Analysis

  • max time kernel
    121s
  • max time network
    126s
  • platform
    windows7_x64
  • resource
    win7-20230831-en
  • resource tags

    arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
  • submitted
    11/10/2023, 11:28

General

  • Target

    6b4520b7b228d550021c6ce04b490397044f4cc15c23ba68a8644b7587b2aa63.exe

  • Size

    912KB

  • MD5

    690e065e1cc3e5955b7a1f04d5f09c11

  • SHA1

    f97b53a4f70a4acaea3b79faf6d6d4220a3a51ca

  • SHA256

    6b4520b7b228d550021c6ce04b490397044f4cc15c23ba68a8644b7587b2aa63

  • SHA512

    3b54cbb88667aa772042dbf5f49c6d4859e4cb0d16e85c4710ab42e6cb438b44e2f65cb95eadd75c7a8c765270786cd7a3cc9c3647859902f80ab329182ae6a7

  • SSDEEP

    24576:8y5KvCDxr+w0pqSIjOwFoax+zo+1Glvtvx2G:rCWR+DvI6wGjE+Ilv5x2

Malware Config

Signatures

  • Detect Mystic stealer payload 6 IoCs
  • Mystic

    Mystic is an infostealer written in C++.

  • Executes dropped EXE 4 IoCs
  • Loads dropped DLL 13 IoCs
  • Adds Run key to start application 2 TTPs 4 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Program crash 2 IoCs
  • Suspicious use of WriteProcessMemory 56 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\6b4520b7b228d550021c6ce04b490397044f4cc15c23ba68a8644b7587b2aa63.exe
    "C:\Users\Admin\AppData\Local\Temp\6b4520b7b228d550021c6ce04b490397044f4cc15c23ba68a8644b7587b2aa63.exe"
    1⤵
    • Loads dropped DLL
    • Adds Run key to start application
    • Suspicious use of WriteProcessMemory
    PID:2800
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x0284435.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x0284435.exe
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Adds Run key to start application
      • Suspicious use of WriteProcessMemory
      PID:1196
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\x8567017.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\x8567017.exe
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Adds Run key to start application
        • Suspicious use of WriteProcessMemory
        PID:2780
        • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\x1404123.exe
          C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\x1404123.exe
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Adds Run key to start application
          • Suspicious use of WriteProcessMemory
          PID:2388
          • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\g9568525.exe
            C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\g9568525.exe
            5⤵
            • Executes dropped EXE
            • Loads dropped DLL
            • Suspicious use of SetThreadContext
            • Suspicious use of WriteProcessMemory
            PID:2728
            • C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
              "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
              6⤵
              • Suspicious use of WriteProcessMemory
              PID:2640
              • C:\Windows\SysWOW64\WerFault.exe
                C:\Windows\SysWOW64\WerFault.exe -u -p 2640 -s 268
                7⤵
                • Program crash
                PID:2504
            • C:\Windows\SysWOW64\WerFault.exe
              C:\Windows\SysWOW64\WerFault.exe -u -p 2728 -s 268
              6⤵
              • Loads dropped DLL
              • Program crash
              PID:2536

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x0284435.exe

    Filesize

    810KB

    MD5

    228355e9ea9035c57a6d0f924a1aa38a

    SHA1

    6a9ed78f28e14fc825c4ea9c8bfb8a3d9cf0fbd6

    SHA256

    99912306d80b1835c689f54964bc7a2cd030149846e7ad938135256749a89d7a

    SHA512

    1d5e5893349dea3d8b3230552dc4e4b3baef035ff147b1854e6cabc117befa90739e058de6dc004b73cc30d0fb0fac070f4deb7e8c78d066caf499ff83112aa4

  • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x0284435.exe

    Filesize

    810KB

    MD5

    228355e9ea9035c57a6d0f924a1aa38a

    SHA1

    6a9ed78f28e14fc825c4ea9c8bfb8a3d9cf0fbd6

    SHA256

    99912306d80b1835c689f54964bc7a2cd030149846e7ad938135256749a89d7a

    SHA512

    1d5e5893349dea3d8b3230552dc4e4b3baef035ff147b1854e6cabc117befa90739e058de6dc004b73cc30d0fb0fac070f4deb7e8c78d066caf499ff83112aa4

  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\x8567017.exe

    Filesize

    548KB

    MD5

    8ed350dac50ca1e2ce3d0f0c30c0a713

    SHA1

    76702efb9a95485409fe365ba812e5c6e6822436

    SHA256

    3e6e6ff930a2559ea8722a269997073fcba202ec93ca06398e59896892741c42

    SHA512

    d9457028d8954b6fd6a8147fd021acfdc74db71627918d50cfa46ca25e3f1a49f7b622bf99d32562e7b4992a8669588208c47cb8419b4327d67076d5dce28e5e

  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\x8567017.exe

    Filesize

    548KB

    MD5

    8ed350dac50ca1e2ce3d0f0c30c0a713

    SHA1

    76702efb9a95485409fe365ba812e5c6e6822436

    SHA256

    3e6e6ff930a2559ea8722a269997073fcba202ec93ca06398e59896892741c42

    SHA512

    d9457028d8954b6fd6a8147fd021acfdc74db71627918d50cfa46ca25e3f1a49f7b622bf99d32562e7b4992a8669588208c47cb8419b4327d67076d5dce28e5e

  • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\x1404123.exe

    Filesize

    382KB

    MD5

    6193742f1b888fac20d35b8da58786b1

    SHA1

    5631db5fbb4201d3cc72e8a90e24a4428e33cc00

    SHA256

    cbff7325b92d67d8a839e985c32ecd337691022c384f700957210a52d7d2e497

    SHA512

    ac8c413884862e54b5408635179599e36ddb1dabf117048e0938d58d9da9e406e9d09940929e4f65cddad3b679675f9e57680963f957570befe7def74b065340

  • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\x1404123.exe

    Filesize

    382KB

    MD5

    6193742f1b888fac20d35b8da58786b1

    SHA1

    5631db5fbb4201d3cc72e8a90e24a4428e33cc00

    SHA256

    cbff7325b92d67d8a839e985c32ecd337691022c384f700957210a52d7d2e497

    SHA512

    ac8c413884862e54b5408635179599e36ddb1dabf117048e0938d58d9da9e406e9d09940929e4f65cddad3b679675f9e57680963f957570befe7def74b065340

  • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\g9568525.exe

    Filesize

    346KB

    MD5

    fcc2426b468af441fee45cfa761d955e

    SHA1

    b4689257c54e5388dc664413d0acb86644b1ca59

    SHA256

    2b469261d5c33ac10e2afd59a255f2f6df7704638a1f840790920f4ca797c15a

    SHA512

    7bfe304710de83519017629d3c10b638c4c1dfea1e993d2309386bd67ca7c3a679639a5847e9f15b9b579ed6aea5afa106f1c95091470232dced58ad69390d26

  • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\g9568525.exe

    Filesize

    346KB

    MD5

    fcc2426b468af441fee45cfa761d955e

    SHA1

    b4689257c54e5388dc664413d0acb86644b1ca59

    SHA256

    2b469261d5c33ac10e2afd59a255f2f6df7704638a1f840790920f4ca797c15a

    SHA512

    7bfe304710de83519017629d3c10b638c4c1dfea1e993d2309386bd67ca7c3a679639a5847e9f15b9b579ed6aea5afa106f1c95091470232dced58ad69390d26

  • C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\g9568525.exe

    Filesize

    346KB

    MD5

    fcc2426b468af441fee45cfa761d955e

    SHA1

    b4689257c54e5388dc664413d0acb86644b1ca59

    SHA256

    2b469261d5c33ac10e2afd59a255f2f6df7704638a1f840790920f4ca797c15a

    SHA512

    7bfe304710de83519017629d3c10b638c4c1dfea1e993d2309386bd67ca7c3a679639a5847e9f15b9b579ed6aea5afa106f1c95091470232dced58ad69390d26

  • \Users\Admin\AppData\Local\Temp\IXP000.TMP\x0284435.exe

    Filesize

    810KB

    MD5

    228355e9ea9035c57a6d0f924a1aa38a

    SHA1

    6a9ed78f28e14fc825c4ea9c8bfb8a3d9cf0fbd6

    SHA256

    99912306d80b1835c689f54964bc7a2cd030149846e7ad938135256749a89d7a

    SHA512

    1d5e5893349dea3d8b3230552dc4e4b3baef035ff147b1854e6cabc117befa90739e058de6dc004b73cc30d0fb0fac070f4deb7e8c78d066caf499ff83112aa4

  • \Users\Admin\AppData\Local\Temp\IXP000.TMP\x0284435.exe

    Filesize

    810KB

    MD5

    228355e9ea9035c57a6d0f924a1aa38a

    SHA1

    6a9ed78f28e14fc825c4ea9c8bfb8a3d9cf0fbd6

    SHA256

    99912306d80b1835c689f54964bc7a2cd030149846e7ad938135256749a89d7a

    SHA512

    1d5e5893349dea3d8b3230552dc4e4b3baef035ff147b1854e6cabc117befa90739e058de6dc004b73cc30d0fb0fac070f4deb7e8c78d066caf499ff83112aa4

  • \Users\Admin\AppData\Local\Temp\IXP001.TMP\x8567017.exe

    Filesize

    548KB

    MD5

    8ed350dac50ca1e2ce3d0f0c30c0a713

    SHA1

    76702efb9a95485409fe365ba812e5c6e6822436

    SHA256

    3e6e6ff930a2559ea8722a269997073fcba202ec93ca06398e59896892741c42

    SHA512

    d9457028d8954b6fd6a8147fd021acfdc74db71627918d50cfa46ca25e3f1a49f7b622bf99d32562e7b4992a8669588208c47cb8419b4327d67076d5dce28e5e

  • \Users\Admin\AppData\Local\Temp\IXP001.TMP\x8567017.exe

    Filesize

    548KB

    MD5

    8ed350dac50ca1e2ce3d0f0c30c0a713

    SHA1

    76702efb9a95485409fe365ba812e5c6e6822436

    SHA256

    3e6e6ff930a2559ea8722a269997073fcba202ec93ca06398e59896892741c42

    SHA512

    d9457028d8954b6fd6a8147fd021acfdc74db71627918d50cfa46ca25e3f1a49f7b622bf99d32562e7b4992a8669588208c47cb8419b4327d67076d5dce28e5e

  • \Users\Admin\AppData\Local\Temp\IXP002.TMP\x1404123.exe

    Filesize

    382KB

    MD5

    6193742f1b888fac20d35b8da58786b1

    SHA1

    5631db5fbb4201d3cc72e8a90e24a4428e33cc00

    SHA256

    cbff7325b92d67d8a839e985c32ecd337691022c384f700957210a52d7d2e497

    SHA512

    ac8c413884862e54b5408635179599e36ddb1dabf117048e0938d58d9da9e406e9d09940929e4f65cddad3b679675f9e57680963f957570befe7def74b065340

  • \Users\Admin\AppData\Local\Temp\IXP002.TMP\x1404123.exe

    Filesize

    382KB

    MD5

    6193742f1b888fac20d35b8da58786b1

    SHA1

    5631db5fbb4201d3cc72e8a90e24a4428e33cc00

    SHA256

    cbff7325b92d67d8a839e985c32ecd337691022c384f700957210a52d7d2e497

    SHA512

    ac8c413884862e54b5408635179599e36ddb1dabf117048e0938d58d9da9e406e9d09940929e4f65cddad3b679675f9e57680963f957570befe7def74b065340

  • \Users\Admin\AppData\Local\Temp\IXP003.TMP\g9568525.exe

    Filesize

    346KB

    MD5

    fcc2426b468af441fee45cfa761d955e

    SHA1

    b4689257c54e5388dc664413d0acb86644b1ca59

    SHA256

    2b469261d5c33ac10e2afd59a255f2f6df7704638a1f840790920f4ca797c15a

    SHA512

    7bfe304710de83519017629d3c10b638c4c1dfea1e993d2309386bd67ca7c3a679639a5847e9f15b9b579ed6aea5afa106f1c95091470232dced58ad69390d26

  • \Users\Admin\AppData\Local\Temp\IXP003.TMP\g9568525.exe

    Filesize

    346KB

    MD5

    fcc2426b468af441fee45cfa761d955e

    SHA1

    b4689257c54e5388dc664413d0acb86644b1ca59

    SHA256

    2b469261d5c33ac10e2afd59a255f2f6df7704638a1f840790920f4ca797c15a

    SHA512

    7bfe304710de83519017629d3c10b638c4c1dfea1e993d2309386bd67ca7c3a679639a5847e9f15b9b579ed6aea5afa106f1c95091470232dced58ad69390d26

  • \Users\Admin\AppData\Local\Temp\IXP003.TMP\g9568525.exe

    Filesize

    346KB

    MD5

    fcc2426b468af441fee45cfa761d955e

    SHA1

    b4689257c54e5388dc664413d0acb86644b1ca59

    SHA256

    2b469261d5c33ac10e2afd59a255f2f6df7704638a1f840790920f4ca797c15a

    SHA512

    7bfe304710de83519017629d3c10b638c4c1dfea1e993d2309386bd67ca7c3a679639a5847e9f15b9b579ed6aea5afa106f1c95091470232dced58ad69390d26

  • \Users\Admin\AppData\Local\Temp\IXP003.TMP\g9568525.exe

    Filesize

    346KB

    MD5

    fcc2426b468af441fee45cfa761d955e

    SHA1

    b4689257c54e5388dc664413d0acb86644b1ca59

    SHA256

    2b469261d5c33ac10e2afd59a255f2f6df7704638a1f840790920f4ca797c15a

    SHA512

    7bfe304710de83519017629d3c10b638c4c1dfea1e993d2309386bd67ca7c3a679639a5847e9f15b9b579ed6aea5afa106f1c95091470232dced58ad69390d26

  • \Users\Admin\AppData\Local\Temp\IXP003.TMP\g9568525.exe

    Filesize

    346KB

    MD5

    fcc2426b468af441fee45cfa761d955e

    SHA1

    b4689257c54e5388dc664413d0acb86644b1ca59

    SHA256

    2b469261d5c33ac10e2afd59a255f2f6df7704638a1f840790920f4ca797c15a

    SHA512

    7bfe304710de83519017629d3c10b638c4c1dfea1e993d2309386bd67ca7c3a679639a5847e9f15b9b579ed6aea5afa106f1c95091470232dced58ad69390d26

  • \Users\Admin\AppData\Local\Temp\IXP003.TMP\g9568525.exe

    Filesize

    346KB

    MD5

    fcc2426b468af441fee45cfa761d955e

    SHA1

    b4689257c54e5388dc664413d0acb86644b1ca59

    SHA256

    2b469261d5c33ac10e2afd59a255f2f6df7704638a1f840790920f4ca797c15a

    SHA512

    7bfe304710de83519017629d3c10b638c4c1dfea1e993d2309386bd67ca7c3a679639a5847e9f15b9b579ed6aea5afa106f1c95091470232dced58ad69390d26

  • \Users\Admin\AppData\Local\Temp\IXP003.TMP\g9568525.exe

    Filesize

    346KB

    MD5

    fcc2426b468af441fee45cfa761d955e

    SHA1

    b4689257c54e5388dc664413d0acb86644b1ca59

    SHA256

    2b469261d5c33ac10e2afd59a255f2f6df7704638a1f840790920f4ca797c15a

    SHA512

    7bfe304710de83519017629d3c10b638c4c1dfea1e993d2309386bd67ca7c3a679639a5847e9f15b9b579ed6aea5afa106f1c95091470232dced58ad69390d26

  • memory/2640-47-0x0000000000400000-0x0000000000428000-memory.dmp

    Filesize

    160KB

  • memory/2640-48-0x0000000000400000-0x0000000000428000-memory.dmp

    Filesize

    160KB

  • memory/2640-49-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmp

    Filesize

    4KB

  • memory/2640-50-0x0000000000400000-0x0000000000428000-memory.dmp

    Filesize

    160KB

  • memory/2640-52-0x0000000000400000-0x0000000000428000-memory.dmp

    Filesize

    160KB

  • memory/2640-54-0x0000000000400000-0x0000000000428000-memory.dmp

    Filesize

    160KB

  • memory/2640-45-0x0000000000400000-0x0000000000428000-memory.dmp

    Filesize

    160KB

  • memory/2640-46-0x0000000000400000-0x0000000000428000-memory.dmp

    Filesize

    160KB

  • memory/2640-44-0x0000000000400000-0x0000000000428000-memory.dmp

    Filesize

    160KB

  • memory/2640-43-0x0000000000400000-0x0000000000428000-memory.dmp

    Filesize

    160KB