mystic | 3d1a2b1b79e9874f189e7fe2f975bec1ee7304dd55cb36e65d9686950f4a7410

Analysis

max time kernel
122s
max time network
150s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
12/10/2023, 07:16

Target

file.exe
Size

700KB
MD5

169ea2c57794dc69d9c869bddb6da795
SHA1

fe6f42340e64099209aefd6c787d6423475a8b57
SHA256

3d1a2b1b79e9874f189e7fe2f975bec1ee7304dd55cb36e65d9686950f4a7410
SHA512

6a518c060da2f9d6766d461064bf36189701dbb53315bbc0c366c4e172b8adeb664c3f2b9ebfc66da738e42904e43eb4cfa5f0b2be1880d0a46d1cba25124d0f
SSDEEP

6144:1SvGAafgBMniUwluzlcy/XVucQ5BH8MA5OZa8aUCID4Iij0wtvfz:gGfg2i8VucQ5BHiOZa8ad3ILw9z

Score

10^/10

mystic stealer

Family

mystic

http://5.42.92.211/loghub/master

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2060 set thread context of 3064	2060	file.exe	31

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2736	2060	WerFault.exe	27

Suspicious use of WriteProcessMemory 18 IoCs

description	pid	Process	procid_target
PID 2060 wrote to memory of 3064	2060	file.exe	31
PID 2060 wrote to memory of 3064	2060	file.exe	31
PID 2060 wrote to memory of 3064	2060	file.exe	31
PID 2060 wrote to memory of 3064	2060	file.exe	31
PID 2060 wrote to memory of 3064	2060	file.exe	31
PID 2060 wrote to memory of 3064	2060	file.exe	31
PID 2060 wrote to memory of 3064	2060	file.exe	31
PID 2060 wrote to memory of 3064	2060	file.exe	31
PID 2060 wrote to memory of 3064	2060	file.exe	31
PID 2060 wrote to memory of 3064	2060	file.exe	31
PID 2060 wrote to memory of 3064	2060	file.exe	31
PID 2060 wrote to memory of 3064	2060	file.exe	31
PID 2060 wrote to memory of 3064	2060	file.exe	31
PID 2060 wrote to memory of 3064	2060	file.exe	31
PID 2060 wrote to memory of 2736	2060	file.exe	32
PID 2060 wrote to memory of 2736	2060	file.exe	32
PID 2060 wrote to memory of 2736	2060	file.exe	32
PID 2060 wrote to memory of 2736	2060	file.exe	32

C:\Users\Admin\AppData\Local\Temp\file.exe
"C:\Users\Admin\AppData\Local\Temp\file.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2060
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
  2⤵
  PID:3064
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2060 -s 92
  2⤵
  - Program crash
  PID:2736

memory/3064-0-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/3064-8-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmp

Filesize
4KB

Download
memory/3064-9-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/3064-7-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/3064-6-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/3064-5-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/3064-4-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/3064-2-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/3064-11-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/3064-13-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/3064-14-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/3064-15-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download