mystic | e3cb5911ee3e585999a4e90ab561746e1704b590d0b5422a6fac0dbfe10b0f1a

Analysis

max time kernel
120s
max time network
123s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
21/09/2023, 13:06

Target

file.exe
Size

700KB
MD5

1946de623552c33fd2a20164fd3ee0f8
SHA1

b2c2bf9b7fac17a820ddbbd29d19ec7c1bd7110a
SHA256

e3cb5911ee3e585999a4e90ab561746e1704b590d0b5422a6fac0dbfe10b0f1a
SHA512

5cece38e21d7862b5415ae7571c70dcdb1d2699b023d7c55c02751021c2c3959c4ec3cba0aa501066a230bdba2fbb429c7ef3c4641b51519be04813af65bab99
SSDEEP

6144:Y6vGALXgBEIy8wluzNcq/PVucQpuQCV7FljY39wWX/1Evfr:pHXgFysVucQp27Q9wWWr

Score

10^/10

mystic stealer

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2008 set thread context of 2184	2008	file.exe	29

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2644	2008	WerFault.exe	27

Suspicious use of WriteProcessMemory 18 IoCs

description	pid	Process	procid_target
PID 2008 wrote to memory of 2184	2008	file.exe	29
PID 2008 wrote to memory of 2184	2008	file.exe	29
PID 2008 wrote to memory of 2184	2008	file.exe	29
PID 2008 wrote to memory of 2184	2008	file.exe	29
PID 2008 wrote to memory of 2184	2008	file.exe	29
PID 2008 wrote to memory of 2184	2008	file.exe	29
PID 2008 wrote to memory of 2184	2008	file.exe	29
PID 2008 wrote to memory of 2184	2008	file.exe	29
PID 2008 wrote to memory of 2184	2008	file.exe	29
PID 2008 wrote to memory of 2184	2008	file.exe	29
PID 2008 wrote to memory of 2184	2008	file.exe	29
PID 2008 wrote to memory of 2184	2008	file.exe	29
PID 2008 wrote to memory of 2184	2008	file.exe	29
PID 2008 wrote to memory of 2184	2008	file.exe	29
PID 2008 wrote to memory of 2644	2008	file.exe	30
PID 2008 wrote to memory of 2644	2008	file.exe	30
PID 2008 wrote to memory of 2644	2008	file.exe	30
PID 2008 wrote to memory of 2644	2008	file.exe	30

C:\Users\Admin\AppData\Local\Temp\file.exe
"C:\Users\Admin\AppData\Local\Temp\file.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2008
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
  2⤵
  PID:2184
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2008 -s 92
  2⤵
  - Program crash
  PID:2644

memory/2184-0-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2184-2-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2184-4-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2184-5-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2184-7-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2184-11-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmp

Filesize
4KB

Download
memory/2184-9-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2184-12-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2184-14-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2184-16-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2184-17-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2184-18-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download