Mistic Backdoor - In-Memory Windows Backdoor Masquerading as Microsoft Endpoint Security

Stealthy Windows backdoor masquerading as Microsoft endpoint-security tooling, deployed by ransomware initial-access broker Woodgnat / KongTuke.

Severity

Critical · Pre-Ransomware

Type

In-Memory Backdoor / Loader / IAB

Actor

Woodgnat / KongTuke (IAB)

Aliases

Backdoor.Mistic · MLTBackdoor

Sectors

Insurance / Education / IT / Prof. Services

Primary Platform

Windows

Atomic IOCs

9 SHA256 · 4 C2 IPs · 25 domains

First Seen

April 2026

Version

v0.3 · 2026-07-22

Author

HuntPack

Executive Summary

Mistic (Symantec: Backdoor.Mistic; Zscaler: MLTBackdoor) is a stealthy, in-memory Windows backdoor active since April 2026, attributed to the financially-motivated initial-access broker Woodgnat (a.k.a. KongTuke). The broker sells footholds to ransomware affiliates including Qilin, Akira, Rhysida, Black Basta, Interlock and 8Base, so a Mistic hit is an early-stage warning of impending ransomware.

Mistic's signature move is masquerading as Microsoft endpoint-security software (MITRE T1036.005). A legitimate signed Microsoft binary, MpExtMs.exe, is abused via DLL side-loading (T1574.002) to load a malicious loader version.dll, which hooks GetModuleFileNameW and LoadLibraryW to redirect execution into EndpointDlp.dll — a filename chosen to imitate Microsoft endpoint DLP tooling. The backdoor runs entirely in memory (no payload on disk), supports remote code execution, file transfer, Beacon Object File (BOF) loading, and a self-delete kill switch.

A companion .NET credential-stealer DLL (f.dll) displays a fake login screen to harvest user passwords. A privilege-escalation helper n.dll is also deployed. Delivery is via ClickFix / FileFix / CrashFix social-engineering lures leading to an MSI installer.

Why this pack leans on behavior, not just hashes. The atomic IOCs below are real and source-cited (Symantec Threat Hunter Team), but Mistic is in-memory, polymorphic at the MSI/DLL layer, and rotates C2 fast. The durable detections are behavioral: a Microsoft-named binary side-loading from an unusual path, version.dll loaded outside System32, a fake-login DLL spawned from a non-browser parent, and beaconing to freshly-registered .top/updater-* infrastructure.

Source Review & Web-Hunter Notes

Tier	Source	Key finding	Carry forward
1	Symantec / security.com — Threat Hunter Team, "Backdoor.Mistic / ModeloRAT"	Primary analysis. Full IOC set (9 SHA256, 4 IPs, 25 domains, delivery URL), side-load chain, persistence detail (Run keys masquerading as AnyDesk/Splashtop/Comms, Startup shortcuts, VBScript, scheduled tasks), broker→ransomware linkage.	yes
1	BleepingComputer — "Stealthy Mistic backdoor linked to ransomware access broker KongTuke"	Corroborates side-load chain (`MpExtMs.exe`→`version.dll`→`EndpointDlp.dll`), in-memory execution, BOF loading, ClickFix/FileFix/CrashFix delivery, fake-login .NET DLL.	yes
2	CyberSecurityNews — "Mistic Backdoor Blends With Microsoft Endpoint Security" (seed source)	Confirms masquerade theme, function-hooking loader, targeted sectors (insurance, education, IT, professional services).	yes
2	CSO Online · GBHackers · Cyberpress	Independent restatements; confirm Woodgnat ClickFix/FileFix/CrashFix lure delivery and IAB business model.	partial

Provenance note: every atomic IOC in §4 / §10 traces to the Symantec Threat Hunter Team publication and is corroborated by BleepingComputer. No IOCs were synthesized.

Hunt Brief & Attack Chain

#	Stage	Behavior	Telemetry	Hunt angle
1	Delivery	ClickFix / FileFix / CrashFix lure → user runs a pasted command / fake "fix" → MSI download (`thomphon.com/update.msi`).	ProcessRollup2, DnsRequest, NetworkConnectIP4	`msiexec` spawned from browser/Explorer with a remote http(s) MSI argument.
2	Install	MSI drops side-load set into a writable dir; legitimate `MpExtMs.exe` staged alongside malicious `version.dll`.	PeFileWritten, ProcessRollup2	MS-signed binary running outside `\Windows\` / `\Program Files\`.
3	Defense Evasion	DLL side-loading: `version.dll` loader hooks `GetModuleFileNameW`/`LoadLibraryW`, loads `EndpointDlp.dll` (masquerades as MS endpoint DLP).	ProcessRollup2, PeFileWritten, ImageHash	`version.dll` / `EndpointDlp.dll` present outside System32; MS-named binary in user-writable path.
4	Execution / C2	Mistic runs in memory: RCE, file up/download, BOF loading, configurable C2 check-in. Beacons to rotating `.top` / `updater-` / `upd-domain-` infra.	NetworkConnectIP4, DnsRequest	MS-named process making outbound connections; DNS to known/look-alike C2.
5	Credential Access	.NET `f.dll` displays a fake login screen to capture passwords.	ProcessRollup2, PeFileWritten	.NET host (`rundll32`/`regsvr32`/sideloaded EXE) loading `f.dll`; fake-lockscreen DLL written.
6	Persistence	Run-key entries masquerading as AnyDesk / Splashtop / Comms; Startup-folder shortcuts; VBScript launchers; scheduled tasks.	AsepValueUpdate, RegGenericValueUpdate, ProcessRollup2	Run-key values naming RMM tools but pointing at non-standard paths / DLLs.
7	Impact (downstream)	Access sold to ransomware affiliates (Qilin/Akira/Rhysida/Black Basta/Interlock/8Base).	—	Treat any Mistic hit as pre-ransomware; escalate.

Consolidated IOC Table

All values sourced from Symantec Threat Hunter Team (corroborated by BleepingComputer). Defang where shown; live values neutralized with [.].

File hashes (SHA256)

SHA256	Component	Conf
`1e41c7bfaa6aa3b93b6cc024274a10e33f3e12fe7c98c1db387ef8927f9d1984`	EndpointDlp.dll (Mistic)	high
`afd5f1ed45a9867daf3bc64152cef460a06b164c8183e490db39146d4749a82c`	EndpointDlp.dll (Mistic)	high
`db972979d508e75fe730d3b72c2701470fbdaeaf8ebdd674744754fa44438ca5`	EndpointDlp.dll (Mistic)	high
`fb3630822b70bacb56aa4cec29b5a0e3e9acb3920809e70310a4003385a6d34a`	EndpointDlp.dll (Mistic)	high
`59e3c4cb06331b4f2d78a9a0592f3747e573bd01c5a7650c26361d1e25520712`	version.dll (loader)	high
`34d798a6c55e57ed0932b6499f4fbcb5454bdfca903307be101a0594b0ac07bc`	f.dll (.NET fake-login credential stealer)	high
`8c935feec4bd05d5d918df308be417532fb42608fb989a08eab183e0ae699235`	n.dll (likely privilege escalation)	med
`3f797a639bc855bc6d5471f327924b62d10900ddec49b970eca6604142bbb4be`	aeff97fe.msi (dropper)	high
`f591275a8f014b29e567529d67c54eb7bb4473db1c38737d6bfd5b3d52c9344e`	48b47c0.msi (dropper)	high

Network — C2 IPs & delivery URL

Type	Value	Conf
IP	`142.93.242[.]144`	high
IP	`144.31.53[.]78`	high
IP	`198.13.159[.]44`	high
IP	`199.91.221[.]42`	high
URL	`hxxp://thomphon[.]com/update.msi`	high

C2 / infrastructure domains (25)

Domains
`authorized-logins[.]net`	`b6w9m2z5x8q1v3k[.]top`	`carrolc[.]com`
`cj06y9v4xab[.]com`	`cwrtwright[.]com`	`defs.updater-worelos[.]com`
`ftps.upd-domain-goloro[.]com`	`grande-luna[.]top`	`human-check[.]top`
`mail.authorized-logins[.]net`	`mailes.upd-domain-goloro[.]com`	`mails.updater-worelos[.]com`
`mueleer[.]com`	`nano.upscale-kolo[.]com`	`oeannon[.]com`
`php.authorized-logins[.]net`	`rotoa-upda-lo[.]com`	`sql-updater-service[.]com`
`sss.authorized-logins[.]net`	`thomphon[.]com`	`upd-domain-goloro[.]com`
`update.update-fall[.]com`	`updater-worelos[.]com`	`upscale-kolo[.]com`
`w3xasv14culvnqj[.]top`

Affected Surface & Telemetry Matrix

Surface	Required telemetry	Priority	Gap risk
Windows endpoints (workstations / servers)	ProcessRollup2, PeFileWritten, ImageHash	critical	Low — Falcon sensor coverage assumed.
Endpoint network egress	NetworkConnectIP4, DnsRequest	high	Medium — fast C2 rotation; IOC value perishable.
Registry / ASEP persistence	AsepValueUpdate, RegGenericValueUpdate	high	Low.
Identity / interactive logon (post fake-login theft)	UserLogon, UserLogonFailed2	medium	Medium — credential reuse may look legitimate.
Scheduled tasks / Startup folder	ProcessRollup2 (schtasks), PeFileWritten	medium	Medium — task registration telemetry varies by sensor config.

ATT&CK Mapping

Tactic	Technique	ID	Observed behavior
Initial Access	Phishing / User Execution (ClickFix/FileFix/CrashFix)	T1566 / T1204	Social-engineering lure tricks user into running pasted command → MSI download.
Execution	Msiexec / Command & Scripting	T1218.007 / T1059	`msiexec` installs side-load set; VBScript launchers.
Defense Evasion	DLL Side-Loading	T1574.002	`MpExtMs.exe` side-loads malicious `version.dll` → `EndpointDlp.dll`.
Defense Evasion	Masquerading: Match Legitimate Name	T1036.005	Binaries named after Microsoft endpoint-security tooling; Run keys named after AnyDesk/Splashtop.
Defense Evasion	Hijack Execution Flow / API Hooking	T1574 / T1056.004	Loader hooks `GetModuleFileNameW` & `LoadLibraryW`; in-memory execution, no disk payload.
Persistence	Registry Run Keys / Startup Folder	T1547.001	Run-key + Startup-folder entries impersonating RMM software.
Persistence	Scheduled Task	T1053.005	Scheduled-task launchers for the side-load set.
Credential Access	Input Capture: Credential API / GUI fake-login	T1056 / T1056.002	.NET `f.dll` displays a fake login screen to harvest passwords.
Privilege Escalation	(helper) `n.dll`	TA0004	Likely privilege-escalation component deployed alongside backdoor.
Command & Control	Application Layer Protocol	T1071	Configurable C2 check-in to rotating domains/IPs; BOF loading.

Native Audit-Log Hunts (non-CQL)

Sysmon Event ID 7 (Image Loaded) — flag version.dll or EndpointDlp.dll loaded by an image outside C:\Windows\System32\ or signed by a non-Microsoft (or absent) signer.
Windows Security 4688 (Process Creation) — MpExtMs.exe with a parent-image path or working directory outside \Windows\ / \Program Files\.
Windows Security 4657 / Sysmon 13 (Registry) — new ...\CurrentVersion\Run values whose name references AnyDesk / Splashtop / "Comms" but whose data points at a DLL, script, or user-writable path.
Startup folder — new .lnk / .vbs in %AppData%\Microsoft\Windows\Start Menu\Programs\Startup.
MSI install log / 4688 — msiexec invoked with a remote http:// / https:// package argument, parented by a browser or Explorer.
Scheduled Tasks (4698) — new task whose action launches a sideloaded EXE or rundll32/regsvr32 against the drop directory.

CrowdStrike LogScale CQL Hunt Queries

Ten queries, high-fidelity first. Pick your cloud, then Copy CQL or Open in Falcon per card. Validate field names against your tenant data model before scheduling.

Falcon cloud (drives "Open in Falcon"): Pick your tenant's cloud first — every "Open in Falcon" button below uses this selection.

Q1 — Microsoft-named binary side-loading from a user-writable path

T1574.002 / T1036.005CONF HIGHFP LOWCOST LOW

Core detection. MpExtMs.exe / version.dll / EndpointDlp.dll running outside Windows/Program Files.

// HUNT: MS-named side-load binary running outside trusted dirs
// MITRE: T1574.002, T1036.005
// CONF: high  FP: low  COST: low
// REQUIRES: ProcessRollup2
// FALSE POSITIVES: portable/dev copies of MpExtMs.exe (rare)
#event_simpleName=ProcessRollup2
| ImageFileName=/\\(MpExtMs|version|EndpointDlp)\./i
| ImageFileName!=/\\(Windows|Program Files( \(x86\))?)\\/i
| table([aid, ComputerName, UserName, FileName, ImageFileName, CommandLine, SHA256HashData, ParentBaseFileName], limit=200)

Q2 — Known Mistic hashes on disk or in process

T1574.002CONF HIGHFP LOWCOST LOW

Atomic hash sweep across process + PE-write telemetry (perishable but high-fidelity).

// HUNT: Mistic / loader / credential-stealer SHA256 sweep
// MITRE: T1574.002, T1056.002
// CONF: high  FP: low  COST: low
// REQUIRES: ProcessRollup2, PeFileWritten
// FALSE POSITIVES: none expected for these hashes
#event_simpleName=/ProcessRollup2|PeFileWritten/
| SHA256HashData=/^(1e41c7bfaa6aa3b93b6cc024274a10e33f3e12fe7c98c1db387ef8927f9d1984|afd5f1ed45a9867daf3bc64152cef460a06b164c8183e490db39146d4749a82c|db972979d508e75fe730d3b72c2701470fbdaeaf8ebdd674744754fa44438ca5|fb3630822b70bacb56aa4cec29b5a0e3e9acb3920809e70310a4003385a6d34a|59e3c4cb06331b4f2d78a9a0592f3747e573bd01c5a7650c26361d1e25520712|34d798a6c55e57ed0932b6499f4fbcb5454bdfca903307be101a0594b0ac07bc|8c935feec4bd05d5d918df308be417532fb42608fb989a08eab183e0ae699235|3f797a639bc855bc6d5471f327924b62d10900ddec49b970eca6604142bbb4be|f591275a8f014b29e567529d67c54eb7bb4473db1c38737d6bfd5b3d52c9344e)$/i
| table([aid, ComputerName, FileName, ImageFileName, SHA256HashData, CommandLine], limit=max)

Q3 — version.dll / EndpointDlp.dll written outside System32

T1574.002CONF HIGHFP MEDCOST LOW

Catches the side-load staging step regardless of hash rotation.

// HUNT: side-load DLL staged in a non-System32 directory
// MITRE: T1574.002
// CONF: high  FP: medium  COST: low
// REQUIRES: PeFileWritten
// FALSE POSITIVES: legit apps ship their own version.dll (installers, games)
// TUNING: exclude trusted vendor install dirs and your software-deploy staging paths
#event_simpleName=PeFileWritten
| TargetFileName=/\\(version|EndpointDlp)\.dll$/i
| TargetFileName!=/\\(Windows|Program Files( \(x86\))?)\\/i
| TargetFileName!=/\\(Trusted Vendor|SoftwareDeploy)\\/i
| table([aid, ComputerName, UserName, TargetFileName, ContextBaseFileName, SHA256HashData], limit=200)

Q4 — Endpoint beaconing to known Mistic C2 IPs

T1071CONF HIGHFP LOWCOST LOW

Network sweep against the four Symantec C2 IPs.

// HUNT: outbound connection to Mistic C2 IPs
// MITRE: T1071
// CONF: high  FP: low  COST: low
// REQUIRES: NetworkConnectIP4
// FALSE POSITIVES: none expected (dedicated C2)
#event_simpleName=NetworkConnectIP4
| RemoteAddressIP4=/^(142\.93\.242\.144|144\.31\.53\.78|198\.13\.159\.44|199\.91\.221\.42)$/
| table([aid, ComputerName, ContextBaseFileName, RemoteAddressIP4, RemotePort, ContextProcessId], limit=200)

Q5 — DNS to Mistic C2 / look-alike infrastructure

T1071CONF HIGHFP MEDCOST LOW

Resolves the 25 known domains plus the updater-* / upd-domain-* naming pattern.

// HUNT: DNS lookup of Mistic C2 / updater-themed look-alike domains
// MITRE: T1071
// CONF: high  FP: medium  COST: low
// REQUIRES: DnsRequest
// FALSE POSITIVES: the broad updater-*/upd-domain-* regex may catch benign vendors
// TUNING: keep the literal-domain arm always-on; gate the pattern arm to alert-only review
#event_simpleName=DnsRequest
| DomainName=/(authorized-logins\.net|updater-worelos\.com|upd-domain-goloro\.com|upscale-kolo\.com|update-fall\.com|sql-updater-service\.com|rotoa-upda-lo\.com|thomphon\.com|mueleer\.com|oeannon\.com|carrolc\.com|cwrtwright\.com|grande-luna\.top|human-check\.top|b6w9m2z5x8q1v3k\.top|w3xasv14culvnqj\.top|cj06y9v4xab\.com)$/i
| table([aid, ComputerName, ContextBaseFileName, DomainName, ContextProcessId], limit=200)

Q6 — Microsoft-named process making outbound network connections

T1574.002 / T1071CONF HIGHFP MEDCOST MED

Behavioral: MpExtMs.exe / endpoint-DLP-named host beaconing — hash-independent.

// HUNT: MS-endpoint-named process initiating egress (side-load beacon)
// MITRE: T1574.002, T1071
// CONF: high  FP: medium  COST: medium
// REQUIRES: NetworkConnectIP4
// FALSE POSITIVES: genuine Defender components phone home to MS-owned ranges
// TUNING: exclude Microsoft-owned destination ASNs / RFC1918 internal updaters
#event_simpleName=NetworkConnectIP4
| ContextBaseFileName=/^(MpExtMs\.exe|EndpointDlp\.dll|version\.dll)$/i
| RemoteAddressIP4!=/^(10\.|192\.168\.|172\.(1[6-9]|2[0-9]|3[01])\.)/
| table([aid, ComputerName, ContextBaseFileName, RemoteAddressIP4, RemotePort, ContextProcessId], limit=200)

Q7 — msiexec installing a remote MSI from a browser/Explorer parent

T1218.007 / T1204CONF MEDFP MEDCOST LOW

Catches the ClickFix → remote-MSI delivery step.

// HUNT: msiexec launching a remote http(s) package via browser/Explorer
// MITRE: T1218.007, T1204
// CONF: medium  FP: medium  COST: low
// REQUIRES: ProcessRollup2
// FALSE POSITIVES: legit web-delivered installers / software portals
// TUNING: allowlist sanctioned software-portal domains in the CommandLine arm
#event_simpleName=ProcessRollup2
| FileName=/^msiexec\.exe$/i
| CommandLine=/https?:\/\//i
| ParentBaseFileName=/^(chrome|msedge|firefox|brave|explorer|powershell|cmd|mshta|wscript)\.exe$/i
| table([aid, ComputerName, UserName, ParentBaseFileName, CommandLine], limit=200)

Q8 — Run-key persistence masquerading as RMM software

T1547.001 / T1036.005CONF MEDFP MEDCOST LOW

ASEP value naming AnyDesk/Splashtop/Comms but pointing at a DLL/script/odd path.

// HUNT: Run-key value impersonating RMM tools, odd target
// MITRE: T1547.001, T1036.005
// CONF: medium  FP: medium  COST: low
// REQUIRES: AsepValueUpdate
// FALSE POSITIVES: genuine AnyDesk/Splashtop installs (point at vendor Program Files)
// TUNING: exclude RegStringValue paths under the real vendor Program Files dirs
#event_simpleName=AsepValueUpdate
| RegValueName=/(AnyDesk|Splashtop|Comms)/i
| RegStringValue=/(\.dll|\.vbs|\.js|\\Users\\|\\AppData\\|\\ProgramData\\|rundll32|regsvr32)/i
| RegStringValue!=/\\Program Files( \(x86\))?\\(AnyDesk|Splashtop)\\/i
| table([aid, ComputerName, RegObjectName, RegValueName, RegStringValue], limit=200)

Q9 — Fake-login credential stealer DLL (f.dll) written / loaded

T1056.002CONF HIGHFP LOWCOST LOW

.NET fake-lockscreen DLL staged or executed via rundll32/regsvr32.

// HUNT: fake-login credential-stealer DLL staged or invoked
// MITRE: T1056.002
// CONF: high  FP: low  COST: low
// REQUIRES: PeFileWritten, ProcessRollup2
// FALSE POSITIVES: a stray user file literally named f.dll (rare); hash arm removes doubt
#event_simpleName=/PeFileWritten|ProcessRollup2/
| SHA256HashData=/^34d798a6c55e57ed0932b6499f4fbcb5454bdfca903307be101a0594b0ac07bc$/i
| table([aid, ComputerName, UserName, FileName, TargetFileName, ImageFileName, CommandLine, SHA256HashData], limit=200)

Q10 — VBScript / WScript launcher in user-writable path

T1059.005CONF MEDFP MEDCOST LOW

Persistence/exec via VBScript launchers from AppData/Startup.

// HUNT: wscript/cscript running a .vbs from a user-writable dir
// MITRE: T1059.005, T1547.001
// CONF: medium  FP: medium  COST: low
// REQUIRES: ProcessRollup2
// FALSE POSITIVES: legit logon/maintenance scripts in user profiles
// TUNING: allowlist known IT script paths / signed admin tooling
#event_simpleName=ProcessRollup2
| FileName=/^(wscript|cscript)\.exe$/i
| CommandLine=/\.vbs/i
| CommandLine=/\\(Users|AppData|ProgramData)\\/i
| table([aid, ComputerName, UserName, ParentBaseFileName, CommandLine], limit=200)

CrowdStrike Custom IOA Recommendations

IOA	Basis (query)	Action	Sev
MS-named binary executing outside trusted dirs	Q1	Detect → Block (process create, ImageFileName regex + path exclusion)	critical
Side-load DLL written outside System32	Q3	Detect (file write IOA)	high
Beacon to known Mistic C2 IPs	Q4	Custom IOC (IP) — block + alert	critical
Fake-login DLL hash (f.dll)	Q9	Custom IOC (SHA256) — block	critical
RMM-named Run key with DLL/script target	Q8	Detect (registry IOA)	high

Alert package (Q1 / Q4 — IOA candidates). Scheduled Search DETECT — Mistic Side-Load (Woodgnat). Email subject: [CRITICAL] Detection: Mistic Backdoor — MS-named binary side-loading / C2 beacon. L1 triage: (1) confirm ImageFileName path is non-standard; (2) pull SHA256HashData, compare to §4; (3) check host for outbound to §4 IPs/domains; (4) look for f.dll fake-login DLL and RMM-named Run keys; (5) network-contain host; (6) escalate as pre-ransomware — actor sells to Qilin/Akira/Rhysida/Black Basta/Interlock/8Base.

Machine-Readable IOC Appendix

Grouped quick-copy grid (defanged where networked) plus an import-ready CSV for Falcon IOC Management. Source: Symantec Threat Hunter Team.

SHA256 (9)block / hunt

1e41c7bfaa6aa3b93b6cc024274a10e33f3e12fe7c98c1db387ef8927f9d1984
afd5f1ed45a9867daf3bc64152cef460a06b164c8183e490db39146d4749a82c
db972979d508e75fe730d3b72c2701470fbdaeaf8ebdd674744754fa44438ca5
fb3630822b70bacb56aa4cec29b5a0e3e9acb3920809e70310a4003385a6d34a
59e3c4cb06331b4f2d78a9a0592f3747e573bd01c5a7650c26361d1e25520712
34d798a6c55e57ed0932b6499f4fbcb5454bdfca903307be101a0594b0ac07bc
8c935feec4bd05d5d918df308be417532fb42608fb989a08eab183e0ae699235
3f797a639bc855bc6d5471f327924b62d10900ddec49b970eca6604142bbb4be
f591275a8f014b29e567529d67c54eb7bb4473db1c38737d6bfd5b3d52c9344e

C2 IPs (4)block / hunt

142.93.242.144
144.31.53.78
198.13.159.44
199.91.221.42

Domains (25)hunt

authorized-logins.net
b6w9m2z5x8q1v3k.top
carrolc.com
cj06y9v4xab.com
cwrtwright.com
defs.updater-worelos.com
ftps.upd-domain-goloro.com
grande-luna.top
human-check.top
mail.authorized-logins.net
mailes.upd-domain-goloro.com
mails.updater-worelos.com
mueleer.com
nano.upscale-kolo.com
oeannon.com
php.authorized-logins.net
rotoa-upda-lo.com
sql-updater-service.com
sss.authorized-logins.net
thomphon.com
upd-domain-goloro.com
update.update-fall.com
updater-worelos.com
upscale-kolo.com
w3xasv14culvnqj.top

Filenames / delivery URLhunt

MpExtMs.exe   (legit MS binary, abused)
version.dll   (loader)
EndpointDlp.dll (Mistic)
f.dll         (.NET fake-login stealer)
n.dll         (privesc helper)
aeff97fe.msi  (dropper)
48b47c0.msi   (dropper)
http://thomphon.com/update.msi

Falcon IOC-Management CSVbulk import

type,value,action,severity,description
sha256,1e41c7bfaa6aa3b93b6cc024274a10e33f3e12fe7c98c1db387ef8927f9d1984,detect,high,EndpointDlp.dll (Mistic)
sha256,afd5f1ed45a9867daf3bc64152cef460a06b164c8183e490db39146d4749a82c,detect,high,EndpointDlp.dll (Mistic)
sha256,db972979d508e75fe730d3b72c2701470fbdaeaf8ebdd674744754fa44438ca5,detect,high,EndpointDlp.dll (Mistic)
sha256,fb3630822b70bacb56aa4cec29b5a0e3e9acb3920809e70310a4003385a6d34a,detect,high,EndpointDlp.dll (Mistic)
sha256,59e3c4cb06331b4f2d78a9a0592f3747e573bd01c5a7650c26361d1e25520712,detect,high,version.dll loader
sha256,34d798a6c55e57ed0932b6499f4fbcb5454bdfca903307be101a0594b0ac07bc,detect,high,f.dll fake-login stealer
sha256,8c935feec4bd05d5d918df308be417532fb42608fb989a08eab183e0ae699235,detect,medium,n.dll privesc helper
sha256,3f797a639bc855bc6d5471f327924b62d10900ddec49b970eca6604142bbb4be,detect,high,aeff97fe.msi dropper
sha256,f591275a8f014b29e567529d67c54eb7bb4473db1c38737d6bfd5b3d52c9344e,detect,high,48b47c0.msi dropper
ipv4,142.93.242.144,detect,high,Mistic C2
ipv4,144.31.53.78,detect,high,Mistic C2
ipv4,198.13.159.44,detect,high,Mistic C2
ipv4,199.91.221.42,detect,high,Mistic C2
domain,authorized-logins.net,detect,high,Mistic C2
domain,b6w9m2z5x8q1v3k.top,detect,high,Mistic C2
domain,carrolc.com,detect,high,Mistic C2
domain,cj06y9v4xab.com,detect,high,Mistic C2
domain,cwrtwright.com,detect,high,Mistic C2
domain,defs.updater-worelos.com,detect,high,Mistic C2
domain,ftps.upd-domain-goloro.com,detect,high,Mistic C2
domain,grande-luna.top,detect,high,Mistic C2
domain,human-check.top,detect,high,Mistic C2
domain,mail.authorized-logins.net,detect,high,Mistic C2
domain,mailes.upd-domain-goloro.com,detect,high,Mistic C2
domain,mails.updater-worelos.com,detect,high,Mistic C2
domain,mueleer.com,detect,high,Mistic C2
domain,nano.upscale-kolo.com,detect,high,Mistic C2
domain,oeannon.com,detect,high,Mistic C2
domain,php.authorized-logins.net,detect,high,Mistic C2
domain,rotoa-upda-lo.com,detect,high,Mistic C2
domain,sql-updater-service.com,detect,high,Mistic C2
domain,sss.authorized-logins.net,detect,high,Mistic C2
domain,thomphon.com,detect,high,Mistic C2 / delivery
domain,upd-domain-goloro.com,detect,high,Mistic C2
domain,update.update-fall.com,detect,high,Mistic C2
domain,updater-worelos.com,detect,high,Mistic C2
domain,upscale-kolo.com,detect,high,Mistic C2
domain,w3xasv14culvnqj.top,detect,high,Mistic C2

Detection Validation Gates

Field validation. All CQL fields are stock Falcon data-model fields (ProcessRollup2 / PeFileWritten / NetworkConnectIP4 / DnsRequest / AsepValueUpdate). Lint passes clean — no tenant-specific fields used.
Path-exclusion tuning. Q3/Q6/Q8/Q10 carry // TUNING exclusions. Before enabling alerting, populate your real trusted-vendor / software-deploy / RMM Program Files paths.
IOC perishability. Q2/Q4/Q5 atomic IOCs rotate fast. Re-validate against current threat intel before relying on them; keep behavioral Q1/Q3/Q6 always-on.
Benign-baseline check. Run Q6 (MS-named egress) and Q7 (remote msiexec) in audit-only for 1 ring first; confirm genuine Defender update traffic and sanctioned web-installers are excluded before promoting to alert.
Escalation gate. Any Q1/Q2/Q4/Q9 hit = treat as confirmed compromise and pre-ransomware; isolate host and escalate immediately.

Hardening — Tiered & Deployable

Immediate (this week)

Block known IOCs — push the §4 SHA256/IP set to Falcon Custom IOC (block). MITRE M1040. no user impact
ASR: block executable creation from email/web + Office child processes — closes the ClickFix→MSI delivery lane. MITRE M1042 / Microsoft ASR rules.
Disable web-delivered MSI from user context — GPO DisableMSI set to 1 for non-admins / AlwaysInstallElevated set to 0. Counters Q7 pattern. MITRE M1038.

Near term (1–4 weeks)

WDAC / AppLocker DLL rules — block DLL load from user-writable paths; defeats side-loading (Q1/Q3). MITRE M1038. pilot on a ring
Strip local-admin from standard users — limits n.dll privesc and persistence. MITRE M1026.
Restrict / inventory RMM tools (AnyDesk, Splashtop) — block unsanctioned RMM so masquerading Run keys stand out. MITRE M1042.

Strategic (1–3 months)

Phishing-resistant MFA (FIDO2) — neutralizes the fake-login credential theft (f.dll); stolen passwords alone become useless. MITRE M1032.
User-execution hardening / ClickFix awareness + clipboard-paste-to-run controls — reduce social-engineering success. MITRE M1017.
Application allow-listing (WDAC enforced mode) — only signed, approved binaries run. MITRE M1038.

Deployable Playbooks

A — Block known Mistic IOCs (PowerShell, Falcon Custom IOC API)

# Push Mistic SHA256 hashes as BLOCK IOCs (requires FalconPy + API creds in env)
$hashes = @(
 "1e41c7bfaa6aa3b93b6cc024274a10e33f3e12fe7c98c1db387ef8927f9d1984",
 "afd5f1ed45a9867daf3bc64152cef460a06b164c8183e490db39146d4749a82c",
 "59e3c4cb06331b4f2d78a9a0592f3747e573bd01c5a7650c26361d1e25520712",
 "34d798a6c55e57ed0932b6499f4fbcb5454bdfca903307be101a0594b0ac07bc"
)
foreach ($h in $hashes) {
  Write-Host "Submit BLOCK IOC: $h (Mistic Backdoor / Woodgnat)"
  # falcon iocs create --type sha256 --value $h --action prevent --platform windows
}

B — Block DLL side-loading from user-writable paths (AppLocker DLL rule, GPO)

# Enforce AppLocker DLL rules: deny DLL load from user-writable dirs.
# gpedit: App Control Policies > AppLocker > DLL Rules > Deny
# Deny path rules (Everyone):
%OSDRIVE%\Users\*\AppData\*\*.dll
%OSDRIVE%\Users\*\Downloads\*\*.dll
%OSDRIVE%\ProgramData\*\*.dll
# Then enable enforcement for the DLL rule collection and gpupdate /force.

C — Enable the key ASR rules (PowerShell)

# Block executable content from email & webmail, and Office spawning child procs
Add-MpPreference -AttackSurfaceReductionRules_Ids BE9BA2D9-53EA-4CDC-84E5-9B1EEEE46550 -AttackSurfaceReductionRules_Actions Enabled
Add-MpPreference -AttackSurfaceReductionRules_Ids D4F940AB-401B-4EFC-AADC-AD5F3C50688A -AttackSurfaceReductionRules_Actions Enabled
# Block process creations from PSExec/WMI, and obfuscated scripts
Add-MpPreference -AttackSurfaceReductionRules_Ids D1E49AAC-8F56-4280-B9BA-993A6D77406C -AttackSurfaceReductionRules_Actions Enabled

Containment Runbook

Isolate — network-contain any host hitting Q1/Q2/Q4/Q9 via Falcon RTR / host containment. Do not power off (in-memory payload — preserve volatile evidence first if forensics needed).
Identify — RTR: enumerate the side-load dir, capture MpExtMs.exe + version.dll + EndpointDlp.dll + f.dll/n.dll; dump Run keys, Startup folder, scheduled tasks; list active network connections.
Eradicate — kill the side-loaded process, delete the side-load set and any .msi droppers, remove RMM-named Run keys / Startup shortcuts / VBScript launchers / scheduled tasks.
Credential reset — assume passwords entered on the fake-login screen are compromised; force-reset all users who interactively logged onto the host; revoke sessions/tokens.
Eradicate persistence broadly — hunt §4 hashes/IPs/domains fleet-wide (Q2/Q4/Q5); the IAB may hold multiple footholds.
Recover — rebuild confirmed-compromised hosts from known-good image; re-enable after IOC sweep is clean.
Escalate — treat as pre-ransomware: notify IR lead, raise monitoring on crown-jewel assets, watch for lateral movement and Qilin/Akira/Rhysida/Black Basta/Interlock/8Base tooling.

Detection Coverage Map

Attack stage	Technique	Coverage	Query
Delivery (ClickFix → remote MSI)	T1204 / T1218.007	PARTIAL	Q7
Side-load staging	T1574.002	COVERED	Q1, Q3
Masquerading as MS tooling	T1036.005	COVERED	Q1, Q8
In-memory execution / API hooking	T1574 / T1056.004	GAP	— behavioral only (no disk artifact); rely on Q1/Q6
C2 (IP / domain)	T1071	COVERED	Q4, Q5, Q6
Credential access (fake login)	T1056.002	COVERED	Q9
Persistence (Run key / Startup / VBScript / task)	T1547.001 / T1053.005 / T1059.005	COVERED	Q8, Q10
Privilege escalation (n.dll)	TA0004	PARTIAL	Q2 (hash only — mechanism undisclosed)

Known gaps: the in-memory execution / BOF-loading stage leaves no disk artifact — there is no atomic query for it; detection there depends on catching the side-load (Q1/Q3) and the resulting egress (Q6). The n.dll privesc mechanism is undisclosed, so only the hash (Q2) covers it.

Hunt Summary Ticket

TITLE:    Hunt — Mistic Backdoor (Backdoor.Mistic / MLTBackdoor) — Woodgnat/KongTuke IAB
VERSION:  v0.3 — 2026-07-22
SEVERITY: CRITICAL (pre-ransomware; access broker for Qilin/Akira/Rhysida/Black Basta/Interlock/8Base)
AUTHOR:   HuntPack

SUMMARY:
  In-memory Windows backdoor masquerading as Microsoft endpoint-security tooling.
  MpExtMs.exe side-loads version.dll (hooks GetModuleFileNameW/LoadLibraryW) ->
  EndpointDlp.dll (Mistic). Companion .NET f.dll shows a fake login screen to steal
  credentials; n.dll = privesc. Delivery via ClickFix/FileFix/CrashFix -> MSI.

SCOPE:    Windows endpoints (insurance, education, IT, professional services seen targeted)
QUERIES:  10 CQL (Q1-Q10) — 6 high-conf, 4 medium. Behavioral core: Q1/Q3/Q6.
IOCs:     9 SHA256, 4 C2 IPs, 25 domains, 1 delivery URL — Symantec Threat Hunter Team.

ACTIONS:
  [ ] Push §4 hashes/IPs to Falcon Custom IOC (block)
  [ ] Enable Q1/Q3 always-on; audit-tune Q6/Q7 on one ring
  [ ] Hunt fleet-wide for §4 hashes/domains (Q2/Q4/Q5)
  [ ] Force credential reset for users on any confirmed host (fake-login theft)
  [ ] Escalate any hit as pre-ransomware

Changelog

v0.32026-07-24CQL correctness pass. All table() calls now carry an explicit row limit: the default is 200 and truncation is silent, so a capped result was indistinguishable from a complete one. Atomic-IOC sweeps (filters over 5+ hashes or C2 IPs) use limit=max so a wide infection is never silently under-scoped; behavioural hunts use limit=200, where exceeding the cap indicates the query needs tuning. Where present, event names that do not exist in the Falcon data model were corrected (e.g. ServiceInstalled is a Sysmon concept, not a Falcon event; ElfFileWritten is ELFFileWritten) — such queries could never return a row. No detection logic, fields, or IOCs changed.

v0.22026-07-22Reformatted to gold template; content unchanged. Reskinned the older bare-<h2> shell to the numbered section-hdr / snum layout, gold sidebar-logo + grouped TOC, and .mk/.mv meta grid (added a Type cell for the gallery subtitle). Added the Falcon IOC-Management CSV quick-copy block. Same 10 CQL queries byte-for-byte, same 9 SHA256 / 4 C2 IPs / 25 domains / 1 delivery URL, same ATT&CK mapping, hardening, coverage map and references.

v0.12026-06-25Initial HuntPack. Built from Symantec / BleepingComputer / CyberSecurityNews reporting. 10 CQL queries, full IOC set, tiered hardening, containment runbook, coverage map.

References

Symantec / security.com — Threat Hunter Team: "Backdoor.Mistic: New Backdoor May be Linked to Ransomware Access Broker / ModeloRAT" — security.com/blog-post/new-mistic-backdoor-modelorat (primary IOC source)
BleepingComputer — "Stealthy Mistic backdoor linked to ransomware access broker KongTuke"
CyberSecurityNews — "Mistic Backdoor Blends With Microsoft Endpoint Security Tooling to Evade Detection" (seed)
CSO Online — "Be on the lookout for Mistic, a new backdoor used by ransomware broker"
GBHackers / Cyberpress — Woodgnat ClickFix/FileFix/CrashFix delivery
MITRE ATT&CK — T1574.002, T1036.005, T1056.002, T1547.001, T1071, T1218.007, T1204

Mistic Backdoor · v0.2 · Generated 2026-07-22 · Author: HuntPack · Defensive detection content only