Analysis

  • max time kernel
    120s
  • max time network
    124s
  • platform
    windows7_x64
  • resource
    win7-20230831-en
  • resource tags

    arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
  • submitted
    07/10/2023, 12:34

General

  • Target

    NEAS.78c241ee205336f9ce449c104b1ea7608d71c8489aa07f4f55a84ae6d27ce915_JC.exe

  • Size

    1.2MB

  • MD5

    abb7f8218366424a14a301054fc2ed57

  • SHA1

    7f4884c03fa7103606b7ae4e2b90b1d2f133c6de

  • SHA256

    78c241ee205336f9ce449c104b1ea7608d71c8489aa07f4f55a84ae6d27ce915

  • SHA512

    272a0dfe6d314f0c0d11b294e61ca295487883b2efea846182ed486d62463bfa26a315ee964d1591a91bdd69c8118ca5125cec6a1b9ed0fdc20e525a278ef947

  • SSDEEP

    24576:jymuXXxHJ27jd+Rdmkr84+TVkhuBFTj+x3Cmo5bpr1gEJ2:2mun727R+vrr9A+xymGpr1P

Malware Config

Signatures

  • Detect Mystic stealer payload 6 IoCs
  • Mystic

    Mystic is an infostealer written in C++.

  • Executes dropped EXE 5 IoCs
  • Loads dropped DLL 15 IoCs
  • Adds Run key to start application 2 TTPs 5 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Program crash 2 IoCs
  • Suspicious use of WriteProcessMemory 63 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\NEAS.78c241ee205336f9ce449c104b1ea7608d71c8489aa07f4f55a84ae6d27ce915_JC.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.78c241ee205336f9ce449c104b1ea7608d71c8489aa07f4f55a84ae6d27ce915_JC.exe"
    1⤵
    • Loads dropped DLL
    • Adds Run key to start application
    • Suspicious use of WriteProcessMemory
    PID:3060
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Yd0ce7ny.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Yd0ce7ny.exe
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Adds Run key to start application
      • Suspicious use of WriteProcessMemory
      PID:2832
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qY5EC2RY.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qY5EC2RY.exe
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Adds Run key to start application
        • Suspicious use of WriteProcessMemory
        PID:2704
        • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\lm7yb0Gr.exe
          C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\lm7yb0Gr.exe
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Adds Run key to start application
          • Suspicious use of WriteProcessMemory
          PID:2672
          • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\pp7ke4xk.exe
            C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\pp7ke4xk.exe
            5⤵
            • Executes dropped EXE
            • Loads dropped DLL
            • Adds Run key to start application
            • Suspicious use of WriteProcessMemory
            PID:2692
            • C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\1Ac90eU7.exe
              C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\1Ac90eU7.exe
              6⤵
              • Executes dropped EXE
              • Loads dropped DLL
              • Suspicious use of SetThreadContext
              • Suspicious use of WriteProcessMemory
              PID:1940
              • C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
                "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
                7⤵
                • Suspicious use of WriteProcessMemory
                PID:1844
                • C:\Windows\SysWOW64\WerFault.exe
                  C:\Windows\SysWOW64\WerFault.exe -u -p 1844 -s 268
                  8⤵
                  • Program crash
                  PID:3032
              • C:\Windows\SysWOW64\WerFault.exe
                C:\Windows\SysWOW64\WerFault.exe -u -p 1940 -s 284
                7⤵
                • Loads dropped DLL
                • Program crash
                PID:812

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Yd0ce7ny.exe

    Filesize

    1.0MB

    MD5

    a1c095e45a0b6da572598ef9c33f6089

    SHA1

    e4bdb84695b0a9db2794c26564f6b3639265dcec

    SHA256

    3dafd1c231623b4b65d76c167a8d92704983238cb4aed68a779360d8ef05123b

    SHA512

    5a3c7b5b341acba103a323ea4478e2aac17d253505025b1e4a8ecdb261832374056bd929e0deae15bd07a20480b5df448d06e511ac3b5895709d852698bc700e

  • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Yd0ce7ny.exe

    Filesize

    1.0MB

    MD5

    a1c095e45a0b6da572598ef9c33f6089

    SHA1

    e4bdb84695b0a9db2794c26564f6b3639265dcec

    SHA256

    3dafd1c231623b4b65d76c167a8d92704983238cb4aed68a779360d8ef05123b

    SHA512

    5a3c7b5b341acba103a323ea4478e2aac17d253505025b1e4a8ecdb261832374056bd929e0deae15bd07a20480b5df448d06e511ac3b5895709d852698bc700e

  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qY5EC2RY.exe

    Filesize

    884KB

    MD5

    ad819fd2029df5dd620823ced7b665b6

    SHA1

    006a40c51bb81393ddc1b783094bbab02bdea40b

    SHA256

    7046ce53a440d1b8b0d6e66b8318be07fbeb7247f7763edc9a80b4daf9b01bd5

    SHA512

    75581eb0b5eb76bcbf813eb6e28a513fad3e10f6bef6c337ee72e7d7fb115539ef33d94ea16f6caade4e134042604db300edd6d819f6d6bef5f0108832889aa5

  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qY5EC2RY.exe

    Filesize

    884KB

    MD5

    ad819fd2029df5dd620823ced7b665b6

    SHA1

    006a40c51bb81393ddc1b783094bbab02bdea40b

    SHA256

    7046ce53a440d1b8b0d6e66b8318be07fbeb7247f7763edc9a80b4daf9b01bd5

    SHA512

    75581eb0b5eb76bcbf813eb6e28a513fad3e10f6bef6c337ee72e7d7fb115539ef33d94ea16f6caade4e134042604db300edd6d819f6d6bef5f0108832889aa5

  • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\lm7yb0Gr.exe

    Filesize

    590KB

    MD5

    6ff6f59572e911314649d156c6548097

    SHA1

    9d05079ae5f8c2b84067a794e604ac8058daba79

    SHA256

    ffe72c96ccd0a4387ccd3de954dd570103ef02596f61522622e2f064d44100fb

    SHA512

    1503a6278bdbfb778e58842c0c793da7c604ddc4bd172809571880cd60b06b243c61e53596464fc5b9869418f3082c768e7a67270c21cf553cce35dcbf271166

  • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\lm7yb0Gr.exe

    Filesize

    590KB

    MD5

    6ff6f59572e911314649d156c6548097

    SHA1

    9d05079ae5f8c2b84067a794e604ac8058daba79

    SHA256

    ffe72c96ccd0a4387ccd3de954dd570103ef02596f61522622e2f064d44100fb

    SHA512

    1503a6278bdbfb778e58842c0c793da7c604ddc4bd172809571880cd60b06b243c61e53596464fc5b9869418f3082c768e7a67270c21cf553cce35dcbf271166

  • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\pp7ke4xk.exe

    Filesize

    417KB

    MD5

    b81c6566a86ba4a9e4306c26e5baa9c8

    SHA1

    779b73cfedf3b57a76f864f1627aa0d29c794419

    SHA256

    0febaf03222ad3abf0405f14154ae39df890f6bb73d6ad97bfe55901f9bdc434

    SHA512

    a7321204f4125e40a2919f0a9db48493e52105eba6d408f5c0f495493e5bfe0a5a924f44b7d95899a21c0d0f6a4d7300c4fbd121477b49e9555ef8b3656002ec

  • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\pp7ke4xk.exe

    Filesize

    417KB

    MD5

    b81c6566a86ba4a9e4306c26e5baa9c8

    SHA1

    779b73cfedf3b57a76f864f1627aa0d29c794419

    SHA256

    0febaf03222ad3abf0405f14154ae39df890f6bb73d6ad97bfe55901f9bdc434

    SHA512

    a7321204f4125e40a2919f0a9db48493e52105eba6d408f5c0f495493e5bfe0a5a924f44b7d95899a21c0d0f6a4d7300c4fbd121477b49e9555ef8b3656002ec

  • C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\1Ac90eU7.exe

    Filesize

    378KB

    MD5

    f0831f173733de08511f3a0739f278a6

    SHA1

    06dc809d653c5d2c97386084ae13b50a73eb5b60

    SHA256

    8b00f9dce8ceb2123fba3bc9f88419960d1e661b6287eafeba4f0a2ee4be3d27

    SHA512

    19e3176ce1f154758f685cc4582e93587aa534a251de315473e35758dcd6ff6315880be7602097308dc89c355742be4729bad81de597e8d430a8e868082314e3

  • C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\1Ac90eU7.exe

    Filesize

    378KB

    MD5

    f0831f173733de08511f3a0739f278a6

    SHA1

    06dc809d653c5d2c97386084ae13b50a73eb5b60

    SHA256

    8b00f9dce8ceb2123fba3bc9f88419960d1e661b6287eafeba4f0a2ee4be3d27

    SHA512

    19e3176ce1f154758f685cc4582e93587aa534a251de315473e35758dcd6ff6315880be7602097308dc89c355742be4729bad81de597e8d430a8e868082314e3

  • C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\1Ac90eU7.exe

    Filesize

    378KB

    MD5

    f0831f173733de08511f3a0739f278a6

    SHA1

    06dc809d653c5d2c97386084ae13b50a73eb5b60

    SHA256

    8b00f9dce8ceb2123fba3bc9f88419960d1e661b6287eafeba4f0a2ee4be3d27

    SHA512

    19e3176ce1f154758f685cc4582e93587aa534a251de315473e35758dcd6ff6315880be7602097308dc89c355742be4729bad81de597e8d430a8e868082314e3

  • \Users\Admin\AppData\Local\Temp\IXP000.TMP\Yd0ce7ny.exe

    Filesize

    1.0MB

    MD5

    a1c095e45a0b6da572598ef9c33f6089

    SHA1

    e4bdb84695b0a9db2794c26564f6b3639265dcec

    SHA256

    3dafd1c231623b4b65d76c167a8d92704983238cb4aed68a779360d8ef05123b

    SHA512

    5a3c7b5b341acba103a323ea4478e2aac17d253505025b1e4a8ecdb261832374056bd929e0deae15bd07a20480b5df448d06e511ac3b5895709d852698bc700e

  • \Users\Admin\AppData\Local\Temp\IXP000.TMP\Yd0ce7ny.exe

    Filesize

    1.0MB

    MD5

    a1c095e45a0b6da572598ef9c33f6089

    SHA1

    e4bdb84695b0a9db2794c26564f6b3639265dcec

    SHA256

    3dafd1c231623b4b65d76c167a8d92704983238cb4aed68a779360d8ef05123b

    SHA512

    5a3c7b5b341acba103a323ea4478e2aac17d253505025b1e4a8ecdb261832374056bd929e0deae15bd07a20480b5df448d06e511ac3b5895709d852698bc700e

  • \Users\Admin\AppData\Local\Temp\IXP001.TMP\qY5EC2RY.exe

    Filesize

    884KB

    MD5

    ad819fd2029df5dd620823ced7b665b6

    SHA1

    006a40c51bb81393ddc1b783094bbab02bdea40b

    SHA256

    7046ce53a440d1b8b0d6e66b8318be07fbeb7247f7763edc9a80b4daf9b01bd5

    SHA512

    75581eb0b5eb76bcbf813eb6e28a513fad3e10f6bef6c337ee72e7d7fb115539ef33d94ea16f6caade4e134042604db300edd6d819f6d6bef5f0108832889aa5

  • \Users\Admin\AppData\Local\Temp\IXP001.TMP\qY5EC2RY.exe

    Filesize

    884KB

    MD5

    ad819fd2029df5dd620823ced7b665b6

    SHA1

    006a40c51bb81393ddc1b783094bbab02bdea40b

    SHA256

    7046ce53a440d1b8b0d6e66b8318be07fbeb7247f7763edc9a80b4daf9b01bd5

    SHA512

    75581eb0b5eb76bcbf813eb6e28a513fad3e10f6bef6c337ee72e7d7fb115539ef33d94ea16f6caade4e134042604db300edd6d819f6d6bef5f0108832889aa5

  • \Users\Admin\AppData\Local\Temp\IXP002.TMP\lm7yb0Gr.exe

    Filesize

    590KB

    MD5

    6ff6f59572e911314649d156c6548097

    SHA1

    9d05079ae5f8c2b84067a794e604ac8058daba79

    SHA256

    ffe72c96ccd0a4387ccd3de954dd570103ef02596f61522622e2f064d44100fb

    SHA512

    1503a6278bdbfb778e58842c0c793da7c604ddc4bd172809571880cd60b06b243c61e53596464fc5b9869418f3082c768e7a67270c21cf553cce35dcbf271166

  • \Users\Admin\AppData\Local\Temp\IXP002.TMP\lm7yb0Gr.exe

    Filesize

    590KB

    MD5

    6ff6f59572e911314649d156c6548097

    SHA1

    9d05079ae5f8c2b84067a794e604ac8058daba79

    SHA256

    ffe72c96ccd0a4387ccd3de954dd570103ef02596f61522622e2f064d44100fb

    SHA512

    1503a6278bdbfb778e58842c0c793da7c604ddc4bd172809571880cd60b06b243c61e53596464fc5b9869418f3082c768e7a67270c21cf553cce35dcbf271166

  • \Users\Admin\AppData\Local\Temp\IXP003.TMP\pp7ke4xk.exe

    Filesize

    417KB

    MD5

    b81c6566a86ba4a9e4306c26e5baa9c8

    SHA1

    779b73cfedf3b57a76f864f1627aa0d29c794419

    SHA256

    0febaf03222ad3abf0405f14154ae39df890f6bb73d6ad97bfe55901f9bdc434

    SHA512

    a7321204f4125e40a2919f0a9db48493e52105eba6d408f5c0f495493e5bfe0a5a924f44b7d95899a21c0d0f6a4d7300c4fbd121477b49e9555ef8b3656002ec

  • \Users\Admin\AppData\Local\Temp\IXP003.TMP\pp7ke4xk.exe

    Filesize

    417KB

    MD5

    b81c6566a86ba4a9e4306c26e5baa9c8

    SHA1

    779b73cfedf3b57a76f864f1627aa0d29c794419

    SHA256

    0febaf03222ad3abf0405f14154ae39df890f6bb73d6ad97bfe55901f9bdc434

    SHA512

    a7321204f4125e40a2919f0a9db48493e52105eba6d408f5c0f495493e5bfe0a5a924f44b7d95899a21c0d0f6a4d7300c4fbd121477b49e9555ef8b3656002ec

  • \Users\Admin\AppData\Local\Temp\IXP004.TMP\1Ac90eU7.exe

    Filesize

    378KB

    MD5

    f0831f173733de08511f3a0739f278a6

    SHA1

    06dc809d653c5d2c97386084ae13b50a73eb5b60

    SHA256

    8b00f9dce8ceb2123fba3bc9f88419960d1e661b6287eafeba4f0a2ee4be3d27

    SHA512

    19e3176ce1f154758f685cc4582e93587aa534a251de315473e35758dcd6ff6315880be7602097308dc89c355742be4729bad81de597e8d430a8e868082314e3

  • \Users\Admin\AppData\Local\Temp\IXP004.TMP\1Ac90eU7.exe

    Filesize

    378KB

    MD5

    f0831f173733de08511f3a0739f278a6

    SHA1

    06dc809d653c5d2c97386084ae13b50a73eb5b60

    SHA256

    8b00f9dce8ceb2123fba3bc9f88419960d1e661b6287eafeba4f0a2ee4be3d27

    SHA512

    19e3176ce1f154758f685cc4582e93587aa534a251de315473e35758dcd6ff6315880be7602097308dc89c355742be4729bad81de597e8d430a8e868082314e3

  • \Users\Admin\AppData\Local\Temp\IXP004.TMP\1Ac90eU7.exe

    Filesize

    378KB

    MD5

    f0831f173733de08511f3a0739f278a6

    SHA1

    06dc809d653c5d2c97386084ae13b50a73eb5b60

    SHA256

    8b00f9dce8ceb2123fba3bc9f88419960d1e661b6287eafeba4f0a2ee4be3d27

    SHA512

    19e3176ce1f154758f685cc4582e93587aa534a251de315473e35758dcd6ff6315880be7602097308dc89c355742be4729bad81de597e8d430a8e868082314e3

  • \Users\Admin\AppData\Local\Temp\IXP004.TMP\1Ac90eU7.exe

    Filesize

    378KB

    MD5

    f0831f173733de08511f3a0739f278a6

    SHA1

    06dc809d653c5d2c97386084ae13b50a73eb5b60

    SHA256

    8b00f9dce8ceb2123fba3bc9f88419960d1e661b6287eafeba4f0a2ee4be3d27

    SHA512

    19e3176ce1f154758f685cc4582e93587aa534a251de315473e35758dcd6ff6315880be7602097308dc89c355742be4729bad81de597e8d430a8e868082314e3

  • \Users\Admin\AppData\Local\Temp\IXP004.TMP\1Ac90eU7.exe

    Filesize

    378KB

    MD5

    f0831f173733de08511f3a0739f278a6

    SHA1

    06dc809d653c5d2c97386084ae13b50a73eb5b60

    SHA256

    8b00f9dce8ceb2123fba3bc9f88419960d1e661b6287eafeba4f0a2ee4be3d27

    SHA512

    19e3176ce1f154758f685cc4582e93587aa534a251de315473e35758dcd6ff6315880be7602097308dc89c355742be4729bad81de597e8d430a8e868082314e3

  • \Users\Admin\AppData\Local\Temp\IXP004.TMP\1Ac90eU7.exe

    Filesize

    378KB

    MD5

    f0831f173733de08511f3a0739f278a6

    SHA1

    06dc809d653c5d2c97386084ae13b50a73eb5b60

    SHA256

    8b00f9dce8ceb2123fba3bc9f88419960d1e661b6287eafeba4f0a2ee4be3d27

    SHA512

    19e3176ce1f154758f685cc4582e93587aa534a251de315473e35758dcd6ff6315880be7602097308dc89c355742be4729bad81de597e8d430a8e868082314e3

  • \Users\Admin\AppData\Local\Temp\IXP004.TMP\1Ac90eU7.exe

    Filesize

    378KB

    MD5

    f0831f173733de08511f3a0739f278a6

    SHA1

    06dc809d653c5d2c97386084ae13b50a73eb5b60

    SHA256

    8b00f9dce8ceb2123fba3bc9f88419960d1e661b6287eafeba4f0a2ee4be3d27

    SHA512

    19e3176ce1f154758f685cc4582e93587aa534a251de315473e35758dcd6ff6315880be7602097308dc89c355742be4729bad81de597e8d430a8e868082314e3

  • memory/1844-54-0x0000000000400000-0x0000000000428000-memory.dmp

    Filesize

    160KB

  • memory/1844-58-0x0000000000400000-0x0000000000428000-memory.dmp

    Filesize

    160KB

  • memory/1844-59-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmp

    Filesize

    4KB

  • memory/1844-60-0x0000000000400000-0x0000000000428000-memory.dmp

    Filesize

    160KB

  • memory/1844-62-0x0000000000400000-0x0000000000428000-memory.dmp

    Filesize

    160KB

  • memory/1844-64-0x0000000000400000-0x0000000000428000-memory.dmp

    Filesize

    160KB

  • memory/1844-57-0x0000000000400000-0x0000000000428000-memory.dmp

    Filesize

    160KB

  • memory/1844-56-0x0000000000400000-0x0000000000428000-memory.dmp

    Filesize

    160KB

  • memory/1844-55-0x0000000000400000-0x0000000000428000-memory.dmp

    Filesize

    160KB

  • memory/1844-53-0x0000000000400000-0x0000000000428000-memory.dmp

    Filesize

    160KB