mystic | 5d1598dff77d699f14f54fe3ae5883303f205af0de34c20b849ed97ebffb8b3f

General

Target

c5b4be000540853873ff8618f1d63240N.exe
Size

721KB
MD5

c5b4be000540853873ff8618f1d63240
SHA1

7984ed651ede48bd6047b5bc81eaf161ae9fcaf3
SHA256

5d1598dff77d699f14f54fe3ae5883303f205af0de34c20b849ed97ebffb8b3f
SHA512

6ed683e33794b34e41921979d1289c4c320d0bd5cbf0a05e4ee4fee7080a83b3792efe126adbbc3d3c31e8aa3bc9eb7986d18c3f74c7226f1d991ddfca715fd5
SSDEEP

12288:wMrqy90W4DK2LgNmBy0yALGAUMIjeuewM3niAKvXlN2Tf3ZBW15Lhs949kTU:KyNCOTHAbhRjniAKv2TPLsLhs94x

Score

10^/10

mystic smokeloader backdoor discovery evasion persistence stealer trojan

Malware Config

Signatures

Detect Mystic stealer payload 1 IoCs

resource	yara_rule
behavioral1/files/0x000700000002345e-17.dat	mystic_family

Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs

evasion trojan

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	1QB12Uo3.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	1QB12Uo3.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	1QB12Uo3.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	1QB12Uo3.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	1QB12Uo3.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	1QB12Uo3.exe

Mystic
Mystic is an infostealer written in C++.
stealer mystic
SmokeLoader
Modular backdoor trojan in use since 2014.
trojan backdoor smokeloader

Executes dropped EXE 4 IoCs

pid	Process
436	IM7cD11.exe
1828	1QB12Uo3.exe
1844	2gR0614.exe
3616	3Mc44jp.exe

Windows security modification 2 TTPs 2 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features	1QB12Uo3.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0"	1QB12Uo3.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	c5b4be000540853873ff8618f1d63240N.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	IM7cD11.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3616 set thread context of 3708	3616	3Mc44jp.exe	97

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	c5b4be000540853873ff8618f1d63240N.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IM7cD11.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2gR0614.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	3Mc44jp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AppLaunch.exe

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	AppLaunch.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	AppLaunch.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	AppLaunch.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
1828	1QB12Uo3.exe
1828	1QB12Uo3.exe
1828	1QB12Uo3.exe
1828	1QB12Uo3.exe

Suspicious use of WriteProcessMemory 19 IoCs

description	pid	Process	procid_target
PID 3540 wrote to memory of 436	3540	c5b4be000540853873ff8618f1d63240N.exe	84
PID 3540 wrote to memory of 436	3540	c5b4be000540853873ff8618f1d63240N.exe	84
PID 3540 wrote to memory of 436	3540	c5b4be000540853873ff8618f1d63240N.exe	84
PID 436 wrote to memory of 1828	436	IM7cD11.exe	85
PID 436 wrote to memory of 1828	436	IM7cD11.exe	85
PID 5000 wrote to memory of 3180	5000	cmd.exe	92
PID 5000 wrote to memory of 3180	5000	cmd.exe	92
PID 436 wrote to memory of 1844	436	IM7cD11.exe	95
PID 436 wrote to memory of 1844	436	IM7cD11.exe	95
PID 436 wrote to memory of 1844	436	IM7cD11.exe	95
PID 3540 wrote to memory of 3616	3540	c5b4be000540853873ff8618f1d63240N.exe	96
PID 3540 wrote to memory of 3616	3540	c5b4be000540853873ff8618f1d63240N.exe	96
PID 3540 wrote to memory of 3616	3540	c5b4be000540853873ff8618f1d63240N.exe	96
PID 3616 wrote to memory of 3708	3616	3Mc44jp.exe	97
PID 3616 wrote to memory of 3708	3616	3Mc44jp.exe	97
PID 3616 wrote to memory of 3708	3616	3Mc44jp.exe	97
PID 3616 wrote to memory of 3708	3616	3Mc44jp.exe	97
PID 3616 wrote to memory of 3708	3616	3Mc44jp.exe	97
PID 3616 wrote to memory of 3708	3616	3Mc44jp.exe	97

C:\Users\Admin\AppData\Local\Temp\c5b4be000540853873ff8618f1d63240N.exe
"C:\Users\Admin\AppData\Local\Temp\c5b4be000540853873ff8618f1d63240N.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3540
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\IM7cD11.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\IM7cD11.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:436
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\1QB12Uo3.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\1QB12Uo3.exe
    3⤵
    - Modifies Windows Defender Real-time Protection settings
    - Executes dropped EXE
    - Windows security modification
    - Suspicious behavior: EnumeratesProcesses
    PID:1828
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\2gR0614.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\2gR0614.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:1844
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\3Mc44jp.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\3Mc44jp.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3616
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
    3⤵
    - System Location Discovery: System Language Discovery
    - Checks SCSI registry key(s)
    PID:3708

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c regini "C:\Users\Admin\AppData\Roaming\random_1724529764.txt"
1⤵
- Suspicious use of WriteProcessMemory
PID:5000
- C:\Windows\system32\regini.exe
  regini "C:\Users\Admin\AppData\Roaming\random_1724529764.txt"
  2⤵
  PID:3180

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Create or Modify System Process

1

T1543

Windows Service

1

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Create or Modify System Process

1

T1543

Windows Service

1

T1543.003

Defense Evasion

Impair Defenses

2

T1562

Disable or Modify Tools

Modify Registry

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\3Mc44jp.exe

Filesize
916KB

MD5
8ee5879d442b2bbe44bef5b2035493ed

SHA1
7168654a6fce389a691cc15e0cc5e0b3ce77e136

SHA256
888edc8072eb6498820e576e8fd8fa965d97c5522b2e6fd6da1b72e620155511

SHA512
8eef704239e14e0d87fd390c1d0deb0aa1cd89b49e9ce757741850dacee9a8e92bce3986bac70d98bd18f1204cfb09597d858e1f473564d020d38a798a2b7be5

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\IM7cD11.exe

Filesize
354KB

MD5
78e0b0745ee3adddd1d6ff1afe024656

SHA1
b6a8ec261bf2ac3f985848e5c1c402c709018dd5

SHA256
c65f04739e8cd280d3b2fd56993c7309f8e7254965780475110df34d0b0bec1c

SHA512
ae769d525bacb55b8312068e15fc477e49018b8fe0a42c38b4ef32ac9f274b2f74caf1f2a173dd3fa3120e4331e9de9f456908b881131868d6b47d04cb9d1071

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\1QB12Uo3.exe

Filesize
265KB

MD5
15fe972bcfd9189d826083838645b850

SHA1
d2bf7fee68e358fa71b942b8ae92e483536abf86

SHA256
ec739f26f487bcc65718bb8c28a5e3adf817a18e01952bd888f618a57c1e61d4

SHA512
30f7c8daa78ba9bb32d5dca56440fd9b1d36336f496521920ab41737787c1c8e0bcdd714b72249e0ab52908d7918afcaf9e0b3f5ba2a8a2888e9adb538810cfe

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\2gR0614.exe

Filesize
180KB

MD5
53e28e07671d832a65fbfe3aa38b6678

SHA1
6f9ea0ed8109030511c2c09c848f66bd0d16d1e1

SHA256
5c59db3277aefb761d4b814aaf5f5acd1fd1a0ea154dc565c78b082a3df4566e

SHA512
053f8048230583e741c34f6714c9684ed1312c064cd0c81d99f09e20192b7ddecb53c9c55e4aceac774315315be7e13de98f2cea4e5487f2d9e9dfa2ce3979c9

Download Submit
C:\Users\Admin\AppData\Roaming\random_1724529764.txt

Filesize
78B

MD5
2d245696c73134b0a9a2ac296ea7c170

SHA1
f234419d7a09920a46ad291b98d7dca5a11f0da8

SHA256
ed83e1f6850e48029654e9829cbf6e2cdff82f55f61d1449f822e448f75e8930

SHA512
af0b981ef20aa94aff080fbd2030556fe47c4cc563885b162e604f72bc70c4a0eee4ee57ce4ea8964e6363a32ba34f8bee933db30d3d61392c42299621a4fc79

Download Submit
memory/3708-22-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads