mystic | b99f055737f6952f961363a9e766b5f6b3ec6e5fb12195d5d67e9dec63e22e28

Analysis

max time kernel
142s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20230915-en
resource tags

arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
submitted
11/10/2023, 07:04

Target

file.exe
Size

1016KB
MD5

7f41d7c25defc702f623a532221c41db
SHA1

94e76ae239f4d84e4e160d78fbc1702e19ea441f
SHA256

b99f055737f6952f961363a9e766b5f6b3ec6e5fb12195d5d67e9dec63e22e28
SHA512

5954ea1e5983053ecf0acd63259ca1a1d06ca0cfc52de2517994e9bf8a48ce79f9b30cc7be4dd5d15f1ec66da088f06ef0e266f09f3f5903f9871cae8f47e082
SSDEEP

24576:KSuYDKzcx9jkmPe/knxyD2rhLpEzGGq0dfDonBEUJVp9:Khcx9jkmPBxe2VVEzdq0dfDonBEUJV

Score

10^/10

mystic stealer

Family

mystic

http://5.42.92.211/loghub/master

Detect Mystic stealer payload 5 IoCs

resource	yara_rule
behavioral2/memory/1760-0-0x0000000000400000-0x0000000000428000-memory.dmp	family_mystic
behavioral2/memory/1760-1-0x0000000000400000-0x0000000000428000-memory.dmp	family_mystic
behavioral2/memory/1760-2-0x0000000000400000-0x0000000000428000-memory.dmp	family_mystic
behavioral2/memory/1760-3-0x0000000000400000-0x0000000000428000-memory.dmp	family_mystic
behavioral2/memory/1760-4-0x0000000000400000-0x0000000000428000-memory.dmp	family_mystic

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4600 set thread context of 1760	4600	file.exe	87

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4352	4600	WerFault.exe	83

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 4600 wrote to memory of 1760	4600	file.exe	87
PID 4600 wrote to memory of 1760	4600	file.exe	87
PID 4600 wrote to memory of 1760	4600	file.exe	87
PID 4600 wrote to memory of 1760	4600	file.exe	87
PID 4600 wrote to memory of 1760	4600	file.exe	87
PID 4600 wrote to memory of 1760	4600	file.exe	87
PID 4600 wrote to memory of 1760	4600	file.exe	87
PID 4600 wrote to memory of 1760	4600	file.exe	87
PID 4600 wrote to memory of 1760	4600	file.exe	87
PID 4600 wrote to memory of 1760	4600	file.exe	87

C:\Users\Admin\AppData\Local\Temp\file.exe
"C:\Users\Admin\AppData\Local\Temp\file.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4600
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
  2⤵
  PID:1760
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4600 -s 152
  2⤵
  - Program crash
  PID:4352

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 4600 -ip 4600
1⤵
PID:3980

memory/1760-0-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/1760-1-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/1760-2-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/1760-3-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/1760-4-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download