mystic | 1381ba7561350dffd366a1ab6b2b02db63779899c3d4074a8e4831eb7a3adab0

Analysis

max time kernel
146s
max time network
135s
platform
windows10-2004_x64
resource
win10v2004-20230915-en
resource tags

arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
submitted
01/10/2023, 16:58

Target

1381ba7561350dffd366a1ab6b2b02db63779899c3d4074a8e4831eb7a3adab0.exe
Size

304KB
MD5

d99d1e03618f330f6123e9c641a02db4
SHA1

6d0913a079f539669f1d3bc2bea7f909080bbfed
SHA256

1381ba7561350dffd366a1ab6b2b02db63779899c3d4074a8e4831eb7a3adab0
SHA512

605a7f171f63e6e68e75b89dbc3bf4408f972c6482fa9b36c7f7d811a28842e3110405f3acdaa46ce1cd1e42fa40f40426a25928190bc82402c9a2bae6599217
SSDEEP

6144:dB89qnD2xsILYMOG1PiSt8IKisJh+PfD2UNJLY2YVnnnRlk2oOWTRX8:ddD2xsILYqUSthY+Pdkblk2oVTRX8

Score

10^/10

mystic stealer

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2120 set thread context of 2500	2120	1381ba7561350dffd366a1ab6b2b02db63779899c3d4074a8e4831eb7a3adab0.exe	87

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3128	2120	WerFault.exe	83

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 2120 wrote to memory of 2500	2120	1381ba7561350dffd366a1ab6b2b02db63779899c3d4074a8e4831eb7a3adab0.exe	87
PID 2120 wrote to memory of 2500	2120	1381ba7561350dffd366a1ab6b2b02db63779899c3d4074a8e4831eb7a3adab0.exe	87
PID 2120 wrote to memory of 2500	2120	1381ba7561350dffd366a1ab6b2b02db63779899c3d4074a8e4831eb7a3adab0.exe	87
PID 2120 wrote to memory of 2500	2120	1381ba7561350dffd366a1ab6b2b02db63779899c3d4074a8e4831eb7a3adab0.exe	87
PID 2120 wrote to memory of 2500	2120	1381ba7561350dffd366a1ab6b2b02db63779899c3d4074a8e4831eb7a3adab0.exe	87
PID 2120 wrote to memory of 2500	2120	1381ba7561350dffd366a1ab6b2b02db63779899c3d4074a8e4831eb7a3adab0.exe	87
PID 2120 wrote to memory of 2500	2120	1381ba7561350dffd366a1ab6b2b02db63779899c3d4074a8e4831eb7a3adab0.exe	87
PID 2120 wrote to memory of 2500	2120	1381ba7561350dffd366a1ab6b2b02db63779899c3d4074a8e4831eb7a3adab0.exe	87
PID 2120 wrote to memory of 2500	2120	1381ba7561350dffd366a1ab6b2b02db63779899c3d4074a8e4831eb7a3adab0.exe	87
PID 2120 wrote to memory of 2500	2120	1381ba7561350dffd366a1ab6b2b02db63779899c3d4074a8e4831eb7a3adab0.exe	87

C:\Users\Admin\AppData\Local\Temp\1381ba7561350dffd366a1ab6b2b02db63779899c3d4074a8e4831eb7a3adab0.exe
"C:\Users\Admin\AppData\Local\Temp\1381ba7561350dffd366a1ab6b2b02db63779899c3d4074a8e4831eb7a3adab0.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2120
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
  2⤵
  PID:2500
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2120 -s 412
  2⤵
  - Program crash
  PID:3128

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 2120 -ip 2120
1⤵
PID:5064

memory/2500-0-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/2500-2-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/2500-1-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/2500-3-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/2500-4-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download