mystic | 99e0a0c1b7b47a62ad566300429ac814030e2139f50e9bd31914026d58b9b60f

Analysis

max time kernel
142s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20230915-en
resource tags

arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
submitted
01/10/2023, 11:55

Target

tmp.exe
Size

276KB
MD5

a827118d116c0e1e32f4ff82cccd2998
SHA1

d9d35a15f2fd28aa8969b0384fc0018a1c1edec4
SHA256

99e0a0c1b7b47a62ad566300429ac814030e2139f50e9bd31914026d58b9b60f
SHA512

fdc518a4172a98755d4f8230ad0cb64add37937660e7cf363dd1c32703105370d9b4d09fd53080fbdaa32b1a0fbe9f089fe0d99c042dff7f6bf850ec83db499e
SSDEEP

6144:Wh2eKajWpVP06aE10BSqgZp9BVfUYaGGeyeRrj:W7KajWL0BSLbPFGqpj

Score

10^/10

mystic stealer

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3416 set thread context of 3800	3416	tmp.exe	89

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1308	3416	WerFault.exe	84

Suspicious use of WriteProcessMemory 16 IoCs

description	pid	Process	procid_target
PID 3416 wrote to memory of 3996	3416	tmp.exe	87
PID 3416 wrote to memory of 3996	3416	tmp.exe	87
PID 3416 wrote to memory of 3996	3416	tmp.exe	87
PID 3416 wrote to memory of 3264	3416	tmp.exe	88
PID 3416 wrote to memory of 3264	3416	tmp.exe	88
PID 3416 wrote to memory of 3264	3416	tmp.exe	88
PID 3416 wrote to memory of 3800	3416	tmp.exe	89
PID 3416 wrote to memory of 3800	3416	tmp.exe	89
PID 3416 wrote to memory of 3800	3416	tmp.exe	89
PID 3416 wrote to memory of 3800	3416	tmp.exe	89
PID 3416 wrote to memory of 3800	3416	tmp.exe	89
PID 3416 wrote to memory of 3800	3416	tmp.exe	89
PID 3416 wrote to memory of 3800	3416	tmp.exe	89
PID 3416 wrote to memory of 3800	3416	tmp.exe	89
PID 3416 wrote to memory of 3800	3416	tmp.exe	89
PID 3416 wrote to memory of 3800	3416	tmp.exe	89

C:\Users\Admin\AppData\Local\Temp\tmp.exe
"C:\Users\Admin\AppData\Local\Temp\tmp.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3416
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
  2⤵
  PID:3996
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
  2⤵
  PID:3264
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
  2⤵
  PID:3800
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3416 -s 288
  2⤵
  - Program crash
  PID:1308

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 464 -p 3416 -ip 3416
1⤵
PID:3056

memory/3800-2-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/3800-1-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/3800-0-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/3800-3-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/3800-4-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download