mystic | 7a5251207164e96dda2e8a1ba2e1f93ba2ae9e645fdf7609f1ff4b2363b00be9

Analysis

max time kernel
126s
max time network
131s
platform
windows10-1703_x64
resource
win10-20230915-en
resource tags

arch:x64arch:x86image:win10-20230915-enlocale:en-usos:windows10-1703-x64system
submitted
04/10/2023, 01:08

Target

7a5251207164e96dda2e8a1ba2e1f93ba2ae9e645fdf7609f1ff4b2363b00be9.exe
Size

1.4MB
MD5

4f0b2b5c5adb0ad7dc4a53a951b0a84f
SHA1

3f4ca0d0f918e594f42ae809e4219a5f10a74a20
SHA256

7a5251207164e96dda2e8a1ba2e1f93ba2ae9e645fdf7609f1ff4b2363b00be9
SHA512

aa3977f497d10ae19d320057907d5420ac480121b2b818065ee3c8502e0f798e1f3aecaf0c7a68433122a605a6a16a15c3088e7d50694eb28e79e81b0a1de758
SSDEEP

12288:WaWs3sJwo00rnuOVD9X6a9DhvhNl422Nn2DYkrrbj:WmsJw8T6a9DhvhE22Nn2skf

Score

10^/10

mystic stealer

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4804 set thread context of 2628	4804	7a5251207164e96dda2e8a1ba2e1f93ba2ae9e645fdf7609f1ff4b2363b00be9.exe	71

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4792	4804	WerFault.exe	69

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 4804 wrote to memory of 2628	4804	7a5251207164e96dda2e8a1ba2e1f93ba2ae9e645fdf7609f1ff4b2363b00be9.exe	71
PID 4804 wrote to memory of 2628	4804	7a5251207164e96dda2e8a1ba2e1f93ba2ae9e645fdf7609f1ff4b2363b00be9.exe	71
PID 4804 wrote to memory of 2628	4804	7a5251207164e96dda2e8a1ba2e1f93ba2ae9e645fdf7609f1ff4b2363b00be9.exe	71
PID 4804 wrote to memory of 2628	4804	7a5251207164e96dda2e8a1ba2e1f93ba2ae9e645fdf7609f1ff4b2363b00be9.exe	71
PID 4804 wrote to memory of 2628	4804	7a5251207164e96dda2e8a1ba2e1f93ba2ae9e645fdf7609f1ff4b2363b00be9.exe	71
PID 4804 wrote to memory of 2628	4804	7a5251207164e96dda2e8a1ba2e1f93ba2ae9e645fdf7609f1ff4b2363b00be9.exe	71
PID 4804 wrote to memory of 2628	4804	7a5251207164e96dda2e8a1ba2e1f93ba2ae9e645fdf7609f1ff4b2363b00be9.exe	71
PID 4804 wrote to memory of 2628	4804	7a5251207164e96dda2e8a1ba2e1f93ba2ae9e645fdf7609f1ff4b2363b00be9.exe	71
PID 4804 wrote to memory of 2628	4804	7a5251207164e96dda2e8a1ba2e1f93ba2ae9e645fdf7609f1ff4b2363b00be9.exe	71
PID 4804 wrote to memory of 2628	4804	7a5251207164e96dda2e8a1ba2e1f93ba2ae9e645fdf7609f1ff4b2363b00be9.exe	71

C:\Users\Admin\AppData\Local\Temp\7a5251207164e96dda2e8a1ba2e1f93ba2ae9e645fdf7609f1ff4b2363b00be9.exe
"C:\Users\Admin\AppData\Local\Temp\7a5251207164e96dda2e8a1ba2e1f93ba2ae9e645fdf7609f1ff4b2363b00be9.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4804
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
  2⤵
  PID:2628
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4804 -s 352
  2⤵
  - Program crash
  PID:4792

memory/2628-0-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/2628-3-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/2628-4-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/2628-5-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/2628-6-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download