mystic | 69681a84faaa9db188bc47aa79ec4f8acbcc8b1452a59c86be9ea5e44f552d75

Analysis

max time kernel
121s
max time network
129s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
11-10-2023 05:00

Target

file.exe
Size

356KB
MD5

fd9c5c946e997348c799dd7b397baeb6
SHA1

ea9665e25e9b542e6fdc760c6d0cf087ec3b3a42
SHA256

69681a84faaa9db188bc47aa79ec4f8acbcc8b1452a59c86be9ea5e44f552d75
SHA512

c15b3dc52edbb98e5d9ef04d7610861dd845e4b70e1b854e50faad5c20170b43b36e90d7d845c0561f5bbea345916765f6c7262594c5c48d6ba23c6b7a8615ab
SSDEEP

6144:DuTeW/s5GqrO5aXnfEGIXWPvZAOfykow2SGAn2KnIelfECnnnLURRlVs0BC+:DmcGqrOk86x/bnGKIwnnnYHs0BC+

Score

10^/10

mystic stealer

Family

mystic

http://5.42.92.211/loghub/master

Detect Mystic stealer payload 8 IoCs

resource	yara_rule
behavioral1/memory/2448-9-0x0000000000400000-0x0000000000428000-memory.dmp	family_mystic
behavioral1/memory/2448-7-0x0000000000400000-0x0000000000428000-memory.dmp	family_mystic
behavioral1/memory/2448-6-0x0000000000400000-0x0000000000428000-memory.dmp	family_mystic
behavioral1/memory/2448-11-0x0000000000400000-0x0000000000428000-memory.dmp	family_mystic
behavioral1/memory/2448-5-0x0000000000400000-0x0000000000428000-memory.dmp	family_mystic
behavioral1/memory/2448-13-0x0000000000400000-0x0000000000428000-memory.dmp	family_mystic
behavioral1/memory/2448-14-0x0000000000400000-0x0000000000428000-memory.dmp	family_mystic
behavioral1/memory/2448-15-0x0000000000400000-0x0000000000428000-memory.dmp	family_mystic

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1448 set thread context of 2448	1448	file.exe	29

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3040	1448	WerFault.exe	27

Suspicious use of WriteProcessMemory 18 IoCs

description	pid	Process	procid_target
PID 1448 wrote to memory of 2448	1448	file.exe	29
PID 1448 wrote to memory of 2448	1448	file.exe	29
PID 1448 wrote to memory of 2448	1448	file.exe	29
PID 1448 wrote to memory of 2448	1448	file.exe	29
PID 1448 wrote to memory of 2448	1448	file.exe	29
PID 1448 wrote to memory of 2448	1448	file.exe	29
PID 1448 wrote to memory of 2448	1448	file.exe	29
PID 1448 wrote to memory of 2448	1448	file.exe	29
PID 1448 wrote to memory of 2448	1448	file.exe	29
PID 1448 wrote to memory of 2448	1448	file.exe	29
PID 1448 wrote to memory of 2448	1448	file.exe	29
PID 1448 wrote to memory of 2448	1448	file.exe	29
PID 1448 wrote to memory of 2448	1448	file.exe	29
PID 1448 wrote to memory of 2448	1448	file.exe	29
PID 1448 wrote to memory of 3040	1448	file.exe	30
PID 1448 wrote to memory of 3040	1448	file.exe	30
PID 1448 wrote to memory of 3040	1448	file.exe	30
PID 1448 wrote to memory of 3040	1448	file.exe	30

C:\Users\Admin\AppData\Local\Temp\file.exe
"C:\Users\Admin\AppData\Local\Temp\file.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1448
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
  2⤵
  PID:2448
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1448 -s 76
  2⤵
  - Program crash
  PID:3040

memory/2448-0-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/2448-8-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmp

Filesize
4KB

Download
memory/2448-9-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/2448-7-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/2448-6-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/2448-11-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/2448-5-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/2448-4-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/2448-2-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/2448-13-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/2448-14-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/2448-15-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download