mystic | 07b63c04cd2b6532b892368ef2b393b6b02f9ba659265c6efb3f81a1ac5089f3

General

Target

07b63c04cd2b6532b892368ef2b393b6b02f9ba659265c6efb3f81a1ac5089f3.exe
Size

1.2MB
MD5

afa8c1e73c3d66f5e35b9bb18dfa371a
SHA1

f124b5815eeb0e8e5228a7e379ce78f38958d426
SHA256

07b63c04cd2b6532b892368ef2b393b6b02f9ba659265c6efb3f81a1ac5089f3
SHA512

60e493e10252161e7950e133a5432ef2f6c554711fd664f0ec2836601e2e659e7b19432e5ffcad4bf5299fd4678611fa209c6a497e39de1da38ffaaaa8a6acdf
SSDEEP

24576:a683nkpw/6Ds2B6yxBNkMsNkaWNJv+E5C6rEbl:aznkpVDs2nQM4kaWNJv+E5C6rEbl

Score

10^/10

mystic stealer

Detect Mystic stealer payload 7 IoCs

Processes:

resource	yara_rule
behavioral1/memory/2536-8-0x0000000000400000-0x0000000000433000-memory.dmp	mystic_family
behavioral1/memory/2536-9-0x0000000000400000-0x0000000000433000-memory.dmp	mystic_family
behavioral1/memory/2536-10-0x0000000000400000-0x0000000000433000-memory.dmp	mystic_family
behavioral1/memory/2536-12-0x0000000000400000-0x0000000000433000-memory.dmp	mystic_family
behavioral1/memory/2536-15-0x0000000000400000-0x0000000000433000-memory.dmp	mystic_family
behavioral1/memory/2536-16-0x0000000000400000-0x0000000000433000-memory.dmp	mystic_family
behavioral1/memory/2536-17-0x0000000000400000-0x0000000000433000-memory.dmp	mystic_family

Mystic
Mystic is an infostealer written in C++.
stealer mystic
Mystic family
mystic
Executes dropped EXE 1 IoCs

Processes:

㙢湗䕄穸癆坆䝶䘵

pid process

2536 㙢湗䕄穸癆坆䝶䘵

pid	process
2536	㙢湗䕄穸癆坆䝶䘵

Suspicious use of SetThreadContext 1 IoCs

Processes:

07b63c04cd2b6532b892368ef2b393b6b02f9ba659265c6efb3f81a1ac5089f3.exe

description	pid	process	target process
PID 1664 set thread context of 2536	1664	07b63c04cd2b6532b892368ef2b393b6b02f9ba659265c6efb3f81a1ac5089f3.exe	㙢湗䕄穸癆坆䝶䘵

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

07b63c04cd2b6532b892368ef2b393b6b02f9ba659265c6efb3f81a1ac5089f3.exe

description	pid	process	target process
PID 1664 wrote to memory of 2536	1664	07b63c04cd2b6532b892368ef2b393b6b02f9ba659265c6efb3f81a1ac5089f3.exe	㙢湗䕄穸癆坆䝶䘵
PID 1664 wrote to memory of 2536	1664	07b63c04cd2b6532b892368ef2b393b6b02f9ba659265c6efb3f81a1ac5089f3.exe	㙢湗䕄穸癆坆䝶䘵
PID 1664 wrote to memory of 2536	1664	07b63c04cd2b6532b892368ef2b393b6b02f9ba659265c6efb3f81a1ac5089f3.exe	㙢湗䕄穸癆坆䝶䘵
PID 1664 wrote to memory of 2536	1664	07b63c04cd2b6532b892368ef2b393b6b02f9ba659265c6efb3f81a1ac5089f3.exe	㙢湗䕄穸癆坆䝶䘵
PID 1664 wrote to memory of 2536	1664	07b63c04cd2b6532b892368ef2b393b6b02f9ba659265c6efb3f81a1ac5089f3.exe	㙢湗䕄穸癆坆䝶䘵
PID 1664 wrote to memory of 2536	1664	07b63c04cd2b6532b892368ef2b393b6b02f9ba659265c6efb3f81a1ac5089f3.exe	㙢湗䕄穸癆坆䝶䘵
PID 1664 wrote to memory of 2536	1664	07b63c04cd2b6532b892368ef2b393b6b02f9ba659265c6efb3f81a1ac5089f3.exe	㙢湗䕄穸癆坆䝶䘵
PID 1664 wrote to memory of 2536	1664	07b63c04cd2b6532b892368ef2b393b6b02f9ba659265c6efb3f81a1ac5089f3.exe	㙢湗䕄穸癆坆䝶䘵
PID 1664 wrote to memory of 2536	1664	07b63c04cd2b6532b892368ef2b393b6b02f9ba659265c6efb3f81a1ac5089f3.exe	㙢湗䕄穸癆坆䝶䘵
PID 1664 wrote to memory of 2536	1664	07b63c04cd2b6532b892368ef2b393b6b02f9ba659265c6efb3f81a1ac5089f3.exe	㙢湗䕄穸癆坆䝶䘵
PID 1664 wrote to memory of 2536	1664	07b63c04cd2b6532b892368ef2b393b6b02f9ba659265c6efb3f81a1ac5089f3.exe	㙢湗䕄穸癆坆䝶䘵

C:\Users\Admin\AppData\Local\Temp\㙢湗䕄穸癆坆䝶䘵
"C:\Users\Admin\AppData\Local\Temp\㙢湗䕄穸癆坆䝶䘵"
2⤵
- Executes dropped EXE
PID:2536

C:\Users\Admin\AppData\Local\Temp\㙢湗䕄穸癆坆䝶䘵

Filesize
38KB

MD5
3992f464696b0eeff236aef93b1fdbd5

SHA1
8dddabaea6b342efc4f5b244420a0af055ae691e

SHA256
0d1a8457014f2eb2563a91d1509dba38f6c418fedf5f241d8579d15a93e40e14

SHA512
27a63b43dc50faf4d9b06e10daa15e83dfb3f3be1bd3af83ea6990bd8ae6d3a6a7fc2f928822db972aaf1305970f4587d768d68cd7e1124bc8f710c1d3ee19a6

Download Submit
memory/1664-18-0x000000013FF30000-0x000000013FFEA000-memory.dmp

Filesize
744KB

Download
memory/2536-10-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2536-7-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2536-8-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2536-9-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2536-6-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2536-11-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2536-12-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2536-15-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2536-16-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2536-17-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2536-5-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download