mystic | c848ab00fe7390a80a2630cfb93d417a16b5ee718e46c4015665775478decbba

Analysis

max time kernel
117s
max time network
122s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
11/10/2023, 12:05

Target

file.exe
Size

379KB
MD5

3fc873773992b5398837c2c56ee381bf
SHA1

eaa2519255cf0673613449ace22b869a1e2ead5f
SHA256

c848ab00fe7390a80a2630cfb93d417a16b5ee718e46c4015665775478decbba
SHA512

c0cb9df83d60250bfa080bee9b06141df86bbdbc1446519130cda3f1c20658c3d67353a596de04aaa5bd407ff273247c954f7c152dba5fb9f999b92a1be7ca7a
SSDEEP

6144:dtJcRgs3r9vIum2Tg0N63KAO3aRVJ/QSK9/oNhg3F:dtORP3r9Hme1Kz/G9/ow3F

Score

10^/10

mystic stealer

Family

mystic

http://5.42.92.211/loghub/master

Detect Mystic stealer payload 8 IoCs

resource	yara_rule
behavioral1/memory/1720-6-0x0000000000400000-0x0000000000428000-memory.dmp	family_mystic
behavioral1/memory/1720-8-0x0000000000400000-0x0000000000428000-memory.dmp	family_mystic
behavioral1/memory/1720-10-0x0000000000400000-0x0000000000428000-memory.dmp	family_mystic
behavioral1/memory/1720-13-0x0000000000400000-0x0000000000428000-memory.dmp	family_mystic
behavioral1/memory/1720-15-0x0000000000400000-0x0000000000428000-memory.dmp	family_mystic
behavioral1/memory/1720-17-0x0000000000400000-0x0000000000428000-memory.dmp	family_mystic
behavioral1/memory/1720-18-0x0000000000400000-0x0000000000428000-memory.dmp	family_mystic
behavioral1/memory/1720-19-0x0000000000400000-0x0000000000428000-memory.dmp	family_mystic

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2008 set thread context of 1720	2008	file.exe	29

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1220	2008	WerFault.exe	28

Suspicious use of WriteProcessMemory 18 IoCs

description	pid	Process	procid_target
PID 2008 wrote to memory of 1720	2008	file.exe	29
PID 2008 wrote to memory of 1720	2008	file.exe	29
PID 2008 wrote to memory of 1720	2008	file.exe	29
PID 2008 wrote to memory of 1720	2008	file.exe	29
PID 2008 wrote to memory of 1720	2008	file.exe	29
PID 2008 wrote to memory of 1720	2008	file.exe	29
PID 2008 wrote to memory of 1720	2008	file.exe	29
PID 2008 wrote to memory of 1720	2008	file.exe	29
PID 2008 wrote to memory of 1720	2008	file.exe	29
PID 2008 wrote to memory of 1720	2008	file.exe	29
PID 2008 wrote to memory of 1720	2008	file.exe	29
PID 2008 wrote to memory of 1720	2008	file.exe	29
PID 2008 wrote to memory of 1720	2008	file.exe	29
PID 2008 wrote to memory of 1720	2008	file.exe	29
PID 2008 wrote to memory of 1220	2008	file.exe	30
PID 2008 wrote to memory of 1220	2008	file.exe	30
PID 2008 wrote to memory of 1220	2008	file.exe	30
PID 2008 wrote to memory of 1220	2008	file.exe	30

C:\Users\Admin\AppData\Local\Temp\file.exe
"C:\Users\Admin\AppData\Local\Temp\file.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2008
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
  2⤵
  PID:1720
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2008 -s 92
  2⤵
  - Program crash
  PID:1220

memory/1720-0-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/1720-2-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/1720-4-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/1720-6-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/1720-8-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/1720-10-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/1720-12-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmp

Filesize
4KB

Download
memory/1720-13-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/1720-15-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/1720-17-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/1720-18-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/1720-19-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download