mystic | a1f687030c0e6bd6884cb8ac0db4a617709d07518c5e98622d1944628d9526c0

Analysis

max time kernel
139s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20230915-en
resource tags

arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
submitted
11/10/2023, 06:20

Target

file.exe
Size

356KB
MD5

e187555fb5581d1568eddf7ac7b79e82
SHA1

b11ed3d7c53e99ad8a3e8b74d115c82aa687c12c
SHA256

a1f687030c0e6bd6884cb8ac0db4a617709d07518c5e98622d1944628d9526c0
SHA512

05e91b8fc5d5331d8f74d7511a437889eaed807e7908a328ea8aad5059ad2468f8dc4b8ffc7e370e12d8f5921d50ce8cf4b4635c13bc5832fc8a8e114b14d583
SSDEEP

6144:uSTeW/s5GqrO5aXnfEGIXWPvZAOpyzviKtC6TQ35M4NZ5/Vs0BC+:4mcGqrOk86xHb3L5ts0BC+

Score

10^/10

mystic stealer

Family

mystic

http://5.42.92.211/loghub/master

Detect Mystic stealer payload 5 IoCs

resource	yara_rule
behavioral2/memory/4792-0-0x0000000000400000-0x0000000000428000-memory.dmp	family_mystic
behavioral2/memory/4792-1-0x0000000000400000-0x0000000000428000-memory.dmp	family_mystic
behavioral2/memory/4792-2-0x0000000000400000-0x0000000000428000-memory.dmp	family_mystic
behavioral2/memory/4792-3-0x0000000000400000-0x0000000000428000-memory.dmp	family_mystic
behavioral2/memory/4792-4-0x0000000000400000-0x0000000000428000-memory.dmp	family_mystic

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3604 set thread context of 4792	3604	file.exe	86

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4848	3604	WerFault.exe	81

Suspicious use of WriteProcessMemory 16 IoCs

description	pid	Process	procid_target
PID 3604 wrote to memory of 4920	3604	file.exe	84
PID 3604 wrote to memory of 4920	3604	file.exe	84
PID 3604 wrote to memory of 4920	3604	file.exe	84
PID 3604 wrote to memory of 1268	3604	file.exe	85
PID 3604 wrote to memory of 1268	3604	file.exe	85
PID 3604 wrote to memory of 1268	3604	file.exe	85
PID 3604 wrote to memory of 4792	3604	file.exe	86
PID 3604 wrote to memory of 4792	3604	file.exe	86
PID 3604 wrote to memory of 4792	3604	file.exe	86
PID 3604 wrote to memory of 4792	3604	file.exe	86
PID 3604 wrote to memory of 4792	3604	file.exe	86
PID 3604 wrote to memory of 4792	3604	file.exe	86
PID 3604 wrote to memory of 4792	3604	file.exe	86
PID 3604 wrote to memory of 4792	3604	file.exe	86
PID 3604 wrote to memory of 4792	3604	file.exe	86
PID 3604 wrote to memory of 4792	3604	file.exe	86

C:\Users\Admin\AppData\Local\Temp\file.exe
"C:\Users\Admin\AppData\Local\Temp\file.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3604
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
  2⤵
  PID:4920
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
  2⤵
  PID:1268
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
  2⤵
  PID:4792
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3604 -s 292
  2⤵
  - Program crash
  PID:4848

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 464 -p 3604 -ip 3604
1⤵
PID:540

memory/4792-0-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/4792-1-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/4792-2-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/4792-3-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/4792-4-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download