mystic | 179649325e561f83a53c5cba99cd8f1f589064c8d0f2029fb8e06f61ae986787

Analysis

max time kernel
184s
max time network
293s
platform
windows10-1703_x64
resource
win10-20230915-en
resource tags

arch:x64arch:x86image:win10-20230915-enlocale:en-usos:windows10-1703-x64system
submitted
06/10/2023, 05:12

Target

2eL1931.exe
Size

1.7MB
MD5

144dc3c0a5275a93ff86f00b5c61b9ec
SHA1

784168ab3c4711737656ca13dc4cb59ca267fa45
SHA256

179649325e561f83a53c5cba99cd8f1f589064c8d0f2029fb8e06f61ae986787
SHA512

9af6a9870077621eb046d6fed0fac88eba35edd4cd5e60f49c46018ab633d5cc77ddb9a93886178544198099a4e3b20726a32729ec9d1cf89524b4a579afb783
SSDEEP

24576:kxxY5A0vimILM/cVmbFgHng2zm6a9Dhvhoos5TtbWf:kL0vimILM/4gFqgAm6a3vZCqf

Score

10^/10

mystic stealer

Family

mystic

http://5.42.92.211/loghub/master

Detect Mystic stealer payload 5 IoCs

resource	yara_rule
behavioral2/memory/4060-0-0x0000000000400000-0x0000000000428000-memory.dmp	family_mystic
behavioral2/memory/4060-3-0x0000000000400000-0x0000000000428000-memory.dmp	family_mystic
behavioral2/memory/4060-4-0x0000000000400000-0x0000000000428000-memory.dmp	family_mystic
behavioral2/memory/4060-5-0x0000000000400000-0x0000000000428000-memory.dmp	family_mystic
behavioral2/memory/4060-6-0x0000000000400000-0x0000000000428000-memory.dmp	family_mystic

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4040 set thread context of 4060	4040	2eL1931.exe	70

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2104	4040	WerFault.exe	69

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 4040 wrote to memory of 4060	4040	2eL1931.exe	70
PID 4040 wrote to memory of 4060	4040	2eL1931.exe	70
PID 4040 wrote to memory of 4060	4040	2eL1931.exe	70
PID 4040 wrote to memory of 4060	4040	2eL1931.exe	70
PID 4040 wrote to memory of 4060	4040	2eL1931.exe	70
PID 4040 wrote to memory of 4060	4040	2eL1931.exe	70
PID 4040 wrote to memory of 4060	4040	2eL1931.exe	70
PID 4040 wrote to memory of 4060	4040	2eL1931.exe	70
PID 4040 wrote to memory of 4060	4040	2eL1931.exe	70
PID 4040 wrote to memory of 4060	4040	2eL1931.exe	70

C:\Users\Admin\AppData\Local\Temp\2eL1931.exe
"C:\Users\Admin\AppData\Local\Temp\2eL1931.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4040
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
  2⤵
  PID:4060
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4040 -s 336
  2⤵
  - Program crash
  PID:2104

memory/4060-0-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/4060-3-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/4060-4-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/4060-5-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/4060-6-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download