mystic | c6c7cf1fe98df6ad9cef8cc1cb280df3a5a71de48f0ab014f02076791bfa118c

Analysis

max time kernel
122s
max time network
152s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
11/10/2023, 13:28

Target

file.exe
Size

379KB
MD5

4c179112aa450c79ecd5cd254f1a13bb
SHA1

aeca90bd4a3b9e533d190fdd60ee31cd5d6ed77f
SHA256

c6c7cf1fe98df6ad9cef8cc1cb280df3a5a71de48f0ab014f02076791bfa118c
SHA512

45d6663aa1a32b0da8cb679b45d94755eb7022cb8b85268da9288b6691c250f49b5731e1520aaf46159f28fc9105cfaa3f99f930d1fb82e7760995a2528a3406
SSDEEP

6144:iJ1cRgs3r9vIum2Tg0N63KAOMYUutfQNGVZc/xvIBb++F3F:iJ6RP3r9HmeeYUuCNuZivpM3F

Score

10^/10

mystic stealer

Detect Mystic stealer payload 6 IoCs

resource	yara_rule
behavioral1/memory/2484-3-0x0000000000400000-0x0000000000428000-memory.dmp	family_mystic
behavioral1/memory/2484-4-0x0000000000400000-0x0000000000428000-memory.dmp	family_mystic
behavioral1/memory/2484-5-0x0000000000400000-0x0000000000428000-memory.dmp	family_mystic
behavioral1/memory/2484-7-0x0000000000400000-0x0000000000428000-memory.dmp	family_mystic
behavioral1/memory/2484-9-0x0000000000400000-0x0000000000428000-memory.dmp	family_mystic
behavioral1/memory/2484-11-0x0000000000400000-0x0000000000428000-memory.dmp	family_mystic

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2920 set thread context of 2484	2920	file.exe	28

Program crash 2 IoCs

pid	pid_target	Process	procid_target
2628	2920	WerFault.exe	17
2716	2484	WerFault.exe	28

Suspicious use of WriteProcessMemory 25 IoCs

description	pid	Process	procid_target
PID 2920 wrote to memory of 2484	2920	file.exe	28
PID 2920 wrote to memory of 2484	2920	file.exe	28
PID 2920 wrote to memory of 2484	2920	file.exe	28
PID 2920 wrote to memory of 2484	2920	file.exe	28
PID 2920 wrote to memory of 2484	2920	file.exe	28
PID 2920 wrote to memory of 2484	2920	file.exe	28
PID 2920 wrote to memory of 2484	2920	file.exe	28
PID 2920 wrote to memory of 2484	2920	file.exe	28
PID 2920 wrote to memory of 2484	2920	file.exe	28
PID 2920 wrote to memory of 2484	2920	file.exe	28
PID 2920 wrote to memory of 2484	2920	file.exe	28
PID 2920 wrote to memory of 2484	2920	file.exe	28
PID 2920 wrote to memory of 2484	2920	file.exe	28
PID 2920 wrote to memory of 2484	2920	file.exe	28
PID 2920 wrote to memory of 2628	2920	file.exe	29
PID 2920 wrote to memory of 2628	2920	file.exe	29
PID 2920 wrote to memory of 2628	2920	file.exe	29
PID 2920 wrote to memory of 2628	2920	file.exe	29
PID 2484 wrote to memory of 2716	2484	AppLaunch.exe	30
PID 2484 wrote to memory of 2716	2484	AppLaunch.exe	30
PID 2484 wrote to memory of 2716	2484	AppLaunch.exe	30
PID 2484 wrote to memory of 2716	2484	AppLaunch.exe	30
PID 2484 wrote to memory of 2716	2484	AppLaunch.exe	30
PID 2484 wrote to memory of 2716	2484	AppLaunch.exe	30
PID 2484 wrote to memory of 2716	2484	AppLaunch.exe	30

C:\Users\Admin\AppData\Local\Temp\file.exe
"C:\Users\Admin\AppData\Local\Temp\file.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2920
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2484
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2484 -s 196
    3⤵
    - Program crash
    PID:2716
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2920 -s 92
  2⤵
  - Program crash
  PID:2628

memory/2484-0-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/2484-1-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/2484-3-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/2484-4-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/2484-2-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/2484-6-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmp

Filesize
4KB

Download
memory/2484-5-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/2484-7-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/2484-9-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/2484-11-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download