mystic | b16e31a3de24e53c79029c6d6ac71401fde56be91191579686306dd6947106e1

Analysis

max time kernel
143s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20230915-en
resource tags

arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
submitted
07/10/2023, 17:04

Target

b16e31a3de24e53c79029c6d6ac71401fde56be91191579686306dd6947106e1.exe
Size

378KB
MD5

26f3befa52df906bf8e8101bfadf11fc
SHA1

db0b192549032229e3a516e8f43edfc2870f7cb0
SHA256

b16e31a3de24e53c79029c6d6ac71401fde56be91191579686306dd6947106e1
SHA512

b217bcdd4af61b54f7a139aa92184d97123d6da5e118a63cbe032feda9c05bcec6057d0665c581db0fc57aaf306ee104b4ff50f69193b97a0e0acb83b20ad02c
SSDEEP

6144:84CSF92pCryG4kfjSGwEi56AOCGW8Mthi8UtLA3aGnPWD9l4VHR0D:84Cu2wryNSfWHthPXP+rD

Score

10^/10

mystic stealer

Family

mystic

http://5.42.92.211/loghub/master

Detect Mystic stealer payload 5 IoCs

resource	yara_rule
behavioral1/memory/1012-0-0x0000000000400000-0x0000000000428000-memory.dmp	family_mystic
behavioral1/memory/1012-1-0x0000000000400000-0x0000000000428000-memory.dmp	family_mystic
behavioral1/memory/1012-2-0x0000000000400000-0x0000000000428000-memory.dmp	family_mystic
behavioral1/memory/1012-3-0x0000000000400000-0x0000000000428000-memory.dmp	family_mystic
behavioral1/memory/1012-4-0x0000000000400000-0x0000000000428000-memory.dmp	family_mystic

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1276 set thread context of 1012	1276	b16e31a3de24e53c79029c6d6ac71401fde56be91191579686306dd6947106e1.exe	87

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4148	1276	WerFault.exe	84

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 1276 wrote to memory of 1012	1276	b16e31a3de24e53c79029c6d6ac71401fde56be91191579686306dd6947106e1.exe	87
PID 1276 wrote to memory of 1012	1276	b16e31a3de24e53c79029c6d6ac71401fde56be91191579686306dd6947106e1.exe	87
PID 1276 wrote to memory of 1012	1276	b16e31a3de24e53c79029c6d6ac71401fde56be91191579686306dd6947106e1.exe	87
PID 1276 wrote to memory of 1012	1276	b16e31a3de24e53c79029c6d6ac71401fde56be91191579686306dd6947106e1.exe	87
PID 1276 wrote to memory of 1012	1276	b16e31a3de24e53c79029c6d6ac71401fde56be91191579686306dd6947106e1.exe	87
PID 1276 wrote to memory of 1012	1276	b16e31a3de24e53c79029c6d6ac71401fde56be91191579686306dd6947106e1.exe	87
PID 1276 wrote to memory of 1012	1276	b16e31a3de24e53c79029c6d6ac71401fde56be91191579686306dd6947106e1.exe	87
PID 1276 wrote to memory of 1012	1276	b16e31a3de24e53c79029c6d6ac71401fde56be91191579686306dd6947106e1.exe	87
PID 1276 wrote to memory of 1012	1276	b16e31a3de24e53c79029c6d6ac71401fde56be91191579686306dd6947106e1.exe	87
PID 1276 wrote to memory of 1012	1276	b16e31a3de24e53c79029c6d6ac71401fde56be91191579686306dd6947106e1.exe	87

C:\Users\Admin\AppData\Local\Temp\b16e31a3de24e53c79029c6d6ac71401fde56be91191579686306dd6947106e1.exe
"C:\Users\Admin\AppData\Local\Temp\b16e31a3de24e53c79029c6d6ac71401fde56be91191579686306dd6947106e1.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1276
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
  2⤵
  PID:1012
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1276 -s 136
  2⤵
  - Program crash
  PID:4148

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 1276 -ip 1276
1⤵
PID:1948

memory/1012-0-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/1012-1-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/1012-2-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/1012-3-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/1012-4-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download