mystic | b35fc9c6756f9c8e376445fea763834955cd88f728657d3ede36a5b063567acd

General

Target

df46912dec821ab1e3bba24bde4053d0N.exe
Size

574KB
MD5

df46912dec821ab1e3bba24bde4053d0
SHA1

6e48c6b70704e916803b887686be66d458c952bf
SHA256

b35fc9c6756f9c8e376445fea763834955cd88f728657d3ede36a5b063567acd
SHA512

6658f24b1d6e19cf1ea62689f47d5e86901c620071770c357de0e2ce1a76e85db9e3910c00e7e2edeab81e1043eade9955dae7f2396ad3875ffcd30ead4a0d6e
SSDEEP

12288:9MrSy90bPOw+DFYZrOQb2iDp0DfyO6Z9nuFMYDHluA8gQ:TyplD6ZyQb2iD2byOE2RDLG

Score

10^/10

mystic discovery evasion persistence stealer trojan

Malware Config

Signatures

Detect Mystic stealer payload 1 IoCs

resource	yara_rule
behavioral1/files/0x000700000002343e-9.dat	mystic_family

Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs

evasion trojan

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	AppLaunch.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	AppLaunch.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	AppLaunch.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	AppLaunch.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	AppLaunch.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection	AppLaunch.exe

Mystic
Mystic is an infostealer written in C++.
stealer mystic

Executes dropped EXE 2 IoCs

pid	Process
1436	1qj38tt0.exe
4992	2YE2409.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	df46912dec821ab1e3bba24bde4053d0N.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1436 set thread context of 5084	1436	1qj38tt0.exe	85

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2YE2409.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	df46912dec821ab1e3bba24bde4053d0N.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	1qj38tt0.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AppLaunch.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5084	AppLaunch.exe
5084	AppLaunch.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	5084	AppLaunch.exe

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 2992 wrote to memory of 1436	2992	df46912dec821ab1e3bba24bde4053d0N.exe	84
PID 2992 wrote to memory of 1436	2992	df46912dec821ab1e3bba24bde4053d0N.exe	84
PID 2992 wrote to memory of 1436	2992	df46912dec821ab1e3bba24bde4053d0N.exe	84
PID 1436 wrote to memory of 5084	1436	1qj38tt0.exe	85
PID 1436 wrote to memory of 5084	1436	1qj38tt0.exe	85
PID 1436 wrote to memory of 5084	1436	1qj38tt0.exe	85
PID 1436 wrote to memory of 5084	1436	1qj38tt0.exe	85
PID 1436 wrote to memory of 5084	1436	1qj38tt0.exe	85
PID 1436 wrote to memory of 5084	1436	1qj38tt0.exe	85
PID 1436 wrote to memory of 5084	1436	1qj38tt0.exe	85
PID 1436 wrote to memory of 5084	1436	1qj38tt0.exe	85
PID 2992 wrote to memory of 4992	2992	df46912dec821ab1e3bba24bde4053d0N.exe	86
PID 2992 wrote to memory of 4992	2992	df46912dec821ab1e3bba24bde4053d0N.exe	86
PID 2992 wrote to memory of 4992	2992	df46912dec821ab1e3bba24bde4053d0N.exe	86

C:\Users\Admin\AppData\Local\Temp\df46912dec821ab1e3bba24bde4053d0N.exe
"C:\Users\Admin\AppData\Local\Temp\df46912dec821ab1e3bba24bde4053d0N.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2992
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\1qj38tt0.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\1qj38tt0.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1436
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
    3⤵
    - Modifies Windows Defender Real-time Protection settings
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:5084
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\2YE2409.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\2YE2409.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4992

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Create or Modify System Process

1

T1543

Windows Service

1

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Create or Modify System Process

1

T1543

Windows Service

1

T1543.003

Defense Evasion

Impair Defenses

1

T1562

Disable or Modify Tools

Modify Registry

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\1qj38tt0.exe

Filesize
1.6MB

MD5
29e9546e7fe835b413a5d65599213b53

SHA1
64d6d2eca4e197a390702a08b074c5ef6da2fa32

SHA256
d65b10dc2c1598935786fd0d562aaee9c9fc6b7d6f950da6de13db6686cab814

SHA512
e556877abd79052f3d3bc6175971001531f363745d396aa96302218cf11b4fc94980f946aae758ff14d8cc8af4d9dcb26503142e2d1cded2d21ab37ddc009658

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\2YE2409.exe

Filesize
180KB

MD5
75a0425d12cb7d92e5a36d853e3a369c

SHA1
e6c6d171dd4f70dcf9377ca832e2dc7c0a4314f6

SHA256
e89d9809e8c20f7c2f97649cdc8669a63b087d9dd169a56e43de7148f2937d8d

SHA512
4c6926e4c286e17fa037d575a3f4ffd97ba63c2ee3433de29551ac2384625ed82e65fb14f0f8058a1de59d4e7c7714d468013f68862dbd4862854ace1bf96592

Download Submit
memory/5084-7-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/5084-11-0x0000000073C6E000-0x0000000073C6F000-memory.dmp

Filesize
4KB

Download
memory/5084-12-0x0000000073C6E000-0x0000000073C6F000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads