mystic | 4153d2b1cb476033ed0382be3027083b5f91fcd4eee4c831b6d31f1d86a02b36

Analysis

max time kernel
125s
max time network
136s
platform
windows10-2004_x64
resource
win10v2004-20230915-en
resource tags

arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
submitted
11-10-2023 06:58

Target

4153d2b1cb476033ed0382be3027083b5f91fcd4eee4c831b6d31f1d86a02b36.exe
Size

1016KB
MD5

a8633acae1c192b00929eed57f24ed86
SHA1

5c05004269ee5e44fad3076ab987a9c11b14b5b8
SHA256

4153d2b1cb476033ed0382be3027083b5f91fcd4eee4c831b6d31f1d86a02b36
SHA512

09f76b3f6d1ae3bc71b1a6e491ea70326ac1a77326c5fa8f51ec38c82e3f40c5d605ccbf5550c5b47e35d35fbeb7399cb49be9b4f923875fdc1af2c4ed25a699
SSDEEP

12288:z+WAo5YaBYDKzcx9jkmP8bey7/0RDMmZZxnyUuyyulvbG8VmNQVR/9:zxVYDKzcx9jkmPe/knxykG09

Score

10^/10

mystic stealer

Family

mystic

http://5.42.92.211/loghub/master

Detect Mystic stealer payload 5 IoCs

resource	yara_rule
behavioral2/memory/4024-0-0x0000000000400000-0x0000000000428000-memory.dmp	family_mystic
behavioral2/memory/4024-1-0x0000000000400000-0x0000000000428000-memory.dmp	family_mystic
behavioral2/memory/4024-2-0x0000000000400000-0x0000000000428000-memory.dmp	family_mystic
behavioral2/memory/4024-3-0x0000000000400000-0x0000000000428000-memory.dmp	family_mystic
behavioral2/memory/4024-4-0x0000000000400000-0x0000000000428000-memory.dmp	family_mystic

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 756 set thread context of 4024	756	4153d2b1cb476033ed0382be3027083b5f91fcd4eee4c831b6d31f1d86a02b36.exe	85

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4872	756	WerFault.exe	81

Suspicious use of WriteProcessMemory 13 IoCs

description	pid	Process	procid_target
PID 756 wrote to memory of 1696	756	4153d2b1cb476033ed0382be3027083b5f91fcd4eee4c831b6d31f1d86a02b36.exe	84
PID 756 wrote to memory of 1696	756	4153d2b1cb476033ed0382be3027083b5f91fcd4eee4c831b6d31f1d86a02b36.exe	84
PID 756 wrote to memory of 1696	756	4153d2b1cb476033ed0382be3027083b5f91fcd4eee4c831b6d31f1d86a02b36.exe	84
PID 756 wrote to memory of 4024	756	4153d2b1cb476033ed0382be3027083b5f91fcd4eee4c831b6d31f1d86a02b36.exe	85
PID 756 wrote to memory of 4024	756	4153d2b1cb476033ed0382be3027083b5f91fcd4eee4c831b6d31f1d86a02b36.exe	85
PID 756 wrote to memory of 4024	756	4153d2b1cb476033ed0382be3027083b5f91fcd4eee4c831b6d31f1d86a02b36.exe	85
PID 756 wrote to memory of 4024	756	4153d2b1cb476033ed0382be3027083b5f91fcd4eee4c831b6d31f1d86a02b36.exe	85
PID 756 wrote to memory of 4024	756	4153d2b1cb476033ed0382be3027083b5f91fcd4eee4c831b6d31f1d86a02b36.exe	85
PID 756 wrote to memory of 4024	756	4153d2b1cb476033ed0382be3027083b5f91fcd4eee4c831b6d31f1d86a02b36.exe	85
PID 756 wrote to memory of 4024	756	4153d2b1cb476033ed0382be3027083b5f91fcd4eee4c831b6d31f1d86a02b36.exe	85
PID 756 wrote to memory of 4024	756	4153d2b1cb476033ed0382be3027083b5f91fcd4eee4c831b6d31f1d86a02b36.exe	85
PID 756 wrote to memory of 4024	756	4153d2b1cb476033ed0382be3027083b5f91fcd4eee4c831b6d31f1d86a02b36.exe	85
PID 756 wrote to memory of 4024	756	4153d2b1cb476033ed0382be3027083b5f91fcd4eee4c831b6d31f1d86a02b36.exe	85

C:\Users\Admin\AppData\Local\Temp\4153d2b1cb476033ed0382be3027083b5f91fcd4eee4c831b6d31f1d86a02b36.exe
"C:\Users\Admin\AppData\Local\Temp\4153d2b1cb476033ed0382be3027083b5f91fcd4eee4c831b6d31f1d86a02b36.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:756
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
  2⤵
  PID:1696
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
  2⤵
  PID:4024
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 756 -s 316
  2⤵
  - Program crash
  PID:4872

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 756 -ip 756
1⤵
PID:4576

memory/4024-0-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/4024-1-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/4024-2-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/4024-3-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/4024-4-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download