mystic | 69681a84faaa9db188bc47aa79ec4f8acbcc8b1452a59c86be9ea5e44f552d75

Analysis

max time kernel
142s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20230915-en
resource tags

arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
submitted
29/09/2023, 23:03

Target
file.exe
Size 356KB
Sample230929-21pansge22
SHA256 69681a84faaa9db188bc47aa79ec4f8acbcc8b1452a59c86be9ea5e44f552d75
MD5 fd9c5c946e997348c799dd7b397baeb6
SHA1 ea9665e25e9b542e6fdc760c6d0cf087ec3b3a42
SHA512 c15b3dc52edbb98e5d9ef04d7610861dd845e4b70e1b854e50faad5c20170b43b36e90d7d845c0561f5bbea345916765f6c7262594c5c48d6ba23c6b7a8615ab
SSDEEP 6144:DuTeW/s5GqrO5aXnfEGIXWPvZAOfykow2SGAn2KnIelfECnnnLURRlVs0BC+:DmcGqrOk86x/bnGKIwnnnYHs0BC+
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

mystic stealer

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 5068 set thread context of 4116	5068	file.exe	87

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2180	5068	WerFault.exe	84

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 5068 wrote to memory of 4116	5068	file.exe	87
PID 5068 wrote to memory of 4116	5068	file.exe	87
PID 5068 wrote to memory of 4116	5068	file.exe	87
PID 5068 wrote to memory of 4116	5068	file.exe	87
PID 5068 wrote to memory of 4116	5068	file.exe	87
PID 5068 wrote to memory of 4116	5068	file.exe	87
PID 5068 wrote to memory of 4116	5068	file.exe	87
PID 5068 wrote to memory of 4116	5068	file.exe	87
PID 5068 wrote to memory of 4116	5068	file.exe	87
PID 5068 wrote to memory of 4116	5068	file.exe	87

C:\Users\Admin\AppData\Local\Temp\file.exe
"C:\Users\Admin\AppData\Local\Temp\file.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:5068
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
  2⤵
  PID:4116
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 5068 -s 264
  2⤵
  - Program crash
  PID:2180

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 5068 -ip 5068
1⤵
PID:1364

memory/4116-0-0x0000000000400000-0x0000000000428000-memory.dmp

Download

memory/4116-1-0x0000000000400000-0x0000000000428000-memory.dmp

Download

memory/4116-2-0x0000000000400000-0x0000000000428000-memory.dmp

Download

memory/4116-3-0x0000000000400000-0x0000000000428000-memory.dmp

Download

memory/4116-4-0x0000000000400000-0x0000000000428000-memory.dmp

Download