mystic | f619c235ccdba30a5e9167cf82c2154178611f4829fd548bb69cd5ea1dc32a0b

Analysis

max time kernel
128s
max time network
136s
platform
windows10-1703_x64
resource
win10-20230915-en
resource tags

arch:x64arch:x86image:win10-20230915-enlocale:en-usos:windows10-1703-x64system
submitted
07/10/2023, 12:07

Target

f619c235ccdba30a5e9167cf82c2154178611f4829fd548bb69cd5ea1dc32a0b.exe
Size

378KB
MD5

e30182acc0b38c1fee525bf1be571e2e
SHA1

f137e2008b2b9788d75bc3a060900630948df2a8
SHA256

f619c235ccdba30a5e9167cf82c2154178611f4829fd548bb69cd5ea1dc32a0b
SHA512

d3b3eb81ce3a936f6996bab38e1d923ed296c719c8efe794bbddb76b40207829a882e7e0f2cb94abafb86cd7a4b56206c0a677887bffdb219799e59743776e6e
SSDEEP

6144:74HS992pCryG4kfjSGwEi56AO/Gtb4v8DeBhWY9eW2ogluNUswem6J0D:74Hq2wryNSwtM3v7VUgWD

Score

10^/10

mystic stealer

Family

mystic

http://5.42.92.211/loghub/master

Detect Mystic stealer payload 5 IoCs

resource	yara_rule
behavioral1/memory/4776-0-0x0000000000400000-0x0000000000428000-memory.dmp	family_mystic
behavioral1/memory/4776-3-0x0000000000400000-0x0000000000428000-memory.dmp	family_mystic
behavioral1/memory/4776-4-0x0000000000400000-0x0000000000428000-memory.dmp	family_mystic
behavioral1/memory/4776-5-0x0000000000400000-0x0000000000428000-memory.dmp	family_mystic
behavioral1/memory/4776-6-0x0000000000400000-0x0000000000428000-memory.dmp	family_mystic

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2504 set thread context of 4776	2504	f619c235ccdba30a5e9167cf82c2154178611f4829fd548bb69cd5ea1dc32a0b.exe	71

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1356	2504	WerFault.exe	69

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 2504 wrote to memory of 4776	2504	f619c235ccdba30a5e9167cf82c2154178611f4829fd548bb69cd5ea1dc32a0b.exe	71
PID 2504 wrote to memory of 4776	2504	f619c235ccdba30a5e9167cf82c2154178611f4829fd548bb69cd5ea1dc32a0b.exe	71
PID 2504 wrote to memory of 4776	2504	f619c235ccdba30a5e9167cf82c2154178611f4829fd548bb69cd5ea1dc32a0b.exe	71
PID 2504 wrote to memory of 4776	2504	f619c235ccdba30a5e9167cf82c2154178611f4829fd548bb69cd5ea1dc32a0b.exe	71
PID 2504 wrote to memory of 4776	2504	f619c235ccdba30a5e9167cf82c2154178611f4829fd548bb69cd5ea1dc32a0b.exe	71
PID 2504 wrote to memory of 4776	2504	f619c235ccdba30a5e9167cf82c2154178611f4829fd548bb69cd5ea1dc32a0b.exe	71
PID 2504 wrote to memory of 4776	2504	f619c235ccdba30a5e9167cf82c2154178611f4829fd548bb69cd5ea1dc32a0b.exe	71
PID 2504 wrote to memory of 4776	2504	f619c235ccdba30a5e9167cf82c2154178611f4829fd548bb69cd5ea1dc32a0b.exe	71
PID 2504 wrote to memory of 4776	2504	f619c235ccdba30a5e9167cf82c2154178611f4829fd548bb69cd5ea1dc32a0b.exe	71
PID 2504 wrote to memory of 4776	2504	f619c235ccdba30a5e9167cf82c2154178611f4829fd548bb69cd5ea1dc32a0b.exe	71

C:\Users\Admin\AppData\Local\Temp\f619c235ccdba30a5e9167cf82c2154178611f4829fd548bb69cd5ea1dc32a0b.exe
"C:\Users\Admin\AppData\Local\Temp\f619c235ccdba30a5e9167cf82c2154178611f4829fd548bb69cd5ea1dc32a0b.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2504
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
  2⤵
  PID:4776
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2504 -s 132
  2⤵
  - Program crash
  PID:1356

memory/4776-0-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/4776-3-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/4776-4-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/4776-5-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/4776-6-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download