mystic | 9317c1ac803a54747b7a74d5bf4b23567e9561f3fe206dac8754730befc85e43

Analysis

max time kernel
79s
max time network
91s
platform
windows10-1703_x64
resource
win10-20230915-en
resource tags

arch:x64arch:x86image:win10-20230915-enlocale:en-usos:windows10-1703-x64system
submitted
30/09/2023, 23:02

Target

9317c1ac803a54747b7a74d5bf4b23567e9561f3fe206dac8754730befc85e43.exe
Size

276KB
MD5

e7bc01581b5159e5bcfe133a62f47a3e
SHA1

fce8a4f3fa263ceb18547191a8046f6fb436411a
SHA256

9317c1ac803a54747b7a74d5bf4b23567e9561f3fe206dac8754730befc85e43
SHA512

be562ed40aebd6f435ea3967e3eec180531b99d62514e7d9f893871f5ea43f07b37c3643731e2bb1af6560b6ecea44b028125814b29182429bebdeb883ab4b46
SSDEEP

6144:WhkJU84xWYWwQ66BSqsy0s3Ien04J1CWivw31LhIj:WcU84xWFsZy0sLvFiDj

Score

10^/10

mystic stealer

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2940 set thread context of 2196	2940	9317c1ac803a54747b7a74d5bf4b23567e9561f3fe206dac8754730befc85e43.exe	71

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3112	2940	WerFault.exe	69

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 2940 wrote to memory of 2196	2940	9317c1ac803a54747b7a74d5bf4b23567e9561f3fe206dac8754730befc85e43.exe	71
PID 2940 wrote to memory of 2196	2940	9317c1ac803a54747b7a74d5bf4b23567e9561f3fe206dac8754730befc85e43.exe	71
PID 2940 wrote to memory of 2196	2940	9317c1ac803a54747b7a74d5bf4b23567e9561f3fe206dac8754730befc85e43.exe	71
PID 2940 wrote to memory of 2196	2940	9317c1ac803a54747b7a74d5bf4b23567e9561f3fe206dac8754730befc85e43.exe	71
PID 2940 wrote to memory of 2196	2940	9317c1ac803a54747b7a74d5bf4b23567e9561f3fe206dac8754730befc85e43.exe	71
PID 2940 wrote to memory of 2196	2940	9317c1ac803a54747b7a74d5bf4b23567e9561f3fe206dac8754730befc85e43.exe	71
PID 2940 wrote to memory of 2196	2940	9317c1ac803a54747b7a74d5bf4b23567e9561f3fe206dac8754730befc85e43.exe	71
PID 2940 wrote to memory of 2196	2940	9317c1ac803a54747b7a74d5bf4b23567e9561f3fe206dac8754730befc85e43.exe	71
PID 2940 wrote to memory of 2196	2940	9317c1ac803a54747b7a74d5bf4b23567e9561f3fe206dac8754730befc85e43.exe	71
PID 2940 wrote to memory of 2196	2940	9317c1ac803a54747b7a74d5bf4b23567e9561f3fe206dac8754730befc85e43.exe	71

C:\Users\Admin\AppData\Local\Temp\9317c1ac803a54747b7a74d5bf4b23567e9561f3fe206dac8754730befc85e43.exe
"C:\Users\Admin\AppData\Local\Temp\9317c1ac803a54747b7a74d5bf4b23567e9561f3fe206dac8754730befc85e43.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2940
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
  2⤵
  PID:2196
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2940 -s 252
  2⤵
  - Program crash
  PID:3112

memory/2196-0-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/2196-3-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/2196-4-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/2196-5-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/2196-6-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download