mystic | 1a9a996d2a2788c74e225e99512e6a0b7632db5a94cfbed6bf1f22e711048e4f

Analysis

max time kernel
157s
max time network
164s
platform
windows10-2004_x64
resource
win10v2004-20230915-en
resource tags

arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
submitted
12-10-2023 11:09

Target

86f8c238c65d1448ac953222698cc05c0f65bff598f4c650559df487f7d2203c.exe
Size

371KB
MD5

5ad689358932b17f6752bb7a060f5aa2
SHA1

88c04797697ba644da1ba42e7d81ca55ce926dfd
SHA256

86f8c238c65d1448ac953222698cc05c0f65bff598f4c650559df487f7d2203c
SHA512

92d0ddc54b8c0f58ab7536bb5684db27d50356b97cc8394a93e3277e6a3e6e99c4f097c03f86d2d6b1b54984bb17f59c3763d5c38b23b3040b0abb82e180cec1
SSDEEP

6144:+RLpmE9POTt+wqWbiC+9DAOviQhuBSGxjPsPojJIfPzxgvZ4xJg8f:+5QE9GTcN4lhlmPzxA4rg8f

Score

10^/10

mystic stealer

Detect Mystic stealer payload 5 IoCs

resource	yara_rule
behavioral2/memory/1668-0-0x0000000000400000-0x0000000000428000-memory.dmp	family_mystic
behavioral2/memory/1668-2-0x0000000000400000-0x0000000000428000-memory.dmp	family_mystic
behavioral2/memory/1668-1-0x0000000000400000-0x0000000000428000-memory.dmp	family_mystic
behavioral2/memory/1668-4-0x0000000000400000-0x0000000000428000-memory.dmp	family_mystic
behavioral2/memory/1668-3-0x0000000000400000-0x0000000000428000-memory.dmp	family_mystic

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 800 set thread context of 1668	800	86f8c238c65d1448ac953222698cc05c0f65bff598f4c650559df487f7d2203c.exe	86

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 800 wrote to memory of 1668	800	86f8c238c65d1448ac953222698cc05c0f65bff598f4c650559df487f7d2203c.exe	86
PID 800 wrote to memory of 1668	800	86f8c238c65d1448ac953222698cc05c0f65bff598f4c650559df487f7d2203c.exe	86
PID 800 wrote to memory of 1668	800	86f8c238c65d1448ac953222698cc05c0f65bff598f4c650559df487f7d2203c.exe	86
PID 800 wrote to memory of 1668	800	86f8c238c65d1448ac953222698cc05c0f65bff598f4c650559df487f7d2203c.exe	86
PID 800 wrote to memory of 1668	800	86f8c238c65d1448ac953222698cc05c0f65bff598f4c650559df487f7d2203c.exe	86
PID 800 wrote to memory of 1668	800	86f8c238c65d1448ac953222698cc05c0f65bff598f4c650559df487f7d2203c.exe	86
PID 800 wrote to memory of 1668	800	86f8c238c65d1448ac953222698cc05c0f65bff598f4c650559df487f7d2203c.exe	86
PID 800 wrote to memory of 1668	800	86f8c238c65d1448ac953222698cc05c0f65bff598f4c650559df487f7d2203c.exe	86
PID 800 wrote to memory of 1668	800	86f8c238c65d1448ac953222698cc05c0f65bff598f4c650559df487f7d2203c.exe	86
PID 800 wrote to memory of 1668	800	86f8c238c65d1448ac953222698cc05c0f65bff598f4c650559df487f7d2203c.exe	86

C:\Users\Admin\AppData\Local\Temp\86f8c238c65d1448ac953222698cc05c0f65bff598f4c650559df487f7d2203c.exe
"C:\Users\Admin\AppData\Local\Temp\86f8c238c65d1448ac953222698cc05c0f65bff598f4c650559df487f7d2203c.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:800
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
  2⤵
  PID:1668

memory/1668-0-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/1668-2-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/1668-1-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/1668-4-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/1668-3-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download