mystic | 7166a2d745495985dbb20a4e67387d9f0f6799ed9bdbe16a452805e0519eb38b

Analysis

max time kernel
142s
max time network
159s
platform
windows10-2004_x64
resource
win10v2004-20230915-en
resource tags

arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
submitted
29/09/2023, 15:31

Target
b63087ee0da6c8c6e791ef6148965d0a.exe
Size 356KB
Sample230929-sx2bdscf5v
SHA256 7166a2d745495985dbb20a4e67387d9f0f6799ed9bdbe16a452805e0519eb38b
MD5 b63087ee0da6c8c6e791ef6148965d0a
SHA1 c4f365e6b775b27b7c12c164b552a31bd3578f78
SHA512 b33c7793d7d21d409c2b9783af971b00a9b02ad756d383ac49a50b6911933ca4b9a217650764ce6fccfd989296822d961c9e042da98a682e3d0fc696262950c2
SSDEEP 6144:OCTeW/s5GqrO5aXnfEGIXWPvZAOPymhGFpF/YEAdvqNQYDMVs0BC+:wmcGqrOk86xbGFvYEAdCNLIs0BC+
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

mystic stealer

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3596 set thread context of 2636	3596	b63087ee0da6c8c6e791ef6148965d0a.exe	87

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3856	3596	WerFault.exe	84

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 3596 wrote to memory of 2636	3596	b63087ee0da6c8c6e791ef6148965d0a.exe	87
PID 3596 wrote to memory of 2636	3596	b63087ee0da6c8c6e791ef6148965d0a.exe	87
PID 3596 wrote to memory of 2636	3596	b63087ee0da6c8c6e791ef6148965d0a.exe	87
PID 3596 wrote to memory of 2636	3596	b63087ee0da6c8c6e791ef6148965d0a.exe	87
PID 3596 wrote to memory of 2636	3596	b63087ee0da6c8c6e791ef6148965d0a.exe	87
PID 3596 wrote to memory of 2636	3596	b63087ee0da6c8c6e791ef6148965d0a.exe	87
PID 3596 wrote to memory of 2636	3596	b63087ee0da6c8c6e791ef6148965d0a.exe	87
PID 3596 wrote to memory of 2636	3596	b63087ee0da6c8c6e791ef6148965d0a.exe	87
PID 3596 wrote to memory of 2636	3596	b63087ee0da6c8c6e791ef6148965d0a.exe	87
PID 3596 wrote to memory of 2636	3596	b63087ee0da6c8c6e791ef6148965d0a.exe	87

C:\Users\Admin\AppData\Local\Temp\b63087ee0da6c8c6e791ef6148965d0a.exe
"C:\Users\Admin\AppData\Local\Temp\b63087ee0da6c8c6e791ef6148965d0a.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3596
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
  2⤵
  PID:2636
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3596 -s 272
  2⤵
  - Program crash
  PID:3856

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3596 -ip 3596
1⤵
PID:2624

memory/2636-0-0x0000000000400000-0x0000000000428000-memory.dmp

Download

memory/2636-1-0x0000000000400000-0x0000000000428000-memory.dmp

Download

memory/2636-2-0x0000000000400000-0x0000000000428000-memory.dmp

Download

memory/2636-3-0x0000000000400000-0x0000000000428000-memory.dmp

Download

memory/2636-4-0x0000000000400000-0x0000000000428000-memory.dmp

Download