mystic | c68af0ff9658e44cc7e06898fc56c6d00cd312b8afee51ac724e296d72187802

Analysis

max time kernel
167s
max time network
277s
platform
windows10-1703_x64
resource
win10-20230915-en
resource tags

arch:x64arch:x86image:win10-20230915-enlocale:en-usos:windows10-1703-x64system
submitted
21-09-2023 04:27

Target

c68af0ff9658e44cc7e06898fc56c6d00cd312b8afee51ac724e296d72187802.exe
Size

1.0MB
MD5

43d9cca9ef9d166f59a48fcc8efc9e06
SHA1

9df8086ab1081a38511372e34413fda546ede9db
SHA256

c68af0ff9658e44cc7e06898fc56c6d00cd312b8afee51ac724e296d72187802
SHA512

1520e99d3ff662cd4d6b5cce16c20be2be83a4cd0ace481f88fe40b739be886caebeb2bbe8358f9085820993092ee2cb7c821516731d540131c928194a4406c2
SSDEEP

12288:HoetdPenEp953bXeu5W2fo8oBNFJQxBTTASKuLpv+4dNVBCuE+OoaWCP5:bvPenEp953bpfo8Un+TMSzO+OoaWU

Score

10^/10

mystic stealer

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4612 set thread context of 2180	4612	c68af0ff9658e44cc7e06898fc56c6d00cd312b8afee51ac724e296d72187802.exe	71

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2480	4612	WerFault.exe	69

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 4612 wrote to memory of 2180	4612	c68af0ff9658e44cc7e06898fc56c6d00cd312b8afee51ac724e296d72187802.exe	71
PID 4612 wrote to memory of 2180	4612	c68af0ff9658e44cc7e06898fc56c6d00cd312b8afee51ac724e296d72187802.exe	71
PID 4612 wrote to memory of 2180	4612	c68af0ff9658e44cc7e06898fc56c6d00cd312b8afee51ac724e296d72187802.exe	71
PID 4612 wrote to memory of 2180	4612	c68af0ff9658e44cc7e06898fc56c6d00cd312b8afee51ac724e296d72187802.exe	71
PID 4612 wrote to memory of 2180	4612	c68af0ff9658e44cc7e06898fc56c6d00cd312b8afee51ac724e296d72187802.exe	71
PID 4612 wrote to memory of 2180	4612	c68af0ff9658e44cc7e06898fc56c6d00cd312b8afee51ac724e296d72187802.exe	71
PID 4612 wrote to memory of 2180	4612	c68af0ff9658e44cc7e06898fc56c6d00cd312b8afee51ac724e296d72187802.exe	71
PID 4612 wrote to memory of 2180	4612	c68af0ff9658e44cc7e06898fc56c6d00cd312b8afee51ac724e296d72187802.exe	71
PID 4612 wrote to memory of 2180	4612	c68af0ff9658e44cc7e06898fc56c6d00cd312b8afee51ac724e296d72187802.exe	71
PID 4612 wrote to memory of 2180	4612	c68af0ff9658e44cc7e06898fc56c6d00cd312b8afee51ac724e296d72187802.exe	71

C:\Users\Admin\AppData\Local\Temp\c68af0ff9658e44cc7e06898fc56c6d00cd312b8afee51ac724e296d72187802.exe
"C:\Users\Admin\AppData\Local\Temp\c68af0ff9658e44cc7e06898fc56c6d00cd312b8afee51ac724e296d72187802.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4612
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
  2⤵
  PID:2180
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4612 -s 256
  2⤵
  - Program crash
  PID:2480

memory/2180-0-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2180-4-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2180-5-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2180-3-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2180-6-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download