mystic | 6ef7040db669184b6c4d76954f0569507a1ff606c1f9a1b9d8c78a736253f477

Analysis

max time kernel
149s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20230915-en
resource tags

arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
submitted
04/10/2023, 09:20

Target

4bf1c5ad10bb0f385f369a039337310c7b83797deb2a8819e6445c1c5b64dd99.exe
Size

1.4MB
MD5

dfa245086aa6bbef75256eb8f5b4d2cd
SHA1

b66d95d02969c3d89712754d0e1cc21b6ad35152
SHA256

4bf1c5ad10bb0f385f369a039337310c7b83797deb2a8819e6445c1c5b64dd99
SHA512

3a30130846e459c438726593f169967bce6a17e23b7b81c14f3a88df25a7bd3b562d4c6157a077f033442ee777d3da66646b0b0c5ad92d4e6b3be50eff722cfa
SSDEEP

12288:jaWs3sJwo00rnuOVD9X6a9DhvhN96lEbBObbj:jmsJw8T6a9DhvhO8U

Score

10^/10

mystic stealer

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1516 set thread context of 2848	1516	4bf1c5ad10bb0f385f369a039337310c7b83797deb2a8819e6445c1c5b64dd99.exe	88

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4624	1516	WerFault.exe	83

Suspicious use of WriteProcessMemory 13 IoCs

description	pid	Process	procid_target
PID 1516 wrote to memory of 2276	1516	4bf1c5ad10bb0f385f369a039337310c7b83797deb2a8819e6445c1c5b64dd99.exe	87
PID 1516 wrote to memory of 2276	1516	4bf1c5ad10bb0f385f369a039337310c7b83797deb2a8819e6445c1c5b64dd99.exe	87
PID 1516 wrote to memory of 2276	1516	4bf1c5ad10bb0f385f369a039337310c7b83797deb2a8819e6445c1c5b64dd99.exe	87
PID 1516 wrote to memory of 2848	1516	4bf1c5ad10bb0f385f369a039337310c7b83797deb2a8819e6445c1c5b64dd99.exe	88
PID 1516 wrote to memory of 2848	1516	4bf1c5ad10bb0f385f369a039337310c7b83797deb2a8819e6445c1c5b64dd99.exe	88
PID 1516 wrote to memory of 2848	1516	4bf1c5ad10bb0f385f369a039337310c7b83797deb2a8819e6445c1c5b64dd99.exe	88
PID 1516 wrote to memory of 2848	1516	4bf1c5ad10bb0f385f369a039337310c7b83797deb2a8819e6445c1c5b64dd99.exe	88
PID 1516 wrote to memory of 2848	1516	4bf1c5ad10bb0f385f369a039337310c7b83797deb2a8819e6445c1c5b64dd99.exe	88
PID 1516 wrote to memory of 2848	1516	4bf1c5ad10bb0f385f369a039337310c7b83797deb2a8819e6445c1c5b64dd99.exe	88
PID 1516 wrote to memory of 2848	1516	4bf1c5ad10bb0f385f369a039337310c7b83797deb2a8819e6445c1c5b64dd99.exe	88
PID 1516 wrote to memory of 2848	1516	4bf1c5ad10bb0f385f369a039337310c7b83797deb2a8819e6445c1c5b64dd99.exe	88
PID 1516 wrote to memory of 2848	1516	4bf1c5ad10bb0f385f369a039337310c7b83797deb2a8819e6445c1c5b64dd99.exe	88
PID 1516 wrote to memory of 2848	1516	4bf1c5ad10bb0f385f369a039337310c7b83797deb2a8819e6445c1c5b64dd99.exe	88

C:\Users\Admin\AppData\Local\Temp\4bf1c5ad10bb0f385f369a039337310c7b83797deb2a8819e6445c1c5b64dd99.exe
"C:\Users\Admin\AppData\Local\Temp\4bf1c5ad10bb0f385f369a039337310c7b83797deb2a8819e6445c1c5b64dd99.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1516
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
  2⤵
  PID:2276
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
  2⤵
  PID:2848
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1516 -s 148
  2⤵
  - Program crash
  PID:4624

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 1516 -ip 1516
1⤵
PID:4956

memory/2848-0-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/2848-1-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/2848-2-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/2848-3-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/2848-4-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download