mystic | e61135fdbe0b5b2642016b836277f9462e898854c3e58b812e0553ea70cd80c0

Analysis

max time kernel
145s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20230915-en
resource tags

arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
submitted
25/09/2023, 10:30

Target
SecuriteInfo.com.Win32.Evo-gen.15245.3227.exe
Size 380KB
Sample230925-mjs5zaec7y
SHA256 e61135fdbe0b5b2642016b836277f9462e898854c3e58b812e0553ea70cd80c0
MD5 a66b0c41083c3a24a872306af4b3e37e
SHA1 8c7f46e156f15c606c1f7162ff1f73040a05003e
SHA512 4db012b27ae50211ddfcb50e2c52083651e92ed5875bfd9882558f9dd60a8e74f41afe86c41957d2d898c65229b26c778585fe0970f6cc0b6107babff86595b7
SSDEEP 6144:2lPhhHX110KwTVSf3pOCq5b6uAOa3DqocbbmlI9p3toHIO//ObK0qwm:2lPX3110dVaUcuU3DqocvmlWp9oHIOaQ
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

mystic stealer

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3296 set thread context of 4504	3296	SecuriteInfo.com.Win32.Evo-gen.15245.3227.exe	86

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4364	3296	WerFault.exe	84

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 3296 wrote to memory of 4504	3296	SecuriteInfo.com.Win32.Evo-gen.15245.3227.exe	86
PID 3296 wrote to memory of 4504	3296	SecuriteInfo.com.Win32.Evo-gen.15245.3227.exe	86
PID 3296 wrote to memory of 4504	3296	SecuriteInfo.com.Win32.Evo-gen.15245.3227.exe	86
PID 3296 wrote to memory of 4504	3296	SecuriteInfo.com.Win32.Evo-gen.15245.3227.exe	86
PID 3296 wrote to memory of 4504	3296	SecuriteInfo.com.Win32.Evo-gen.15245.3227.exe	86
PID 3296 wrote to memory of 4504	3296	SecuriteInfo.com.Win32.Evo-gen.15245.3227.exe	86
PID 3296 wrote to memory of 4504	3296	SecuriteInfo.com.Win32.Evo-gen.15245.3227.exe	86
PID 3296 wrote to memory of 4504	3296	SecuriteInfo.com.Win32.Evo-gen.15245.3227.exe	86
PID 3296 wrote to memory of 4504	3296	SecuriteInfo.com.Win32.Evo-gen.15245.3227.exe	86
PID 3296 wrote to memory of 4504	3296	SecuriteInfo.com.Win32.Evo-gen.15245.3227.exe	86

C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.Evo-gen.15245.3227.exe
"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.Evo-gen.15245.3227.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3296
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
  2⤵
  PID:4504
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3296 -s 260
  2⤵
  - Program crash
  PID:4364

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 3296 -ip 3296
1⤵
PID:4260

memory/4504-0-0x0000000000400000-0x0000000000428000-memory.dmp

Download

memory/4504-1-0x0000000000400000-0x0000000000428000-memory.dmp

Download

memory/4504-2-0x0000000000400000-0x0000000000428000-memory.dmp

Download

memory/4504-3-0x0000000000400000-0x0000000000428000-memory.dmp

Download

memory/4504-4-0x0000000000400000-0x0000000000428000-memory.dmp

Download