Analysis
-
max time kernel
118s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20230831-en -
resource tags
arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system -
submitted
12/10/2023, 14:54
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
file.exe
Resource
win7-20230831-en
4 signatures
150 seconds
General
-
Target
file.exe
-
Size
365KB
-
MD5
43bce7aea19356915c2cf3a2c0f48157
-
SHA1
efac2e159bce12c8c9a471d265e2dd51b8776a94
-
SHA256
b38d5f695a430bf14e650839152e0fe32a9f0a4b702213f5223d5f0136ff1343
-
SHA512
63a272ab4ab31b0eb8fc0df172f6f9914944f5ee8e4eeecff79e2599b140e47bd95f79f5c88936a79e9fb560de93e7ae317059b727a7de1058a5688ac93b0fa1
-
SSDEEP
6144:NbEjEc2jicP5iOo2T8VrSd/sUAOXUlty4NsdzCRW5D/ToTmxh10Y1Sa:NbERqiG59ouhUjy4KdAW5DLumxh131Sa
Malware Config
Signatures
-
Detect Mystic stealer payload 8 IoCs
resource yara_rule behavioral1/memory/2456-10-0x0000000000400000-0x0000000000428000-memory.dmp family_mystic behavioral1/memory/2456-13-0x0000000000400000-0x0000000000428000-memory.dmp family_mystic behavioral1/memory/2456-8-0x0000000000400000-0x0000000000428000-memory.dmp family_mystic behavioral1/memory/2456-6-0x0000000000400000-0x0000000000428000-memory.dmp family_mystic behavioral1/memory/2456-15-0x0000000000400000-0x0000000000428000-memory.dmp family_mystic behavioral1/memory/2456-17-0x0000000000400000-0x0000000000428000-memory.dmp family_mystic behavioral1/memory/2456-18-0x0000000000400000-0x0000000000428000-memory.dmp family_mystic behavioral1/memory/2456-19-0x0000000000400000-0x0000000000428000-memory.dmp family_mystic -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 2076 set thread context of 2456 2076 file.exe 28 -
Suspicious use of WriteProcessMemory 14 IoCs
description pid Process procid_target PID 2076 wrote to memory of 2456 2076 file.exe 28 PID 2076 wrote to memory of 2456 2076 file.exe 28 PID 2076 wrote to memory of 2456 2076 file.exe 28 PID 2076 wrote to memory of 2456 2076 file.exe 28 PID 2076 wrote to memory of 2456 2076 file.exe 28 PID 2076 wrote to memory of 2456 2076 file.exe 28 PID 2076 wrote to memory of 2456 2076 file.exe 28 PID 2076 wrote to memory of 2456 2076 file.exe 28 PID 2076 wrote to memory of 2456 2076 file.exe 28 PID 2076 wrote to memory of 2456 2076 file.exe 28 PID 2076 wrote to memory of 2456 2076 file.exe 28 PID 2076 wrote to memory of 2456 2076 file.exe 28 PID 2076 wrote to memory of 2456 2076 file.exe 28 PID 2076 wrote to memory of 2456 2076 file.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\file.exe"C:\Users\Admin\AppData\Local\Temp\file.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2076 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"2⤵PID:2456
-