mystic | efdb40c9a204350396083b0df45029afb731eb3e502a0ed5cf545fa3ca01c4f5

Analysis

max time kernel
142s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20230915-en
resource tags

arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
submitted
21/09/2023, 22:54

Target

file.exe
Size

700KB
MD5

13fcbf16f7125772f035e6a92ab7d87f
SHA1

567968a91a2dde28476a9795299e338f2097814b
SHA256

efdb40c9a204350396083b0df45029afb731eb3e502a0ed5cf545fa3ca01c4f5
SHA512

9601232f62e0b242685c3c39e786f06d2d29cbeeb4319ba2a0989182276eaf19f47c7bb6a852fe7538c0fc0175ae50c464ab745f92f71c41de4c6e6a72a2f458
SSDEEP

6144:kSvGAafgBMniUwluzlcy/XVucQ5oXMt89wyi9sgIff2LXdabBnvfz:1Gfg2i8VucQ5oXMSeJIff2Jabpz

Score

10^/10

mystic stealer

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3940 set thread context of 2120	3940	file.exe	80

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2132	3940	WerFault.exe	78

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 3940 wrote to memory of 2120	3940	file.exe	80
PID 3940 wrote to memory of 2120	3940	file.exe	80
PID 3940 wrote to memory of 2120	3940	file.exe	80
PID 3940 wrote to memory of 2120	3940	file.exe	80
PID 3940 wrote to memory of 2120	3940	file.exe	80
PID 3940 wrote to memory of 2120	3940	file.exe	80
PID 3940 wrote to memory of 2120	3940	file.exe	80
PID 3940 wrote to memory of 2120	3940	file.exe	80
PID 3940 wrote to memory of 2120	3940	file.exe	80
PID 3940 wrote to memory of 2120	3940	file.exe	80

C:\Users\Admin\AppData\Local\Temp\file.exe
"C:\Users\Admin\AppData\Local\Temp\file.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3940
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
  2⤵
  PID:2120
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3940 -s 148
  2⤵
  - Program crash
  PID:2132

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 3940 -ip 3940
1⤵
PID:2840

memory/2120-0-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2120-1-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2120-2-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2120-3-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2120-4-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download