mystic | 3d1a2b1b79e9874f189e7fe2f975bec1ee7304dd55cb36e65d9686950f4a7410

Analysis

max time kernel
153s
max time network
166s
platform
windows10-2004_x64
resource
win10v2004-20230915-en
resource tags

arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
submitted
12/10/2023, 07:16

Target

file.exe
Size

700KB
MD5

169ea2c57794dc69d9c869bddb6da795
SHA1

fe6f42340e64099209aefd6c787d6423475a8b57
SHA256

3d1a2b1b79e9874f189e7fe2f975bec1ee7304dd55cb36e65d9686950f4a7410
SHA512

6a518c060da2f9d6766d461064bf36189701dbb53315bbc0c366c4e172b8adeb664c3f2b9ebfc66da738e42904e43eb4cfa5f0b2be1880d0a46d1cba25124d0f
SSDEEP

6144:1SvGAafgBMniUwluzlcy/XVucQ5BH8MA5OZa8aUCID4Iij0wtvfz:gGfg2i8VucQ5BHiOZa8ad3ILw9z

Score

10^/10

mystic stealer

Family

mystic

http://5.42.92.211/loghub/master

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1828 set thread context of 4936	1828	file.exe	90

Program crash 1 IoCs

pid	pid_target	Process	procid_target
5076	1828	WerFault.exe	84

Suspicious use of WriteProcessMemory 13 IoCs

description	pid	Process	procid_target
PID 1828 wrote to memory of 3036	1828	file.exe	89
PID 1828 wrote to memory of 3036	1828	file.exe	89
PID 1828 wrote to memory of 3036	1828	file.exe	89
PID 1828 wrote to memory of 4936	1828	file.exe	90
PID 1828 wrote to memory of 4936	1828	file.exe	90
PID 1828 wrote to memory of 4936	1828	file.exe	90
PID 1828 wrote to memory of 4936	1828	file.exe	90
PID 1828 wrote to memory of 4936	1828	file.exe	90
PID 1828 wrote to memory of 4936	1828	file.exe	90
PID 1828 wrote to memory of 4936	1828	file.exe	90
PID 1828 wrote to memory of 4936	1828	file.exe	90
PID 1828 wrote to memory of 4936	1828	file.exe	90
PID 1828 wrote to memory of 4936	1828	file.exe	90

C:\Users\Admin\AppData\Local\Temp\file.exe
"C:\Users\Admin\AppData\Local\Temp\file.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1828
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
  2⤵
  PID:3036
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
  2⤵
  PID:4936
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1828 -s 136
  2⤵
  - Program crash
  PID:5076

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 468 -p 1828 -ip 1828
1⤵
PID:1616

memory/4936-0-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/4936-1-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/4936-2-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/4936-3-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/4936-4-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/4936-5-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download