mystic | cf8b060b835ddb131b19c9666675c5b5a0f4200bf12c4f7b4328ca6368bd54c5

Analysis

max time kernel
128s
max time network
136s
platform
windows10-1703_x64
resource
win10-20230915-en
resource tags

arch:x64arch:x86image:win10-20230915-enlocale:en-usos:windows10-1703-x64system
submitted
22/09/2023, 19:22

Target

cf8b060b835ddb131b19c9666675c5b5a0f4200bf12c4f7b4328ca6368bd54c5.exe
Size

378KB
MD5

700af9f9bfabea9683ab33cfe02ad4e2
SHA1

eac8a5d8742af1aff58f35fa230474e7efcb9aff
SHA256

cf8b060b835ddb131b19c9666675c5b5a0f4200bf12c4f7b4328ca6368bd54c5
SHA512

a2a3298ec7e9baf8b123ca10b9e58fa05d1cc3d5c5fcb4253f0c4af553c047e254b00646046de1f4c92f864af5cc94debb1c53b7257c25c26dee8279bc8f9433
SSDEEP

6144:oi5frpxdonyq4zaG2u5AOMeKKSzsLMAdwYHsN+TW5QrRQ6quqp:okrp0/9u5CeFMsLXdwwsAW5QS6quqp

Score

10^/10

mystic stealer

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 712 set thread context of 2556	712	cf8b060b835ddb131b19c9666675c5b5a0f4200bf12c4f7b4328ca6368bd54c5.exe	71

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4180	712	WerFault.exe	69

Suspicious use of WriteProcessMemory 13 IoCs

description	pid	Process	procid_target
PID 712 wrote to memory of 3520	712	cf8b060b835ddb131b19c9666675c5b5a0f4200bf12c4f7b4328ca6368bd54c5.exe	70
PID 712 wrote to memory of 3520	712	cf8b060b835ddb131b19c9666675c5b5a0f4200bf12c4f7b4328ca6368bd54c5.exe	70
PID 712 wrote to memory of 3520	712	cf8b060b835ddb131b19c9666675c5b5a0f4200bf12c4f7b4328ca6368bd54c5.exe	70
PID 712 wrote to memory of 2556	712	cf8b060b835ddb131b19c9666675c5b5a0f4200bf12c4f7b4328ca6368bd54c5.exe	71
PID 712 wrote to memory of 2556	712	cf8b060b835ddb131b19c9666675c5b5a0f4200bf12c4f7b4328ca6368bd54c5.exe	71
PID 712 wrote to memory of 2556	712	cf8b060b835ddb131b19c9666675c5b5a0f4200bf12c4f7b4328ca6368bd54c5.exe	71
PID 712 wrote to memory of 2556	712	cf8b060b835ddb131b19c9666675c5b5a0f4200bf12c4f7b4328ca6368bd54c5.exe	71
PID 712 wrote to memory of 2556	712	cf8b060b835ddb131b19c9666675c5b5a0f4200bf12c4f7b4328ca6368bd54c5.exe	71
PID 712 wrote to memory of 2556	712	cf8b060b835ddb131b19c9666675c5b5a0f4200bf12c4f7b4328ca6368bd54c5.exe	71
PID 712 wrote to memory of 2556	712	cf8b060b835ddb131b19c9666675c5b5a0f4200bf12c4f7b4328ca6368bd54c5.exe	71
PID 712 wrote to memory of 2556	712	cf8b060b835ddb131b19c9666675c5b5a0f4200bf12c4f7b4328ca6368bd54c5.exe	71
PID 712 wrote to memory of 2556	712	cf8b060b835ddb131b19c9666675c5b5a0f4200bf12c4f7b4328ca6368bd54c5.exe	71
PID 712 wrote to memory of 2556	712	cf8b060b835ddb131b19c9666675c5b5a0f4200bf12c4f7b4328ca6368bd54c5.exe	71

C:\Users\Admin\AppData\Local\Temp\cf8b060b835ddb131b19c9666675c5b5a0f4200bf12c4f7b4328ca6368bd54c5.exe
"C:\Users\Admin\AppData\Local\Temp\cf8b060b835ddb131b19c9666675c5b5a0f4200bf12c4f7b4328ca6368bd54c5.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:712
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
  2⤵
  PID:3520
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
  2⤵
  PID:2556
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 712 -s 268
  2⤵
  - Program crash
  PID:4180

memory/2556-0-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2556-3-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2556-4-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2556-5-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2556-6-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download