mystic | 0d5e1bd7d3c54885ed533d496d57e097c90543d889f71cbe40942055ec641a4e

Analysis

max time kernel
103s
max time network
105s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
29-10-2024 06:14

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0d5e1bd7d3c54885ed533d496d57e097c90543d889f71cbe40942055ec641a4eN.exe
Size

1.1MB
MD5

405292c315ba0149e8c0751860a49d60
SHA1

76ec0c2d15e7433920c5d35981679cf648212069
SHA256

0d5e1bd7d3c54885ed533d496d57e097c90543d889f71cbe40942055ec641a4e
SHA512

a01065ae61be7685f2256927186b3491696959acb8a9675d03f2ddcb43d7df77d35f2a73f92750eee1875c701be5ec12b570fd630e9db56ee198abd1a07d635b
SSDEEP

12288:bH1QIzGx2dAfzwZa5uHXBQk0bvym1uRDm2e+WRNukiSA7WiCOu1YOWvE:TG2dAfzwZa5uHxa6m1eV89iCOEYOWM

Score

10^/10

mystic discovery stealer

Malware Config

Signatures

Detect Mystic stealer payload 5 IoCs

resource	yara_rule
behavioral2/memory/4536-0-0x0000000000400000-0x0000000000434000-memory.dmp	mystic_family
behavioral2/memory/4536-2-0x0000000000400000-0x0000000000434000-memory.dmp	mystic_family
behavioral2/memory/4536-3-0x0000000000400000-0x0000000000434000-memory.dmp	mystic_family
behavioral2/memory/4536-1-0x0000000000400000-0x0000000000434000-memory.dmp	mystic_family
behavioral2/memory/4536-4-0x0000000000400000-0x0000000000434000-memory.dmp	mystic_family

Mystic
Mystic is an infostealer written in C++.
stealer mystic
Mystic family
mystic

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1856 set thread context of 4536	1856	0d5e1bd7d3c54885ed533d496d57e097c90543d889f71cbe40942055ec641a4eN.exe	87

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	0d5e1bd7d3c54885ed533d496d57e097c90543d889f71cbe40942055ec641a4eN.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 1856 wrote to memory of 4536	1856	0d5e1bd7d3c54885ed533d496d57e097c90543d889f71cbe40942055ec641a4eN.exe	87
PID 1856 wrote to memory of 4536	1856	0d5e1bd7d3c54885ed533d496d57e097c90543d889f71cbe40942055ec641a4eN.exe	87
PID 1856 wrote to memory of 4536	1856	0d5e1bd7d3c54885ed533d496d57e097c90543d889f71cbe40942055ec641a4eN.exe	87
PID 1856 wrote to memory of 4536	1856	0d5e1bd7d3c54885ed533d496d57e097c90543d889f71cbe40942055ec641a4eN.exe	87
PID 1856 wrote to memory of 4536	1856	0d5e1bd7d3c54885ed533d496d57e097c90543d889f71cbe40942055ec641a4eN.exe	87
PID 1856 wrote to memory of 4536	1856	0d5e1bd7d3c54885ed533d496d57e097c90543d889f71cbe40942055ec641a4eN.exe	87
PID 1856 wrote to memory of 4536	1856	0d5e1bd7d3c54885ed533d496d57e097c90543d889f71cbe40942055ec641a4eN.exe	87
PID 1856 wrote to memory of 4536	1856	0d5e1bd7d3c54885ed533d496d57e097c90543d889f71cbe40942055ec641a4eN.exe	87
PID 1856 wrote to memory of 4536	1856	0d5e1bd7d3c54885ed533d496d57e097c90543d889f71cbe40942055ec641a4eN.exe	87
PID 1856 wrote to memory of 4536	1856	0d5e1bd7d3c54885ed533d496d57e097c90543d889f71cbe40942055ec641a4eN.exe	87

C:\Users\Admin\AppData\Local\Temp\0d5e1bd7d3c54885ed533d496d57e097c90543d889f71cbe40942055ec641a4eN.exe
"C:\Users\Admin\AppData\Local\Temp\0d5e1bd7d3c54885ed533d496d57e097c90543d889f71cbe40942055ec641a4eN.exe"
1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1856
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
  2⤵
  PID:4536

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4536-0-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4536-2-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4536-3-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4536-1-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4536-4-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download