mystic | e8d64a783e8e02f927a12be9ecb7f413fb03916cfebcb0a198bce1e37b9e5554

Analysis

max time kernel
118s
max time network
123s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
11/10/2023, 07:25

Target

file.exe
Size

1016KB
MD5

bc65d604465049597b656b73b1afd328
SHA1

6a9160a225faf54cea360ebcaaf95515d4934c46
SHA256

e8d64a783e8e02f927a12be9ecb7f413fb03916cfebcb0a198bce1e37b9e5554
SHA512

cdc1c5047dccffeab279ff9c42b32f08837f00a681e86b9bb3853ec694f85118bc6c5b9a611fdf6e2e84cfb3ca9a29d25bb215576242f7345eb69e7f644b599e
SSDEEP

12288:T+mAovYIBYDKzcx9jkmP8bey7/0RDMmZZxnyUuyyu6pbqFghgL/9:TH/YDKzcx9jkmPe/knxyf0FghC9

Score

10^/10

mystic stealer

Detect Mystic stealer payload 6 IoCs

resource	yara_rule
behavioral1/memory/2888-4-0x0000000000400000-0x0000000000428000-memory.dmp	family_mystic
behavioral1/memory/2888-8-0x0000000000400000-0x0000000000428000-memory.dmp	family_mystic
behavioral1/memory/2888-6-0x0000000000400000-0x0000000000428000-memory.dmp	family_mystic
behavioral1/memory/2888-11-0x0000000000400000-0x0000000000428000-memory.dmp	family_mystic
behavioral1/memory/2888-13-0x0000000000400000-0x0000000000428000-memory.dmp	family_mystic
behavioral1/memory/2888-15-0x0000000000400000-0x0000000000428000-memory.dmp	family_mystic

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1728 set thread context of 2888	1728	file.exe	29

Program crash 2 IoCs

pid	pid_target	Process	procid_target
2752	1728	WerFault.exe	27
2772	2888	WerFault.exe	29

Suspicious use of WriteProcessMemory 25 IoCs

description	pid	Process	procid_target
PID 1728 wrote to memory of 2888	1728	file.exe	29
PID 1728 wrote to memory of 2888	1728	file.exe	29
PID 1728 wrote to memory of 2888	1728	file.exe	29
PID 1728 wrote to memory of 2888	1728	file.exe	29
PID 1728 wrote to memory of 2888	1728	file.exe	29
PID 1728 wrote to memory of 2888	1728	file.exe	29
PID 1728 wrote to memory of 2888	1728	file.exe	29
PID 1728 wrote to memory of 2888	1728	file.exe	29
PID 1728 wrote to memory of 2888	1728	file.exe	29
PID 1728 wrote to memory of 2888	1728	file.exe	29
PID 1728 wrote to memory of 2888	1728	file.exe	29
PID 1728 wrote to memory of 2888	1728	file.exe	29
PID 1728 wrote to memory of 2888	1728	file.exe	29
PID 1728 wrote to memory of 2888	1728	file.exe	29
PID 1728 wrote to memory of 2752	1728	file.exe	30
PID 1728 wrote to memory of 2752	1728	file.exe	30
PID 1728 wrote to memory of 2752	1728	file.exe	30
PID 1728 wrote to memory of 2752	1728	file.exe	30
PID 2888 wrote to memory of 2772	2888	AppLaunch.exe	31
PID 2888 wrote to memory of 2772	2888	AppLaunch.exe	31
PID 2888 wrote to memory of 2772	2888	AppLaunch.exe	31
PID 2888 wrote to memory of 2772	2888	AppLaunch.exe	31
PID 2888 wrote to memory of 2772	2888	AppLaunch.exe	31
PID 2888 wrote to memory of 2772	2888	AppLaunch.exe	31
PID 2888 wrote to memory of 2772	2888	AppLaunch.exe	31

C:\Users\Admin\AppData\Local\Temp\file.exe
"C:\Users\Admin\AppData\Local\Temp\file.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1728
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2888
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2888 -s 196
    3⤵
    - Program crash
    PID:2772
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1728 -s 92
  2⤵
  - Program crash
  PID:2752

memory/2888-0-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/2888-2-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/2888-1-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/2888-4-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/2888-8-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/2888-6-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/2888-10-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmp

Filesize
4KB

Download
memory/2888-11-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/2888-13-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/2888-15-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download