mystic | b38d5f695a430bf14e650839152e0fe32a9f0a4b702213f5223d5f0136ff1343

Analysis

max time kernel
118s
max time network
122s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
12/10/2023, 14:54

Target

file.exe
Size

365KB
MD5

43bce7aea19356915c2cf3a2c0f48157
SHA1

efac2e159bce12c8c9a471d265e2dd51b8776a94
SHA256

b38d5f695a430bf14e650839152e0fe32a9f0a4b702213f5223d5f0136ff1343
SHA512

63a272ab4ab31b0eb8fc0df172f6f9914944f5ee8e4eeecff79e2599b140e47bd95f79f5c88936a79e9fb560de93e7ae317059b727a7de1058a5688ac93b0fa1
SSDEEP

6144:NbEjEc2jicP5iOo2T8VrSd/sUAOXUlty4NsdzCRW5D/ToTmxh10Y1Sa:NbERqiG59ouhUjy4KdAW5DLumxh131Sa

Score

10^/10

mystic stealer

Detect Mystic stealer payload 8 IoCs

resource	yara_rule
behavioral1/memory/2456-10-0x0000000000400000-0x0000000000428000-memory.dmp	family_mystic
behavioral1/memory/2456-13-0x0000000000400000-0x0000000000428000-memory.dmp	family_mystic
behavioral1/memory/2456-8-0x0000000000400000-0x0000000000428000-memory.dmp	family_mystic
behavioral1/memory/2456-6-0x0000000000400000-0x0000000000428000-memory.dmp	family_mystic
behavioral1/memory/2456-15-0x0000000000400000-0x0000000000428000-memory.dmp	family_mystic
behavioral1/memory/2456-17-0x0000000000400000-0x0000000000428000-memory.dmp	family_mystic
behavioral1/memory/2456-18-0x0000000000400000-0x0000000000428000-memory.dmp	family_mystic
behavioral1/memory/2456-19-0x0000000000400000-0x0000000000428000-memory.dmp	family_mystic

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2076 set thread context of 2456	2076	file.exe	28

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 2076 wrote to memory of 2456	2076	file.exe	28
PID 2076 wrote to memory of 2456	2076	file.exe	28
PID 2076 wrote to memory of 2456	2076	file.exe	28
PID 2076 wrote to memory of 2456	2076	file.exe	28
PID 2076 wrote to memory of 2456	2076	file.exe	28
PID 2076 wrote to memory of 2456	2076	file.exe	28
PID 2076 wrote to memory of 2456	2076	file.exe	28
PID 2076 wrote to memory of 2456	2076	file.exe	28
PID 2076 wrote to memory of 2456	2076	file.exe	28
PID 2076 wrote to memory of 2456	2076	file.exe	28
PID 2076 wrote to memory of 2456	2076	file.exe	28
PID 2076 wrote to memory of 2456	2076	file.exe	28
PID 2076 wrote to memory of 2456	2076	file.exe	28
PID 2076 wrote to memory of 2456	2076	file.exe	28

C:\Users\Admin\AppData\Local\Temp\file.exe
"C:\Users\Admin\AppData\Local\Temp\file.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2076
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
  2⤵
  PID:2456

memory/2456-4-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/2456-12-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmp

Filesize
4KB

Download
memory/2456-10-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/2456-13-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/2456-8-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/2456-6-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/2456-2-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/2456-0-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/2456-15-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/2456-17-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/2456-18-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/2456-19-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download