Analysis

  • max time kernel
    122s
  • max time network
    132s
  • platform
    windows10-1703_x64
  • resource
    win10-20230915-en
  • resource tags

    arch:x64arch:x86image:win10-20230915-enlocale:en-usos:windows10-1703-x64system
  • submitted
    07/10/2023, 06:03

General

  • Target

    c52f1aa4527983452b72bfcc7c7498055116825e436d192acbb7b799124415c1.exe

  • Size

    1.2MB

  • MD5

    ffe7a227d672738c32a358a57cec260a

  • SHA1

    510db6cee62d02c4c7c9dad24943bd3f750d7f93

  • SHA256

    c52f1aa4527983452b72bfcc7c7498055116825e436d192acbb7b799124415c1

  • SHA512

    5080a0d9e79b757d9892e672291f0124d852fda2be1305f26cebd6c8e1df7c9aeb03a1e76709980aa0c07542f6ba0f2249a1a859bf31d8060bb20635375b598a

  • SSDEEP

    24576:AyrJFM73gR6RI52yQFjnzwgLS/+wkc+Qv+hUbW5:HNFM70El0gLS+PQ5W

Malware Config

Signatures

  • Detect Mystic stealer payload 4 IoCs
  • Mystic

    Mystic is an infostealer written in C++.

  • Executes dropped EXE 5 IoCs
  • Adds Run key to start application 2 TTPs 5 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Program crash 2 IoCs
  • Suspicious use of WriteProcessMemory 25 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\c52f1aa4527983452b72bfcc7c7498055116825e436d192acbb7b799124415c1.exe
    "C:\Users\Admin\AppData\Local\Temp\c52f1aa4527983452b72bfcc7c7498055116825e436d192acbb7b799124415c1.exe"
    1⤵
    • Adds Run key to start application
    • Suspicious use of WriteProcessMemory
    PID:2088
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\WQ4sg2Gq.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\WQ4sg2Gq.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious use of WriteProcessMemory
      PID:2188
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ZC5pC5Xb.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ZC5pC5Xb.exe
        3⤵
        • Executes dropped EXE
        • Adds Run key to start application
        • Suspicious use of WriteProcessMemory
        PID:4784
        • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\Gx6DA6Dl.exe
          C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\Gx6DA6Dl.exe
          4⤵
          • Executes dropped EXE
          • Adds Run key to start application
          • Suspicious use of WriteProcessMemory
          PID:2216
          • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\nW6fu3Dj.exe
            C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\nW6fu3Dj.exe
            5⤵
            • Executes dropped EXE
            • Adds Run key to start application
            • Suspicious use of WriteProcessMemory
            PID:1836
            • C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\1oA20VV8.exe
              C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\1oA20VV8.exe
              6⤵
              • Executes dropped EXE
              • Suspicious use of SetThreadContext
              • Suspicious use of WriteProcessMemory
              PID:4568
              • C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
                "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
                7⤵
                  PID:1588
                  • C:\Windows\SysWOW64\WerFault.exe
                    C:\Windows\SysWOW64\WerFault.exe -u -p 1588 -s 568
                    8⤵
                    • Program crash
                    PID:520
                • C:\Windows\SysWOW64\WerFault.exe
                  C:\Windows\SysWOW64\WerFault.exe -u -p 4568 -s 140
                  7⤵
                  • Program crash
                  PID:752

    Network

          MITRE ATT&CK Enterprise v15

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\WQ4sg2Gq.exe

            Filesize

            1.0MB

            MD5

            b9cfcc60817c8121977e71ee8c6aebd9

            SHA1

            ced1e9401ddee75a63c1adeeb1ae3bd072702f1d

            SHA256

            12166e655475465188552c5503a8d8e5db50d4812b0582d3bd020eb20d5da373

            SHA512

            c95027be495067c1c39e4ffd950aa113d4a4de23939fcac8264d9c02f07eca691a43a6937b61b0cdf4c0d835487c0b18cafeeca2786f62b2de4d4ebbe2a60b2e

          • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\WQ4sg2Gq.exe

            Filesize

            1.0MB

            MD5

            b9cfcc60817c8121977e71ee8c6aebd9

            SHA1

            ced1e9401ddee75a63c1adeeb1ae3bd072702f1d

            SHA256

            12166e655475465188552c5503a8d8e5db50d4812b0582d3bd020eb20d5da373

            SHA512

            c95027be495067c1c39e4ffd950aa113d4a4de23939fcac8264d9c02f07eca691a43a6937b61b0cdf4c0d835487c0b18cafeeca2786f62b2de4d4ebbe2a60b2e

          • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ZC5pC5Xb.exe

            Filesize

            884KB

            MD5

            3a6538c6c794a8776591c48d4d347f44

            SHA1

            2831c8594e8455f289b4de7e8e7110f0227defdc

            SHA256

            ee5c3274f5b30bb85e429a54681d54a0841d8244c2644e0a7b30427fb347d03e

            SHA512

            aa1af6f2b6cdc8e5d42577f24b6e0e9ebc50847f635eb0004a17852b274f4bd1156809f930e37610780063f7f5eb20c8fd752ba5e9fa6f4cb7449fb89af4d9f5

          • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ZC5pC5Xb.exe

            Filesize

            884KB

            MD5

            3a6538c6c794a8776591c48d4d347f44

            SHA1

            2831c8594e8455f289b4de7e8e7110f0227defdc

            SHA256

            ee5c3274f5b30bb85e429a54681d54a0841d8244c2644e0a7b30427fb347d03e

            SHA512

            aa1af6f2b6cdc8e5d42577f24b6e0e9ebc50847f635eb0004a17852b274f4bd1156809f930e37610780063f7f5eb20c8fd752ba5e9fa6f4cb7449fb89af4d9f5

          • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\Gx6DA6Dl.exe

            Filesize

            590KB

            MD5

            aec2a6ad8432b23e6caea51b4f676d3f

            SHA1

            47b7b07b86b6b3b165f00bde02bc38d7a94e2d90

            SHA256

            0c9a20791a0dc9a4a77b2a598c0797583528e60e8caa40172a3b829fcd6d9cc4

            SHA512

            5f2aed8e5cee75baaccbd98366cbc1abc9a54b590a47de26f7d9ef61721cfb3a7bd804a0ba1619703eba99af49ae858d5825842925b5ae74c78ac5db1a2aa226

          • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\Gx6DA6Dl.exe

            Filesize

            590KB

            MD5

            aec2a6ad8432b23e6caea51b4f676d3f

            SHA1

            47b7b07b86b6b3b165f00bde02bc38d7a94e2d90

            SHA256

            0c9a20791a0dc9a4a77b2a598c0797583528e60e8caa40172a3b829fcd6d9cc4

            SHA512

            5f2aed8e5cee75baaccbd98366cbc1abc9a54b590a47de26f7d9ef61721cfb3a7bd804a0ba1619703eba99af49ae858d5825842925b5ae74c78ac5db1a2aa226

          • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\nW6fu3Dj.exe

            Filesize

            417KB

            MD5

            08e301a84cf495a48b0bcf65bef50534

            SHA1

            70f4fecdd000a98aab48f5640b9fe6eafee98226

            SHA256

            3bf26fe604efcb027de085c469a520483fd73f09ef2d53650d56768847b857aa

            SHA512

            41ea61ebfdbfdb17b08bfa24b7691def1177f82560fbf69c2cc533bd7a63398acde07766d9f980f667f4149951bf53319f4ab330cd948ef750a7f9465e689e82

          • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\nW6fu3Dj.exe

            Filesize

            417KB

            MD5

            08e301a84cf495a48b0bcf65bef50534

            SHA1

            70f4fecdd000a98aab48f5640b9fe6eafee98226

            SHA256

            3bf26fe604efcb027de085c469a520483fd73f09ef2d53650d56768847b857aa

            SHA512

            41ea61ebfdbfdb17b08bfa24b7691def1177f82560fbf69c2cc533bd7a63398acde07766d9f980f667f4149951bf53319f4ab330cd948ef750a7f9465e689e82

          • C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\1oA20VV8.exe

            Filesize

            378KB

            MD5

            f0831f173733de08511f3a0739f278a6

            SHA1

            06dc809d653c5d2c97386084ae13b50a73eb5b60

            SHA256

            8b00f9dce8ceb2123fba3bc9f88419960d1e661b6287eafeba4f0a2ee4be3d27

            SHA512

            19e3176ce1f154758f685cc4582e93587aa534a251de315473e35758dcd6ff6315880be7602097308dc89c355742be4729bad81de597e8d430a8e868082314e3

          • C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\1oA20VV8.exe

            Filesize

            378KB

            MD5

            f0831f173733de08511f3a0739f278a6

            SHA1

            06dc809d653c5d2c97386084ae13b50a73eb5b60

            SHA256

            8b00f9dce8ceb2123fba3bc9f88419960d1e661b6287eafeba4f0a2ee4be3d27

            SHA512

            19e3176ce1f154758f685cc4582e93587aa534a251de315473e35758dcd6ff6315880be7602097308dc89c355742be4729bad81de597e8d430a8e868082314e3

          • memory/1588-35-0x0000000000400000-0x0000000000428000-memory.dmp

            Filesize

            160KB

          • memory/1588-38-0x0000000000400000-0x0000000000428000-memory.dmp

            Filesize

            160KB

          • memory/1588-39-0x0000000000400000-0x0000000000428000-memory.dmp

            Filesize

            160KB

          • memory/1588-41-0x0000000000400000-0x0000000000428000-memory.dmp

            Filesize

            160KB