mystic | f648e7461ffce908e516ff0aa05432a3ecbd0f7d38097f86cafbca18dd34c276

Analysis

max time kernel
151s
max time network
160s
platform
windows10-2004_x64
resource
win10v2004-20230915-en
resource tags

arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
submitted
12-10-2023 01:16

Target

file.exe
Size

364KB
MD5

10145e84c5872f8dd2576296266abb98
SHA1

3ccc002228a7fd2032922c65073f06b93a77fd60
SHA256

f648e7461ffce908e516ff0aa05432a3ecbd0f7d38097f86cafbca18dd34c276
SHA512

ccb65287c4547e8f86cc6057391b2c558a42207469bdb20716590786a0439a2fe6ad51bcb49e2f10348cfb97a3eada9af950b3471862e3f254b8025bddf29027
SSDEEP

6144:gr46fuYXChoQTjlFgLuCY1dRuAO84uGckTJGiiN/MP1K6w8y0:g0YzXChdTbv1buBuGcKsiipL6w8y

Score

10^/10

mystic stealer

Family

mystic

http://5.42.92.211/loghub/master

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 220 set thread context of 5108	220	file.exe	86

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2164	220	WerFault.exe	25

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 220 wrote to memory of 5108	220	file.exe	86
PID 220 wrote to memory of 5108	220	file.exe	86
PID 220 wrote to memory of 5108	220	file.exe	86
PID 220 wrote to memory of 5108	220	file.exe	86
PID 220 wrote to memory of 5108	220	file.exe	86
PID 220 wrote to memory of 5108	220	file.exe	86
PID 220 wrote to memory of 5108	220	file.exe	86
PID 220 wrote to memory of 5108	220	file.exe	86
PID 220 wrote to memory of 5108	220	file.exe	86
PID 220 wrote to memory of 5108	220	file.exe	86

C:\Users\Admin\AppData\Local\Temp\file.exe
"C:\Users\Admin\AppData\Local\Temp\file.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:220
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
  2⤵
  PID:5108
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 220 -s 260
  2⤵
  - Program crash
  PID:2164

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 220 -ip 220
1⤵
PID:4852

memory/5108-0-0x0000000000400000-0x000000000042C000-memory.dmp

Filesize
176KB

Download
memory/5108-1-0x0000000000400000-0x000000000042C000-memory.dmp

Filesize
176KB

Download
memory/5108-2-0x0000000000400000-0x000000000042C000-memory.dmp

Filesize
176KB

Download
memory/5108-3-0x0000000000400000-0x000000000042C000-memory.dmp

Filesize
176KB

Download
memory/5108-4-0x0000000000400000-0x000000000042C000-memory.dmp

Filesize
176KB

Download