mystic | b7a22177e360d67969783ad1e39a20e47c5deef9e1b073ed9b01af266a24e84b

Analysis

max time kernel
162s
max time network
167s
platform
windows10-2004_x64
resource
win10v2004-20230915-en
resource tags

arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
submitted
11/10/2023, 05:21

Target

b7a22177e360d67969783ad1e39a20e47c5deef9e1b073ed9b01af266a24e84b.exe
Size

356KB
MD5

c4ffe788d29bf398461f92efa22b75ca
SHA1

afa7119a47247d390e179021eface7d0e9a288ad
SHA256

b7a22177e360d67969783ad1e39a20e47c5deef9e1b073ed9b01af266a24e84b
SHA512

cf0b9a2c858558fc0123968b01d32b4a40c994e3e532408ce455964fef74a6c0f3f8e9093fe345c7e5a2097f3be58216dfe9a956288f48fdd0c3f0d378d56bc7
SSDEEP

6144:nSTeW/s5GqrO5aXnfEGIXWPvZAOLyDBMRJPL/ozfoIz3FjUWwgVs0BC+:LmcGqrOk86xbRJTAzga3FjUWwMs0BC+

Score

10^/10

mystic stealer

Family

mystic

http://5.42.92.211/loghub/master

Detect Mystic stealer payload 5 IoCs

resource	yara_rule
behavioral2/memory/4120-0-0x0000000000400000-0x0000000000428000-memory.dmp	family_mystic
behavioral2/memory/4120-1-0x0000000000400000-0x0000000000428000-memory.dmp	family_mystic
behavioral2/memory/4120-2-0x0000000000400000-0x0000000000428000-memory.dmp	family_mystic
behavioral2/memory/4120-3-0x0000000000400000-0x0000000000428000-memory.dmp	family_mystic
behavioral2/memory/4120-4-0x0000000000400000-0x0000000000428000-memory.dmp	family_mystic

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1972 set thread context of 4120	1972	b7a22177e360d67969783ad1e39a20e47c5deef9e1b073ed9b01af266a24e84b.exe	87

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3032	1972	WerFault.exe	83

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 1972 wrote to memory of 4120	1972	b7a22177e360d67969783ad1e39a20e47c5deef9e1b073ed9b01af266a24e84b.exe	87
PID 1972 wrote to memory of 4120	1972	b7a22177e360d67969783ad1e39a20e47c5deef9e1b073ed9b01af266a24e84b.exe	87
PID 1972 wrote to memory of 4120	1972	b7a22177e360d67969783ad1e39a20e47c5deef9e1b073ed9b01af266a24e84b.exe	87
PID 1972 wrote to memory of 4120	1972	b7a22177e360d67969783ad1e39a20e47c5deef9e1b073ed9b01af266a24e84b.exe	87
PID 1972 wrote to memory of 4120	1972	b7a22177e360d67969783ad1e39a20e47c5deef9e1b073ed9b01af266a24e84b.exe	87
PID 1972 wrote to memory of 4120	1972	b7a22177e360d67969783ad1e39a20e47c5deef9e1b073ed9b01af266a24e84b.exe	87
PID 1972 wrote to memory of 4120	1972	b7a22177e360d67969783ad1e39a20e47c5deef9e1b073ed9b01af266a24e84b.exe	87
PID 1972 wrote to memory of 4120	1972	b7a22177e360d67969783ad1e39a20e47c5deef9e1b073ed9b01af266a24e84b.exe	87
PID 1972 wrote to memory of 4120	1972	b7a22177e360d67969783ad1e39a20e47c5deef9e1b073ed9b01af266a24e84b.exe	87
PID 1972 wrote to memory of 4120	1972	b7a22177e360d67969783ad1e39a20e47c5deef9e1b073ed9b01af266a24e84b.exe	87

C:\Users\Admin\AppData\Local\Temp\b7a22177e360d67969783ad1e39a20e47c5deef9e1b073ed9b01af266a24e84b.exe
"C:\Users\Admin\AppData\Local\Temp\b7a22177e360d67969783ad1e39a20e47c5deef9e1b073ed9b01af266a24e84b.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1972
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
  2⤵
  PID:4120
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1972 -s 136
  2⤵
  - Program crash
  PID:3032

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 1972 -ip 1972
1⤵
PID:436

memory/4120-0-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/4120-1-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/4120-2-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/4120-3-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/4120-4-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download