
PID 2008 wrote to memory of 5000	2008	2qh0304.exe	104
PID 2168 wrote to memory of 920	2168	d3f2262a94435b8347df3ab935ed8eca2004e7db1ebf5da5384c7f7fe78efe31.exe	107
PID 2168 wrote to memory of 920	2168	d3f2262a94435b8347df3ab935ed8eca2004e7db1ebf5da5384c7f7fe78efe31.exe	107
PID 2168 wrote to memory of 920	2168	d3f2262a94435b8347df3ab935ed8eca2004e7db1ebf5da5384c7f7fe78efe31.exe	107
PID 920 wrote to memory of 2708	920	3wW07DC.exe	109
PID 920 wrote to memory of 2708	920	3wW07DC.exe	109
PID 920 wrote to memory of 2708	920	3wW07DC.exe	109
PID 920 wrote to memory of 2708	920	3wW07DC.exe	109
PID 920 wrote to memory of 2708	920	3wW07DC.exe	109
PID 920 wrote to memory of 2708	920	3wW07DC.exe	109

C:\Users\Admin\AppData\Local\Temp\d3f2262a94435b8347df3ab935ed8eca2004e7db1ebf5da5384c7f7fe78efe31.exe
"C:\Users\Admin\AppData\Local\Temp\d3f2262a94435b8347df3ab935ed8eca2004e7db1ebf5da5384c7f7fe78efe31.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2168
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Ir7Fp32.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Ir7Fp32.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:752
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\1Kk43lc3.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\1Kk43lc3.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - Suspicious use of WriteProcessMemory
    PID:3308
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:464
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3308 -s 556
      4⤵
      Program crash
      PID:3352
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\2qh0304.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\2qh0304.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - Suspicious use of WriteProcessMemory
    PID:2008
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
      4⤵
      PID:5000
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2008 -s 152
      4⤵
      Program crash
      PID:2128
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\3wW07DC.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\3wW07DC.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - Suspicious use of WriteProcessMemory
  PID:920
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
    3⤵
    - Checks SCSI registry key(s)
    PID:2708
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 920 -s 148
    3⤵
    - Program crash
    PID:2776

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 3308 -ip 3308
1⤵
PID:8

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 488 -p 2008 -ip 2008
1⤵
PID:4436

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 920 -ip 920
1⤵
PID:3996

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\3wW07DC.exe

Filesize
145KB

MD5
2e2abe3c6a4b20808050d8571eb68672

SHA1
821f83eec008da00652d83f3453475992053434e

SHA256
fb8610ee8cb2f5f8768118786ad3440fb43a42e4a702fa5497f6f0fca2613b4a

SHA512
ea02d8ed93a34453f68ec61c00c305f4148ef59be4bbaea815862d38d8869714edad1ad61c8945ca1ab807c4a80f177747d0fba6ad5089f91bdcd42e7be3e6e0

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Ir7Fp32.exe

Filesize
444KB

MD5
e7c020b364e7d0c94bf02eb907759afa

SHA1
f22b1826edd65e10d19543154ef20223014959da

SHA256
79b4336019b89d2c06ccaf936af57e5d94d86758a39ebea0d9e6abd857a24f91

SHA512
c8989337afd18dc17d9533eebe810c0650e97c39d1a057642fc78fd7934ef082e12570b8c0fec52e4435be221671eca6baa3c50a04f05abff43b2ba0abfea82c

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\1Kk43lc3.exe

Filesize
306KB

MD5
cffbf89be9b8ebbba9a11ea60f0be22e

SHA1
86269fe003ca2411781daf149ea2d8b91503c663

SHA256
824399351186817a2c12df4e401bcae384ce66add003c01e4a3a8e25e48b7b62

SHA512
3690bdca96918ae9ed0baa7d564d0edbdc83ec996c126ff3fb88a160046b14b1de22043fc39e8bdb25f6d96f5cc866ebf58afe30506ba502dfa83a8a5ae4a273

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\2qh0304.exe

Filesize
295KB

MD5
12036ab86b223897ef2855b2529cd36e

SHA1
c07528b08964c6ef50001fa4546c0a6536ba2c5b

SHA256
6fe508924f6064a34f0b10965fd868eced8b1ec47f5497f94eb6cfcdd75e4ece

SHA512
1f5027e150edca3f869fba4692ea6eee9d3cf2119481c54f2912b1fbea6dd05c110fd15bdb9e392c3f5c39f4e2fa49775002c9a9c40b905da63dca57aa1618f4

Download Submit
memory/464-21-0x0000000005880000-0x0000000005E24000-memory.dmp

Filesize
5.6MB

Download
memory/464-15-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/464-19-0x00000000747CE000-0x00000000747CF000-memory.dmp

Filesize
4KB

Download
memory/464-20-0x0000000002C30000-0x0000000002C50000-memory.dmp

Filesize
128KB

Download
memory/464-16-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/464-22-0x00000000052D0000-0x00000000052EE000-memory.dmp

Filesize
120KB

Download
memory/464-23-0x0000000005490000-0x0000000005522000-memory.dmp

Filesize
584KB

Download
memory/464-18-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/464-14-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2708-34-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/5000-30-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/5000-28-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/5000-27-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads