mystic | eafc2bfbeaeddb89f86da75f29f14435b745b919f0b99dd1d0d30b9d33efb415

Analysis

max time kernel
149s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
24-05-2024 07:44

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

e2ca05276c37a88d337993eae49ec4ac99bf1c9f9e56112366021c7a649bf337.exe
Size

639KB
MD5

23b871d98adf8e627167bff2a2c43597
SHA1

fdf756924e8266a1f7c48e339dfd355fc20882cb
SHA256

e2ca05276c37a88d337993eae49ec4ac99bf1c9f9e56112366021c7a649bf337
SHA512

b93c4e78455e44886d501d8c4a27a0e958870e878765be46524ae1987472f3156eeea5e1a6b96adb26c186386a1ea4419ea19dc1ae6003077702e24932d9ca92
SSDEEP

12288:sMrCy90ZczjJFspR1UewQx2fM7Hbfozro8UcUo:OyPzbspvUC8MrbfoHNUcd

Score

10^/10

mystic smokeloader backdoor evasion persistence stealer trojan

Malware Config

Signatures

Detect Mystic stealer payload 3 IoCs

resource	yara_rule
behavioral18/memory/4996-19-0x0000000000400000-0x0000000000433000-memory.dmp	mystic_family
behavioral18/memory/4996-22-0x0000000000400000-0x0000000000433000-memory.dmp	mystic_family
behavioral18/memory/4996-20-0x0000000000400000-0x0000000000433000-memory.dmp	mystic_family

Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs

evasion trojan

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection	AppLaunch.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	AppLaunch.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	AppLaunch.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	AppLaunch.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	AppLaunch.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	AppLaunch.exe

Mystic
Mystic is an infostealer written in C++.
stealer mystic
SmokeLoader
Modular backdoor trojan in use since 2014.
trojan backdoor smokeloader

Executes dropped EXE 4 IoCs

pid	Process
2120	jj9PN00.exe
4596	1PA02lk4.exe
724	2mV3913.exe
5080	3zU16Qy.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	e2ca05276c37a88d337993eae49ec4ac99bf1c9f9e56112366021c7a649bf337.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	jj9PN00.exe

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 4596 set thread context of 1996	4596	1PA02lk4.exe	85
PID 724 set thread context of 4996	724	2mV3913.exe	88

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	3zU16Qy.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	3zU16Qy.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	3zU16Qy.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1996	AppLaunch.exe
1996	AppLaunch.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1996	AppLaunch.exe

Suspicious use of WriteProcessMemory 33 IoCs

description	pid	Process	procid_target
PID 1724 wrote to memory of 2120	1724	e2ca05276c37a88d337993eae49ec4ac99bf1c9f9e56112366021c7a649bf337.exe	83
PID 1724 wrote to memory of 2120	1724	e2ca05276c37a88d337993eae49ec4ac99bf1c9f9e56112366021c7a649bf337.exe	83
PID 1724 wrote to memory of 2120	1724	e2ca05276c37a88d337993eae49ec4ac99bf1c9f9e56112366021c7a649bf337.exe	83
PID 2120 wrote to memory of 4596	2120	jj9PN00.exe	84
PID 2120 wrote to memory of 4596	2120	jj9PN00.exe	84
PID 2120 wrote to memory of 4596	2120	jj9PN00.exe	84
PID 4596 wrote to memory of 1996	4596	1PA02lk4.exe	85
PID 4596 wrote to memory of 1996	4596	1PA02lk4.exe	85
PID 4596 wrote to memory of 1996	4596	1PA02lk4.exe	85
PID 4596 wrote to memory of 1996	4596	1PA02lk4.exe	85
PID 4596 wrote to memory of 1996	4596	1PA02lk4.exe	85
PID 4596 wrote to memory of 1996	4596	1PA02lk4.exe	85
PID 4596 wrote to memory of 1996	4596	1PA02lk4.exe	85
PID 4596 wrote to memory of 1996	4596	1PA02lk4.exe	85
PID 2120 wrote to memory of 724	2120	jj9PN00.exe	86
PID 2120 wrote to memory of 724	2120	jj9PN00.exe	86
PID 2120 wrote to memory of 724	2120	jj9PN00.exe	86
PID 724 wrote to memory of 3628	724	2mV3913.exe	87
PID 724 wrote to memory of 3628	724	2mV3913.exe	87
PID 724 wrote to memory of 3628	724	2mV3913.exe	87
PID 724 wrote to memory of 4996	724	2mV3913.exe	88
PID 724 wrote to memory of 4996	724	2mV3913.exe	88
PID 724 wrote to memory of 4996	724	2mV3913.exe	88
PID 724 wrote to memory of 4996	724	2mV3913.exe	88
PID 724 wrote to memory of 4996	724	2mV3913.exe	88
PID 724 wrote to memory of 4996	724	2mV3913.exe	88
PID 724 wrote to memory of 4996	724	2mV3913.exe	88
PID 724 wrote to memory of 4996	724	2mV3913.exe	88
PID 724 wrote to memory of 4996	724	2mV3913.exe	88
PID 724 wrote to memory of 4996	724	2mV3913.exe	88
PID 1724 wrote to memory of 5080	1724	e2ca05276c37a88d337993eae49ec4ac99bf1c9f9e56112366021c7a649bf337.exe	89
PID 1724 wrote to memory of 5080	1724	e2ca05276c37a88d337993eae49ec4ac99bf1c9f9e56112366021c7a649bf337.exe	89
PID 1724 wrote to memory of 5080	1724	e2ca05276c37a88d337993eae49ec4ac99bf1c9f9e56112366021c7a649bf337.exe	89

C:\Users\Admin\AppData\Local\Temp\e2ca05276c37a88d337993eae49ec4ac99bf1c9f9e56112366021c7a649bf337.exe
"C:\Users\Admin\AppData\Local\Temp\e2ca05276c37a88d337993eae49ec4ac99bf1c9f9e56112366021c7a649bf337.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1724
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\jj9PN00.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\jj9PN00.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:2120
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\1PA02lk4.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\1PA02lk4.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - Suspicious use of WriteProcessMemory
    PID:4596
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
      4⤵
      Modifies Windows Defender Real-time Protection settings
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:1996
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\2mV3913.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\2mV3913.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - Suspicious use of WriteProcessMemory
    PID:724
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
      4⤵
      PID:3628
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
      4⤵
      PID:4996
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\3zU16Qy.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\3zU16Qy.exe
  2⤵
  - Executes dropped EXE
  - Checks SCSI registry key(s)
  PID:5080

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\3zU16Qy.exe

Filesize
31KB

MD5
869809cd3b8b13f62f9587a8612381eb

SHA1
f7092abeeef9b83fd6be61e82ebc9b662910d3f0

SHA256
c13b0cc720e7b27279848e421b17a1f1daf0254625795ca9f4016c7feba78942

SHA512
2d74bd5c5a1d1336bbcc7c6dc45913a478930d0ed1c926ffa4280fd2e6d5a6ead4e7feb6f0d569353f73b606759ff1768216332cd0208ea848fdb2f256e6abe8

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\jj9PN00.exe

Filesize
514KB

MD5
6f6b8d7bd63ec46fa42bb15be0ca89fa

SHA1
37f12200c4a5699deea39cd0aa8415229aac81c4

SHA256
e0ea1ee575f207b9ea24fcf0c171430557837ea2cc69dd2cd8429f99f0049482

SHA512
ad0d5fd5f8fd1ca77af65c231f387d14bd3d02867673123908fc94b6fe7d65bffb3739ec68ba7d291e3a222e484ed897a67a26638b98a7a52f5d99b1092726b3

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\1PA02lk4.exe

Filesize
869KB

MD5
0fd9368f80b936f0752d82fc303cca52

SHA1
fda68a9989e3a3ace9475ec52e0d1258a4d4edd4

SHA256
814e2281d04aa73c4f60b2f5c67c6ee58854c25b6cc2b465bba03bbb6158c3a3

SHA512
e6cc10ab53a96e07dc62030fd7a0ce1aa23ba2c03d73b2a649f819fc56ac401b3873baeb17083d071757ffba57d4580a311f9fb423c012f9ff4c1da9e42645f6

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\2mV3913.exe

Filesize
1.0MB

MD5
de70b049a18518bf7a6e47b84c11104d

SHA1
97240f5a9f99832a5a7b24ad9c764a931174b20c

SHA256
82daec39720820c085e748fee986013b739024dccbcf00f55dbdbfc6b08553bc

SHA512
c0e0e3f6ccec8da7c61bbc63c16cefc01f4b50299c86300dd022a3a5abb0eb322d8ffd206244149dd15d0c7ffaa441b696d26ccdf75637cb0b016fdbfffbb431

Download Submit
memory/1996-14-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/1996-15-0x000000007434E000-0x000000007434F000-memory.dmp

Filesize
4KB

Download
memory/4996-19-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4996-22-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4996-20-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/5080-26-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/5080-27-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download