mystic | 0d5e1bd7d3c54885ed533d496d57e097c90543d889f71cbe40942055ec641a4e

General

Target

0d5e1bd7d3c54885ed533d496d57e097c90543d889f71cbe40942055ec641a4eN.exe
Size

1.1MB
MD5

405292c315ba0149e8c0751860a49d60
SHA1

76ec0c2d15e7433920c5d35981679cf648212069
SHA256

0d5e1bd7d3c54885ed533d496d57e097c90543d889f71cbe40942055ec641a4e
SHA512

a01065ae61be7685f2256927186b3491696959acb8a9675d03f2ddcb43d7df77d35f2a73f92750eee1875c701be5ec12b570fd630e9db56ee198abd1a07d635b
SSDEEP

12288:bH1QIzGx2dAfzwZa5uHXBQk0bvym1uRDm2e+WRNukiSA7WiCOu1YOWvE:TG2dAfzwZa5uHxa6m1eV89iCOEYOWM

Score

10^/10

Malware Config

Signatures

Detect Mystic stealer payload 6 IoCs

resource	yara_rule
behavioral1/memory/2380-9-0x0000000000400000-0x0000000000434000-memory.dmp	mystic_family
behavioral1/memory/2380-7-0x0000000000400000-0x0000000000434000-memory.dmp	mystic_family
behavioral1/memory/2380-5-0x0000000000400000-0x0000000000434000-memory.dmp	mystic_family
behavioral1/memory/2380-3-0x0000000000400000-0x0000000000434000-memory.dmp	mystic_family
behavioral1/memory/2380-4-0x0000000000400000-0x0000000000434000-memory.dmp	mystic_family
behavioral1/memory/2380-11-0x0000000000400000-0x0000000000434000-memory.dmp	mystic_family

Mystic
Mystic is an infostealer written in C++.
stealer mystic
Mystic family
mystic

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2100 set thread context of 2380	2100	0d5e1bd7d3c54885ed533d496d57e097c90543d889f71cbe40942055ec641a4eN.exe	30

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2720	2380	WerFault.exe	30

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	0d5e1bd7d3c54885ed533d496d57e097c90543d889f71cbe40942055ec641a4eN.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AppLaunch.exe

Suspicious use of WriteProcessMemory 21 IoCs

description	pid	Process	procid_target
PID 2100 wrote to memory of 2380	2100	0d5e1bd7d3c54885ed533d496d57e097c90543d889f71cbe40942055ec641a4eN.exe	30
PID 2100 wrote to memory of 2380	2100	0d5e1bd7d3c54885ed533d496d57e097c90543d889f71cbe40942055ec641a4eN.exe	30
PID 2100 wrote to memory of 2380	2100	0d5e1bd7d3c54885ed533d496d57e097c90543d889f71cbe40942055ec641a4eN.exe	30
PID 2100 wrote to memory of 2380	2100	0d5e1bd7d3c54885ed533d496d57e097c90543d889f71cbe40942055ec641a4eN.exe	30
PID 2100 wrote to memory of 2380	2100	0d5e1bd7d3c54885ed533d496d57e097c90543d889f71cbe40942055ec641a4eN.exe	30
PID 2100 wrote to memory of 2380	2100	0d5e1bd7d3c54885ed533d496d57e097c90543d889f71cbe40942055ec641a4eN.exe	30
PID 2100 wrote to memory of 2380	2100	0d5e1bd7d3c54885ed533d496d57e097c90543d889f71cbe40942055ec641a4eN.exe	30
PID 2100 wrote to memory of 2380	2100	0d5e1bd7d3c54885ed533d496d57e097c90543d889f71cbe40942055ec641a4eN.exe	30
PID 2100 wrote to memory of 2380	2100	0d5e1bd7d3c54885ed533d496d57e097c90543d889f71cbe40942055ec641a4eN.exe	30
PID 2100 wrote to memory of 2380	2100	0d5e1bd7d3c54885ed533d496d57e097c90543d889f71cbe40942055ec641a4eN.exe	30
PID 2100 wrote to memory of 2380	2100	0d5e1bd7d3c54885ed533d496d57e097c90543d889f71cbe40942055ec641a4eN.exe	30
PID 2100 wrote to memory of 2380	2100	0d5e1bd7d3c54885ed533d496d57e097c90543d889f71cbe40942055ec641a4eN.exe	30
PID 2100 wrote to memory of 2380	2100	0d5e1bd7d3c54885ed533d496d57e097c90543d889f71cbe40942055ec641a4eN.exe	30
PID 2100 wrote to memory of 2380	2100	0d5e1bd7d3c54885ed533d496d57e097c90543d889f71cbe40942055ec641a4eN.exe	30
PID 2380 wrote to memory of 2720	2380	AppLaunch.exe	31
PID 2380 wrote to memory of 2720	2380	AppLaunch.exe	31
PID 2380 wrote to memory of 2720	2380	AppLaunch.exe	31
PID 2380 wrote to memory of 2720	2380	AppLaunch.exe	31
PID 2380 wrote to memory of 2720	2380	AppLaunch.exe	31
PID 2380 wrote to memory of 2720	2380	AppLaunch.exe	31
PID 2380 wrote to memory of 2720	2380	AppLaunch.exe	31

C:\Users\Admin\AppData\Local\Temp\0d5e1bd7d3c54885ed533d496d57e097c90543d889f71cbe40942055ec641a4eN.exe
"C:\Users\Admin\AppData\Local\Temp\0d5e1bd7d3c54885ed533d496d57e097c90543d889f71cbe40942055ec641a4eN.exe"
1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2100
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2380
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2380 -s 196
    3⤵
    - Program crash
    PID:2720

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2380-6-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmp

Filesize
4KB

Download
memory/2380-9-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2380-7-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2380-5-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2380-3-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2380-4-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2380-2-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2380-1-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2380-0-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2380-11-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download

Analysis

Sharing