mystic | 7d456683a069978de6b7e28e455c691a7d37d8d8b9507df86e8e9c5c0d6983b0

Analysis

max time kernel
120s
max time network
124s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
12-10-2023 15:43

Target

file.exe
Size

371KB
MD5

25c0ef13f3b36ef0b77679850764f0ec
SHA1

19fbc6fdc8300ec40134f90ad63ab2da1eb1a0ed
SHA256

7d456683a069978de6b7e28e455c691a7d37d8d8b9507df86e8e9c5c0d6983b0
SHA512

fe7a83a06c9fb06ef18398411bde809af433183f210e267187d9e41cd9a38d09afcc2d6f4c2bed75cc56e6e1040f79fc0fe4ef7bdd810d92f83279fc0a74d28f
SSDEEP

6144:j9vJm09zORs+z/TMify9DAOBgQzEbjeAm5SimSI8/:jlw09CK5NQaACAmID8/

Score

10^/10

mystic stealer

Detect Mystic stealer payload 6 IoCs

resource	yara_rule
behavioral1/memory/2244-3-0x0000000000400000-0x0000000000428000-memory.dmp	family_mystic
behavioral1/memory/2244-4-0x0000000000400000-0x0000000000428000-memory.dmp	family_mystic
behavioral1/memory/2244-9-0x0000000000400000-0x0000000000428000-memory.dmp	family_mystic
behavioral1/memory/2244-7-0x0000000000400000-0x0000000000428000-memory.dmp	family_mystic
behavioral1/memory/2244-5-0x0000000000400000-0x0000000000428000-memory.dmp	family_mystic
behavioral1/memory/2244-11-0x0000000000400000-0x0000000000428000-memory.dmp	family_mystic

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2260 set thread context of 2244	2260	file.exe	29

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2468	2244	WerFault.exe	29

Suspicious use of WriteProcessMemory 28 IoCs

description	pid	Process	procid_target
PID 2260 wrote to memory of 2376	2260	file.exe	28
PID 2260 wrote to memory of 2376	2260	file.exe	28
PID 2260 wrote to memory of 2376	2260	file.exe	28
PID 2260 wrote to memory of 2376	2260	file.exe	28
PID 2260 wrote to memory of 2376	2260	file.exe	28
PID 2260 wrote to memory of 2376	2260	file.exe	28
PID 2260 wrote to memory of 2376	2260	file.exe	28
PID 2260 wrote to memory of 2244	2260	file.exe	29
PID 2260 wrote to memory of 2244	2260	file.exe	29
PID 2260 wrote to memory of 2244	2260	file.exe	29
PID 2260 wrote to memory of 2244	2260	file.exe	29
PID 2260 wrote to memory of 2244	2260	file.exe	29
PID 2260 wrote to memory of 2244	2260	file.exe	29
PID 2260 wrote to memory of 2244	2260	file.exe	29
PID 2260 wrote to memory of 2244	2260	file.exe	29
PID 2260 wrote to memory of 2244	2260	file.exe	29
PID 2260 wrote to memory of 2244	2260	file.exe	29
PID 2260 wrote to memory of 2244	2260	file.exe	29
PID 2260 wrote to memory of 2244	2260	file.exe	29
PID 2260 wrote to memory of 2244	2260	file.exe	29
PID 2260 wrote to memory of 2244	2260	file.exe	29
PID 2244 wrote to memory of 2468	2244	AppLaunch.exe	30
PID 2244 wrote to memory of 2468	2244	AppLaunch.exe	30
PID 2244 wrote to memory of 2468	2244	AppLaunch.exe	30
PID 2244 wrote to memory of 2468	2244	AppLaunch.exe	30
PID 2244 wrote to memory of 2468	2244	AppLaunch.exe	30
PID 2244 wrote to memory of 2468	2244	AppLaunch.exe	30
PID 2244 wrote to memory of 2468	2244	AppLaunch.exe	30

C:\Users\Admin\AppData\Local\Temp\file.exe
"C:\Users\Admin\AppData\Local\Temp\file.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2260
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
  2⤵
  PID:2376
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2244
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2244 -s 196
    3⤵
    - Program crash
    PID:2468

memory/2244-2-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/2244-3-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/2244-1-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/2244-0-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/2244-4-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/2244-9-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/2244-7-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/2244-6-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmp

Filesize
4KB

Download
memory/2244-5-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/2244-11-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download