mystic | 912652c9e3181955874efbe00832847883b873a455e6623aeba2e0d9716bc0a4

Analysis

max time kernel
140s
max time network
157s
platform
windows10-2004_x64
resource
win10v2004-20230915-en
resource tags

arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
submitted
12/10/2023, 14:50

Target

file.exe
Size

365KB
MD5

99db7dd959b3be0545bfba5b2e370e18
SHA1

dd29cff26db84b3bdcaece5cb15cdabc077f83f8
SHA256

912652c9e3181955874efbe00832847883b873a455e6623aeba2e0d9716bc0a4
SHA512

dd0d0c8c82fb00534ae14c0f3de289af325a2b38269b216b28c49b6bc01d685455b9f0457ddb8c7063ec041120b8d5fc315212091f05ee4a6e8e0be132dd0e40
SSDEEP

6144:1gPjEm2jicP5iOo2T8VrSd/sUAOTUlVkeYvc0Dlib+Gog0Um5Llaba1Sa:1gPDqiG59oupUhYvc6la+L35haba1Sa

Score

10^/10

mystic stealer

Detect Mystic stealer payload 5 IoCs

resource	yara_rule
behavioral2/memory/3572-0-0x0000000000400000-0x0000000000428000-memory.dmp	family_mystic
behavioral2/memory/3572-2-0x0000000000400000-0x0000000000428000-memory.dmp	family_mystic
behavioral2/memory/3572-1-0x0000000000400000-0x0000000000428000-memory.dmp	family_mystic
behavioral2/memory/3572-3-0x0000000000400000-0x0000000000428000-memory.dmp	family_mystic
behavioral2/memory/3572-4-0x0000000000400000-0x0000000000428000-memory.dmp	family_mystic

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 380 set thread context of 3572	380	file.exe	85

Suspicious use of WriteProcessMemory 13 IoCs

description	pid	Process	procid_target
PID 380 wrote to memory of 3244	380	file.exe	84
PID 380 wrote to memory of 3244	380	file.exe	84
PID 380 wrote to memory of 3244	380	file.exe	84
PID 380 wrote to memory of 3572	380	file.exe	85
PID 380 wrote to memory of 3572	380	file.exe	85
PID 380 wrote to memory of 3572	380	file.exe	85
PID 380 wrote to memory of 3572	380	file.exe	85
PID 380 wrote to memory of 3572	380	file.exe	85
PID 380 wrote to memory of 3572	380	file.exe	85
PID 380 wrote to memory of 3572	380	file.exe	85
PID 380 wrote to memory of 3572	380	file.exe	85
PID 380 wrote to memory of 3572	380	file.exe	85
PID 380 wrote to memory of 3572	380	file.exe	85

C:\Users\Admin\AppData\Local\Temp\file.exe
"C:\Users\Admin\AppData\Local\Temp\file.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:380
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
  2⤵
  PID:3244
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
  2⤵
  PID:3572

memory/3572-0-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/3572-2-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/3572-1-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/3572-3-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/3572-4-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download