mystic | ea4a647bb752042cdeabf742af9808349e1ac898edb4d392685854399de3b58a

Analysis

max time kernel
139s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20230915-en
resource tags

arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
submitted
06/10/2023, 07:54

Target

ad565a40153052b16609d6580cfd3e3f.exe
Size

1.7MB
MD5

ad565a40153052b16609d6580cfd3e3f
SHA1

fffd13fdddc9c98b8a7b45f2f520ac2dd001f06a
SHA256

ea4a647bb752042cdeabf742af9808349e1ac898edb4d392685854399de3b58a
SHA512

fd6af7fab6342311b21202079f454a3bbe75e2250b8016b3c15dcdc62112b09b059cbf2596c20598e1345d7e9137bb43fce341013339b0ec69e53d4d1bdab99b
SSDEEP

24576:cjxY5A0vimILM/NVJ7qgHHY2Qm6a9DhvhJPSdK/q1f:cp0vimILM/bdqKYHm6a3vXOaq1f

Score

10^/10

mystic stealer

Family

mystic

http://5.42.92.211/loghub/master

Detect Mystic stealer payload 5 IoCs

resource	yara_rule
behavioral2/memory/780-0-0x0000000000400000-0x0000000000428000-memory.dmp	family_mystic
behavioral2/memory/780-1-0x0000000000400000-0x0000000000428000-memory.dmp	family_mystic
behavioral2/memory/780-2-0x0000000000400000-0x0000000000428000-memory.dmp	family_mystic
behavioral2/memory/780-3-0x0000000000400000-0x0000000000428000-memory.dmp	family_mystic
behavioral2/memory/780-4-0x0000000000400000-0x0000000000428000-memory.dmp	family_mystic

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4396 set thread context of 780	4396	ad565a40153052b16609d6580cfd3e3f.exe	84

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4484	4396	WerFault.exe	81

Suspicious use of WriteProcessMemory 13 IoCs

description	pid	Process	procid_target
PID 4396 wrote to memory of 1364	4396	ad565a40153052b16609d6580cfd3e3f.exe	83
PID 4396 wrote to memory of 1364	4396	ad565a40153052b16609d6580cfd3e3f.exe	83
PID 4396 wrote to memory of 1364	4396	ad565a40153052b16609d6580cfd3e3f.exe	83
PID 4396 wrote to memory of 780	4396	ad565a40153052b16609d6580cfd3e3f.exe	84
PID 4396 wrote to memory of 780	4396	ad565a40153052b16609d6580cfd3e3f.exe	84
PID 4396 wrote to memory of 780	4396	ad565a40153052b16609d6580cfd3e3f.exe	84
PID 4396 wrote to memory of 780	4396	ad565a40153052b16609d6580cfd3e3f.exe	84
PID 4396 wrote to memory of 780	4396	ad565a40153052b16609d6580cfd3e3f.exe	84
PID 4396 wrote to memory of 780	4396	ad565a40153052b16609d6580cfd3e3f.exe	84
PID 4396 wrote to memory of 780	4396	ad565a40153052b16609d6580cfd3e3f.exe	84
PID 4396 wrote to memory of 780	4396	ad565a40153052b16609d6580cfd3e3f.exe	84
PID 4396 wrote to memory of 780	4396	ad565a40153052b16609d6580cfd3e3f.exe	84
PID 4396 wrote to memory of 780	4396	ad565a40153052b16609d6580cfd3e3f.exe	84

C:\Users\Admin\AppData\Local\Temp\ad565a40153052b16609d6580cfd3e3f.exe
"C:\Users\Admin\AppData\Local\Temp\ad565a40153052b16609d6580cfd3e3f.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4396
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
  2⤵
  PID:1364
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
  2⤵
  PID:780
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4396 -s 392
  2⤵
  - Program crash
  PID:4484

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 4396 -ip 4396
1⤵
PID:4984

memory/780-0-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/780-1-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/780-2-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/780-3-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/780-4-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download