mystic | 69681a84faaa9db188bc47aa79ec4f8acbcc8b1452a59c86be9ea5e44f552d75

Analysis

max time kernel
143s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20230915-en
resource tags

arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
submitted
11/10/2023, 05:00

Target

file.exe
Size

356KB
MD5

fd9c5c946e997348c799dd7b397baeb6
SHA1

ea9665e25e9b542e6fdc760c6d0cf087ec3b3a42
SHA256

69681a84faaa9db188bc47aa79ec4f8acbcc8b1452a59c86be9ea5e44f552d75
SHA512

c15b3dc52edbb98e5d9ef04d7610861dd845e4b70e1b854e50faad5c20170b43b36e90d7d845c0561f5bbea345916765f6c7262594c5c48d6ba23c6b7a8615ab
SSDEEP

6144:DuTeW/s5GqrO5aXnfEGIXWPvZAOfykow2SGAn2KnIelfECnnnLURRlVs0BC+:DmcGqrOk86x/bnGKIwnnnYHs0BC+

Score

10^/10

mystic stealer

Family

mystic

http://5.42.92.211/loghub/master

Detect Mystic stealer payload 5 IoCs

resource	yara_rule
behavioral2/memory/1600-1-0x0000000000400000-0x0000000000428000-memory.dmp	family_mystic
behavioral2/memory/1600-0-0x0000000000400000-0x0000000000428000-memory.dmp	family_mystic
behavioral2/memory/1600-2-0x0000000000400000-0x0000000000428000-memory.dmp	family_mystic
behavioral2/memory/1600-3-0x0000000000400000-0x0000000000428000-memory.dmp	family_mystic
behavioral2/memory/1600-4-0x0000000000400000-0x0000000000428000-memory.dmp	family_mystic

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 440 set thread context of 1600	440	file.exe	84

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1072	440	WerFault.exe	81

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 440 wrote to memory of 1600	440	file.exe	84
PID 440 wrote to memory of 1600	440	file.exe	84
PID 440 wrote to memory of 1600	440	file.exe	84
PID 440 wrote to memory of 1600	440	file.exe	84
PID 440 wrote to memory of 1600	440	file.exe	84
PID 440 wrote to memory of 1600	440	file.exe	84
PID 440 wrote to memory of 1600	440	file.exe	84
PID 440 wrote to memory of 1600	440	file.exe	84
PID 440 wrote to memory of 1600	440	file.exe	84
PID 440 wrote to memory of 1600	440	file.exe	84

C:\Users\Admin\AppData\Local\Temp\file.exe
"C:\Users\Admin\AppData\Local\Temp\file.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:440
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
  2⤵
  PID:1600
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 440 -s 136
  2⤵
  - Program crash
  PID:1072

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 440 -ip 440
1⤵
PID:4444

memory/1600-1-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/1600-0-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/1600-2-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/1600-3-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/1600-4-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download