mystic | c848ab00fe7390a80a2630cfb93d417a16b5ee718e46c4015665775478decbba

Analysis

max time kernel
142s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20230915-en
resource tags

arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
submitted
11/10/2023, 12:05

Target

file.exe
Size

379KB
MD5

3fc873773992b5398837c2c56ee381bf
SHA1

eaa2519255cf0673613449ace22b869a1e2ead5f
SHA256

c848ab00fe7390a80a2630cfb93d417a16b5ee718e46c4015665775478decbba
SHA512

c0cb9df83d60250bfa080bee9b06141df86bbdbc1446519130cda3f1c20658c3d67353a596de04aaa5bd407ff273247c954f7c152dba5fb9f999b92a1be7ca7a
SSDEEP

6144:dtJcRgs3r9vIum2Tg0N63KAO3aRVJ/QSK9/oNhg3F:dtORP3r9Hme1Kz/G9/ow3F

Score

10^/10

mystic stealer

Family

mystic

http://5.42.92.211/loghub/master

Detect Mystic stealer payload 5 IoCs

resource	yara_rule
behavioral2/memory/5016-1-0x0000000000400000-0x0000000000428000-memory.dmp	family_mystic
behavioral2/memory/5016-0-0x0000000000400000-0x0000000000428000-memory.dmp	family_mystic
behavioral2/memory/5016-2-0x0000000000400000-0x0000000000428000-memory.dmp	family_mystic
behavioral2/memory/5016-3-0x0000000000400000-0x0000000000428000-memory.dmp	family_mystic
behavioral2/memory/5016-4-0x0000000000400000-0x0000000000428000-memory.dmp	family_mystic

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 728 set thread context of 5016	728	file.exe	86

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3928	728	WerFault.exe	84

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 728 wrote to memory of 5016	728	file.exe	86
PID 728 wrote to memory of 5016	728	file.exe	86
PID 728 wrote to memory of 5016	728	file.exe	86
PID 728 wrote to memory of 5016	728	file.exe	86
PID 728 wrote to memory of 5016	728	file.exe	86
PID 728 wrote to memory of 5016	728	file.exe	86
PID 728 wrote to memory of 5016	728	file.exe	86
PID 728 wrote to memory of 5016	728	file.exe	86
PID 728 wrote to memory of 5016	728	file.exe	86
PID 728 wrote to memory of 5016	728	file.exe	86

C:\Users\Admin\AppData\Local\Temp\file.exe
"C:\Users\Admin\AppData\Local\Temp\file.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:728
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
  2⤵
  PID:5016
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 728 -s 288
  2⤵
  - Program crash
  PID:3928

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 728 -ip 728
1⤵
PID:2504

memory/5016-1-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/5016-0-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/5016-2-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/5016-3-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/5016-4-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download