mystic | 9bb807cf7b1f9185dc98521d10d14320191adb2b5dbd6dfbc2fa582d582451dd

Analysis

max time kernel
139s
max time network
157s
platform
windows10-2004_x64
resource
win10v2004-20230915-en
resource tags

arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
submitted
12/10/2023, 05:15

Target

g8710294.exe
Size

700KB
MD5

a420a058f341d72059d1e5b5a57bc599
SHA1

4cac917ba7339bed604a58690a30c411557f2c94
SHA256

9bb807cf7b1f9185dc98521d10d14320191adb2b5dbd6dfbc2fa582d582451dd
SHA512

7d1bedc4197f4a7885c997b7e30bbd277ba86cfabdb46c19a61fa2520ce30ed52ba54bb5ebca3682ab0b60a4b0c46b5f433e000fc96e5369c450d2bd8fb8c9e0
SSDEEP

6144:46vGALXgBEIy8wluzNcq/PVucQpuk+gP44D18jAq/DdEhgntGO/CoLnCvfr:ZHXgFysVucQpuk+gw4R8famj+r

Score

10^/10

mystic stealer

Family

mystic

http://5.42.92.211/loghub/master

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 664 set thread context of 1420	664	g8710294.exe	90

Program crash 1 IoCs

pid	pid_target	Process	procid_target
876	664	WerFault.exe	81

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 664 wrote to memory of 1420	664	g8710294.exe	90
PID 664 wrote to memory of 1420	664	g8710294.exe	90
PID 664 wrote to memory of 1420	664	g8710294.exe	90
PID 664 wrote to memory of 1420	664	g8710294.exe	90
PID 664 wrote to memory of 1420	664	g8710294.exe	90
PID 664 wrote to memory of 1420	664	g8710294.exe	90
PID 664 wrote to memory of 1420	664	g8710294.exe	90
PID 664 wrote to memory of 1420	664	g8710294.exe	90
PID 664 wrote to memory of 1420	664	g8710294.exe	90
PID 664 wrote to memory of 1420	664	g8710294.exe	90

C:\Users\Admin\AppData\Local\Temp\g8710294.exe
"C:\Users\Admin\AppData\Local\Temp\g8710294.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:664
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
  2⤵
  PID:1420
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 664 -s 296
  2⤵
  - Program crash
  PID:876

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 664 -ip 664
1⤵
PID:3816

memory/1420-0-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/1420-1-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/1420-2-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/1420-3-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/1420-4-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download