mystic | c757aec83a6964e8e7ef2d09e356aa4468b48d65ee478addcbfe94ccb34ac9a5

Analysis

max time kernel
162s
max time network
175s
platform
windows10-2004_x64
resource
win10v2004-20230915-en
resource tags

arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
submitted
12/10/2023, 05:30

Target

c757aec83a6964e8e7ef2d09e356aa4468b48d65ee478addcbfe94ccb34ac9a5.exe
Size

700KB
MD5

80ec7e8de58d34c4217a06c100577a88
SHA1

f3841eb1d18c1e868186ec2f36d5aa240185ec54
SHA256

c757aec83a6964e8e7ef2d09e356aa4468b48d65ee478addcbfe94ccb34ac9a5
SHA512

6cce9e5db6c5b634771bcf00f5ede69a467946da1cce16ed2bc396a79835797f6fbe1e39806f6a518b2a4e4040516fe4fe62f120a9fcf98ed3651098e5da15b5
SSDEEP

6144:RXSvGAafgBMniUwluzlcy/XVucQ5eJBeluQq0qkIrq/vsxpqJ86DpMM4vfz:wGfg2i8VucQ5mBCuJ0YrmZVMMMz

Score

10^/10

mystic stealer

Family

mystic

http://5.42.92.211/loghub/master

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4984 set thread context of 4812	4984	c757aec83a6964e8e7ef2d09e356aa4468b48d65ee478addcbfe94ccb34ac9a5.exe	95

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4596	4984	WerFault.exe	84

Suspicious use of WriteProcessMemory 13 IoCs

description	pid	Process	procid_target
PID 4984 wrote to memory of 4032	4984	c757aec83a6964e8e7ef2d09e356aa4468b48d65ee478addcbfe94ccb34ac9a5.exe	94
PID 4984 wrote to memory of 4032	4984	c757aec83a6964e8e7ef2d09e356aa4468b48d65ee478addcbfe94ccb34ac9a5.exe	94
PID 4984 wrote to memory of 4032	4984	c757aec83a6964e8e7ef2d09e356aa4468b48d65ee478addcbfe94ccb34ac9a5.exe	94
PID 4984 wrote to memory of 4812	4984	c757aec83a6964e8e7ef2d09e356aa4468b48d65ee478addcbfe94ccb34ac9a5.exe	95
PID 4984 wrote to memory of 4812	4984	c757aec83a6964e8e7ef2d09e356aa4468b48d65ee478addcbfe94ccb34ac9a5.exe	95
PID 4984 wrote to memory of 4812	4984	c757aec83a6964e8e7ef2d09e356aa4468b48d65ee478addcbfe94ccb34ac9a5.exe	95
PID 4984 wrote to memory of 4812	4984	c757aec83a6964e8e7ef2d09e356aa4468b48d65ee478addcbfe94ccb34ac9a5.exe	95
PID 4984 wrote to memory of 4812	4984	c757aec83a6964e8e7ef2d09e356aa4468b48d65ee478addcbfe94ccb34ac9a5.exe	95
PID 4984 wrote to memory of 4812	4984	c757aec83a6964e8e7ef2d09e356aa4468b48d65ee478addcbfe94ccb34ac9a5.exe	95
PID 4984 wrote to memory of 4812	4984	c757aec83a6964e8e7ef2d09e356aa4468b48d65ee478addcbfe94ccb34ac9a5.exe	95
PID 4984 wrote to memory of 4812	4984	c757aec83a6964e8e7ef2d09e356aa4468b48d65ee478addcbfe94ccb34ac9a5.exe	95
PID 4984 wrote to memory of 4812	4984	c757aec83a6964e8e7ef2d09e356aa4468b48d65ee478addcbfe94ccb34ac9a5.exe	95
PID 4984 wrote to memory of 4812	4984	c757aec83a6964e8e7ef2d09e356aa4468b48d65ee478addcbfe94ccb34ac9a5.exe	95

C:\Users\Admin\AppData\Local\Temp\c757aec83a6964e8e7ef2d09e356aa4468b48d65ee478addcbfe94ccb34ac9a5.exe
"C:\Users\Admin\AppData\Local\Temp\c757aec83a6964e8e7ef2d09e356aa4468b48d65ee478addcbfe94ccb34ac9a5.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4984
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
  2⤵
  PID:4032
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
  2⤵
  PID:4812
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4984 -s 304
  2⤵
  - Program crash
  PID:4596

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 476 -p 4984 -ip 4984
1⤵
PID:3516

memory/4812-0-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/4812-1-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/4812-2-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/4812-3-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/4812-4-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download