mystic | f1c2fa6c699ab7e9f9ebcc7351f26dec139fd305382cca1ed790c093655b4ded

Analysis

max time kernel
171s
max time network
162s
platform
windows10-2004_x64
resource
win10v2004-20230915-en
resource tags

arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
submitted
12/10/2023, 03:46

Target

f1c2fa6c699ab7e9f9ebcc7351f26dec139fd305382cca1ed790c093655b4ded.exe
Size

365KB
MD5

22d11081c350680d752cf1b97f338970
SHA1

8d9caf348d7b3fa75ab6d8dddc378ba278bf1031
SHA256

f1c2fa6c699ab7e9f9ebcc7351f26dec139fd305382cca1ed790c093655b4ded
SHA512

3414fb7f0afb091e1aa34265381ba01ce96e6c8adf569b77134bb5a8c20be58cfb377034416778301f74ec5716ee223729f17fdac4cc1183472ec4ab2f46c621
SSDEEP

6144:9+5frpxdonyq4zaG2u5AO2eKJNkCHcGPt4h5AeVM7Qgmquqp:9wrp0/9u54e6NFHneVMUHquqp

Score

10^/10

mystic stealer

Family

mystic

http://5.42.92.211/loghub/master

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2148 set thread context of 3540	2148	f1c2fa6c699ab7e9f9ebcc7351f26dec139fd305382cca1ed790c093655b4ded.exe	89

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1996	2148	WerFault.exe	83

Suspicious use of WriteProcessMemory 13 IoCs

description	pid	Process	procid_target
PID 2148 wrote to memory of 432	2148	f1c2fa6c699ab7e9f9ebcc7351f26dec139fd305382cca1ed790c093655b4ded.exe	88
PID 2148 wrote to memory of 432	2148	f1c2fa6c699ab7e9f9ebcc7351f26dec139fd305382cca1ed790c093655b4ded.exe	88
PID 2148 wrote to memory of 432	2148	f1c2fa6c699ab7e9f9ebcc7351f26dec139fd305382cca1ed790c093655b4ded.exe	88
PID 2148 wrote to memory of 3540	2148	f1c2fa6c699ab7e9f9ebcc7351f26dec139fd305382cca1ed790c093655b4ded.exe	89
PID 2148 wrote to memory of 3540	2148	f1c2fa6c699ab7e9f9ebcc7351f26dec139fd305382cca1ed790c093655b4ded.exe	89
PID 2148 wrote to memory of 3540	2148	f1c2fa6c699ab7e9f9ebcc7351f26dec139fd305382cca1ed790c093655b4ded.exe	89
PID 2148 wrote to memory of 3540	2148	f1c2fa6c699ab7e9f9ebcc7351f26dec139fd305382cca1ed790c093655b4ded.exe	89
PID 2148 wrote to memory of 3540	2148	f1c2fa6c699ab7e9f9ebcc7351f26dec139fd305382cca1ed790c093655b4ded.exe	89
PID 2148 wrote to memory of 3540	2148	f1c2fa6c699ab7e9f9ebcc7351f26dec139fd305382cca1ed790c093655b4ded.exe	89
PID 2148 wrote to memory of 3540	2148	f1c2fa6c699ab7e9f9ebcc7351f26dec139fd305382cca1ed790c093655b4ded.exe	89
PID 2148 wrote to memory of 3540	2148	f1c2fa6c699ab7e9f9ebcc7351f26dec139fd305382cca1ed790c093655b4ded.exe	89
PID 2148 wrote to memory of 3540	2148	f1c2fa6c699ab7e9f9ebcc7351f26dec139fd305382cca1ed790c093655b4ded.exe	89
PID 2148 wrote to memory of 3540	2148	f1c2fa6c699ab7e9f9ebcc7351f26dec139fd305382cca1ed790c093655b4ded.exe	89

C:\Users\Admin\AppData\Local\Temp\f1c2fa6c699ab7e9f9ebcc7351f26dec139fd305382cca1ed790c093655b4ded.exe
"C:\Users\Admin\AppData\Local\Temp\f1c2fa6c699ab7e9f9ebcc7351f26dec139fd305382cca1ed790c093655b4ded.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2148
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
  2⤵
  PID:432
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
  2⤵
  PID:3540
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2148 -s 288
  2⤵
  - Program crash
  PID:1996

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 2148 -ip 2148
1⤵
PID:3400

memory/3540-0-0x0000000000400000-0x000000000042C000-memory.dmp

Filesize
176KB

Download
memory/3540-1-0x0000000000400000-0x000000000042C000-memory.dmp

Filesize
176KB

Download
memory/3540-2-0x0000000000400000-0x000000000042C000-memory.dmp

Filesize
176KB

Download
memory/3540-3-0x0000000000400000-0x000000000042C000-memory.dmp

Filesize
176KB

Download
memory/3540-4-0x0000000000400000-0x000000000042C000-memory.dmp

Filesize
176KB

Download