mystic | dd599a6bab1a1dabfa1fca35b3aa571004102301666e21fec5316076b068ab55

Analysis

max time kernel
134s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
24/05/2024, 10:18

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2692caca2a880cb62bad959791f7e78945d5e600364901df7fc8de45a268a520.exe
Size 479KB
Sample240524-mb2gdade3y
SHA256 2692caca2a880cb62bad959791f7e78945d5e600364901df7fc8de45a268a520
MD5 d499e2f474c8e4d29c388869829a7596
SHA1 4fa5039317f8eccfcf961c7185e64e01623a73ce
SHA512 be84929c9b98f3a7158666e2df339f10552c32978eecd8382f36f9b142343f1db69318a35f0862da19258379bbf71ba99f03c81a2542612d63ab04cddd96d535
SSDEEP 12288:LMrZy90Id12LTOXvJRUZDstpVEbwgRnO54pnqLRr:iyoTOXvK0pOlRhnqFr
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

mystic evasion persistence stealer trojan

Malware Config

Signatures

Detect Mystic stealer payload 4 IoCs

resource	yara_rule
behavioral3/memory/4368-46-0x0000000000400000-0x0000000000433000-memory.dmp	mystic_family
behavioral3/memory/4368-50-0x0000000000400000-0x0000000000433000-memory.dmp	mystic_family
behavioral3/memory/4368-49-0x0000000000400000-0x0000000000433000-memory.dmp	mystic_family
behavioral3/memory/4368-47-0x0000000000400000-0x0000000000433000-memory.dmp	mystic_family

Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs

evasion trojan

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection	1Ec34gC5.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	1Ec34gC5.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	1Ec34gC5.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	1Ec34gC5.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	1Ec34gC5.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	1Ec34gC5.exe

Mystic
Mystic is an infostealer written in C++.
stealer mystic

Executes dropped EXE 2 IoCs

pid	Process
2372	1Ec34gC5.exe
1296	2LI1862.exe

Windows security modification 2 TTPs 2 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features	1Ec34gC5.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0"	1Ec34gC5.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	2692caca2a880cb62bad959791f7e78945d5e600364901df7fc8de45a268a520.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1296 set thread context of 4368	1296	2LI1862.exe	96

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4848	1296	WerFault.exe	95

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2372	1Ec34gC5.exe
2372	1Ec34gC5.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2372	1Ec34gC5.exe

Suspicious use of WriteProcessMemory 16 IoCs

description	pid	Process	procid_target
PID 64 wrote to memory of 2372	64	2692caca2a880cb62bad959791f7e78945d5e600364901df7fc8de45a268a520.exe	85
PID 64 wrote to memory of 2372	64	2692caca2a880cb62bad959791f7e78945d5e600364901df7fc8de45a268a520.exe	85
PID 64 wrote to memory of 2372	64	2692caca2a880cb62bad959791f7e78945d5e600364901df7fc8de45a268a520.exe	85
PID 64 wrote to memory of 1296	64	2692caca2a880cb62bad959791f7e78945d5e600364901df7fc8de45a268a520.exe	95
PID 64 wrote to memory of 1296	64	2692caca2a880cb62bad959791f7e78945d5e600364901df7fc8de45a268a520.exe	95
PID 64 wrote to memory of 1296	64	2692caca2a880cb62bad959791f7e78945d5e600364901df7fc8de45a268a520.exe	95
PID 1296 wrote to memory of 4368	1296	2LI1862.exe	96
PID 1296 wrote to memory of 4368	1296	2LI1862.exe	96
PID 1296 wrote to memory of 4368	1296	2LI1862.exe	96
PID 1296 wrote to memory of 4368	1296	2LI1862.exe	96
PID 1296 wrote to memory of 4368	1296	2LI1862.exe	96
PID 1296 wrote to memory of 4368	1296	2LI1862.exe	96
PID 1296 wrote to memory of 4368	1296	2LI1862.exe	96
PID 1296 wrote to memory of 4368	1296	2LI1862.exe	96
PID 1296 wrote to memory of 4368	1296	2LI1862.exe	96
PID 1296 wrote to memory of 4368	1296	2LI1862.exe	96

C:\Users\Admin\AppData\Local\Temp\2692caca2a880cb62bad959791f7e78945d5e600364901df7fc8de45a268a520.exe
"C:\Users\Admin\AppData\Local\Temp\2692caca2a880cb62bad959791f7e78945d5e600364901df7fc8de45a268a520.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:64
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\1Ec34gC5.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\1Ec34gC5.exe
  2⤵
  - Modifies Windows Defender Real-time Protection settings
  - Executes dropped EXE
  - Windows security modification
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2372
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\2LI1862.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\2LI1862.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - Suspicious use of WriteProcessMemory
  PID:1296
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
    3⤵
    PID:4368
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1296 -s 576
    3⤵
    - Program crash
    PID:4848

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 1296 -ip 1296
1⤵
PID:4992

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

1Ec34gC5.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\1Ec34gC5.exe
Size 194KB
SHA256 97e62bfa90aca06c595fb150e36f56b4a285f58cc072b8c458ae79805523fc36
MD5 35d718538c3e1346cb4fcf54aaa0f141
SHA1 234c0aa0465c27c190a83936e8e3aa3c4b991224
SHA512 4bcf5cabe93ec54608ccb95d80822f411bb32c2746be609873a493045913fb53e0a953e75f82dfe620d661f049437da7a70d34995dc915bb0b09426e97f0aec3
SSDEEP 3072:0DKW1LgppLRHMY0TBfJvjcTp5XYtzgXbxrf5Qfp16I8hW7xs:0DKW1Lgbdl0TBBvjc/82tf5QBtS
MD5 SHA1 SHA512 SSDEEP

Submit Download

2LI1862.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\2LI1862.exe
Size 423KB
SHA256 33cbe5d3e41e3e6bfe263da0b16e33b8b1addaaa27f60ba2abf13aa54dd9a209
MD5 ad7f69fd4ff4bf4fc9d9baf07d5cb25a
SHA1 d2258f2dced5633f822e85105fbec7143246a4a5
SHA512 d5d9e74568139d24f318ae3e4d71cad5de22827a1da8d2fb5c4d113d342e35d82cf9b22ded26270f9ccbcf750b05f3de8f515433cdc2715faed520f155d0ee4a
SSDEEP 6144:tDufpu01XFBvaKAwQtdsJlfpoCJAOf8hTOoo1gD60zkiRGig4M3+7SVAQrlS:tDuxf1XFBC2JQCJKhugm0QiRGD49MrlS
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/2372-26-0x0000000002510000-0x0000000002526000-memory.dmp

Download

memory/2372-13-0x0000000002510000-0x0000000002526000-memory.dmp

Download

memory/2372-11-0x0000000002510000-0x000000000252C000-memory.dmp

Download

memory/2372-10-0x0000000004980000-0x0000000004F24000-memory.dmp

Download

memory/2372-12-0x00000000745C0000-0x0000000074D70000-memory.dmp

Download

memory/2372-40-0x0000000002510000-0x0000000002526000-memory.dmp

Download

memory/2372-38-0x0000000002510000-0x0000000002526000-memory.dmp

Download

memory/2372-36-0x0000000002510000-0x0000000002526000-memory.dmp

Download

memory/2372-34-0x0000000002510000-0x0000000002526000-memory.dmp

Download

memory/2372-32-0x0000000002510000-0x0000000002526000-memory.dmp

Download

memory/2372-30-0x0000000002510000-0x0000000002526000-memory.dmp

Download

memory/2372-28-0x0000000002510000-0x0000000002526000-memory.dmp

Download

memory/2372-9-0x00000000745C0000-0x0000000074D70000-memory.dmp

Download

memory/2372-24-0x0000000002510000-0x0000000002526000-memory.dmp

Download

memory/2372-14-0x0000000002510000-0x0000000002526000-memory.dmp

Download

memory/2372-20-0x0000000002510000-0x0000000002526000-memory.dmp

Download

memory/2372-18-0x0000000002510000-0x0000000002526000-memory.dmp

Download

memory/2372-16-0x0000000002510000-0x0000000002526000-memory.dmp

Download

memory/2372-22-0x0000000002510000-0x0000000002526000-memory.dmp

Download

memory/2372-8-0x0000000002470000-0x000000000248E000-memory.dmp

Download

memory/2372-42-0x00000000745C0000-0x0000000074D70000-memory.dmp

Download

memory/2372-7-0x00000000745CE000-0x00000000745CF000-memory.dmp

Download

memory/4368-46-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/4368-50-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/4368-49-0x0000000000400000-0x0000000000433000-memory.dmp

Download

memory/4368-47-0x0000000000400000-0x0000000000433000-memory.dmp

Download