mystic | ea4a647bb752042cdeabf742af9808349e1ac898edb4d392685854399de3b58a

Analysis

max time kernel
122s
max time network
125s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
06-10-2023 07:54

Target

ad565a40153052b16609d6580cfd3e3f.exe
Size

1.7MB
MD5

ad565a40153052b16609d6580cfd3e3f
SHA1

fffd13fdddc9c98b8a7b45f2f520ac2dd001f06a
SHA256

ea4a647bb752042cdeabf742af9808349e1ac898edb4d392685854399de3b58a
SHA512

fd6af7fab6342311b21202079f454a3bbe75e2250b8016b3c15dcdc62112b09b059cbf2596c20598e1345d7e9137bb43fce341013339b0ec69e53d4d1bdab99b
SSDEEP

24576:cjxY5A0vimILM/NVJ7qgHHY2Qm6a9DhvhJPSdK/q1f:cp0vimILM/bdqKYHm6a3vXOaq1f

Score

10^/10

mystic stealer

Family

mystic

http://5.42.92.211/loghub/master

Detect Mystic stealer payload 8 IoCs

resource	yara_rule
behavioral1/memory/2244-6-0x0000000000400000-0x0000000000428000-memory.dmp	family_mystic
behavioral1/memory/2244-8-0x0000000000400000-0x0000000000428000-memory.dmp	family_mystic
behavioral1/memory/2244-10-0x0000000000400000-0x0000000000428000-memory.dmp	family_mystic
behavioral1/memory/2244-13-0x0000000000400000-0x0000000000428000-memory.dmp	family_mystic
behavioral1/memory/2244-15-0x0000000000400000-0x0000000000428000-memory.dmp	family_mystic
behavioral1/memory/2244-17-0x0000000000400000-0x0000000000428000-memory.dmp	family_mystic
behavioral1/memory/2244-18-0x0000000000400000-0x0000000000428000-memory.dmp	family_mystic
behavioral1/memory/2244-19-0x0000000000400000-0x0000000000428000-memory.dmp	family_mystic

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1964 set thread context of 2244	1964	ad565a40153052b16609d6580cfd3e3f.exe	28

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1752	1964	WerFault.exe	27

Suspicious use of WriteProcessMemory 18 IoCs

description	pid	Process	procid_target
PID 1964 wrote to memory of 2244	1964	ad565a40153052b16609d6580cfd3e3f.exe	28
PID 1964 wrote to memory of 2244	1964	ad565a40153052b16609d6580cfd3e3f.exe	28
PID 1964 wrote to memory of 2244	1964	ad565a40153052b16609d6580cfd3e3f.exe	28
PID 1964 wrote to memory of 2244	1964	ad565a40153052b16609d6580cfd3e3f.exe	28
PID 1964 wrote to memory of 2244	1964	ad565a40153052b16609d6580cfd3e3f.exe	28
PID 1964 wrote to memory of 2244	1964	ad565a40153052b16609d6580cfd3e3f.exe	28
PID 1964 wrote to memory of 2244	1964	ad565a40153052b16609d6580cfd3e3f.exe	28
PID 1964 wrote to memory of 2244	1964	ad565a40153052b16609d6580cfd3e3f.exe	28
PID 1964 wrote to memory of 2244	1964	ad565a40153052b16609d6580cfd3e3f.exe	28
PID 1964 wrote to memory of 2244	1964	ad565a40153052b16609d6580cfd3e3f.exe	28
PID 1964 wrote to memory of 2244	1964	ad565a40153052b16609d6580cfd3e3f.exe	28
PID 1964 wrote to memory of 2244	1964	ad565a40153052b16609d6580cfd3e3f.exe	28
PID 1964 wrote to memory of 2244	1964	ad565a40153052b16609d6580cfd3e3f.exe	28
PID 1964 wrote to memory of 2244	1964	ad565a40153052b16609d6580cfd3e3f.exe	28
PID 1964 wrote to memory of 1752	1964	ad565a40153052b16609d6580cfd3e3f.exe	29
PID 1964 wrote to memory of 1752	1964	ad565a40153052b16609d6580cfd3e3f.exe	29
PID 1964 wrote to memory of 1752	1964	ad565a40153052b16609d6580cfd3e3f.exe	29
PID 1964 wrote to memory of 1752	1964	ad565a40153052b16609d6580cfd3e3f.exe	29

C:\Users\Admin\AppData\Local\Temp\ad565a40153052b16609d6580cfd3e3f.exe
"C:\Users\Admin\AppData\Local\Temp\ad565a40153052b16609d6580cfd3e3f.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1964
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
  2⤵
  PID:2244
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1964 -s 136
  2⤵
  - Program crash
  PID:1752

memory/2244-0-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/2244-2-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/2244-4-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/2244-6-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/2244-8-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/2244-10-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/2244-12-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmp

Filesize
4KB

Download
memory/2244-13-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/2244-15-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/2244-17-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/2244-18-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/2244-19-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download