mystic | dee95abe5f71db0e84d48f29932bedef8149e710aac85fe13414585bfa9d3807

Analysis

max time kernel
133s
max time network
161s
platform
windows10-2004_x64
resource
win10v2004-20230915-en
resource tags

arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
submitted
12-10-2023 16:17

Target

3dc3c86de641b5098d278807e52a5326.exe
Size

371KB
MD5

3dc3c86de641b5098d278807e52a5326
SHA1

7da7b994eca80f08ffca8a2e7dc0afb93145803d
SHA256

dee95abe5f71db0e84d48f29932bedef8149e710aac85fe13414585bfa9d3807
SHA512

2a370443e934e980431881204a4cd2d182d57ae956c36bb408bdc4b7d37db4c48014850d8c25f3a0a509899271ab4299387d4f62fce41cf75a5fdcd6de349a4f
SSDEEP

6144:vnvJm09zORs+z/TMify9DAOxgQuGai5rxL7cbWI+FB9N7ZiKrzd3OC8/:vvw09CK5NcpixxPcbWHFBZfd3OC8/

Score

10^/10

mystic stealer

Detect Mystic stealer payload 5 IoCs

resource	yara_rule
behavioral2/memory/1088-0-0x0000000000400000-0x0000000000428000-memory.dmp	family_mystic
behavioral2/memory/1088-1-0x0000000000400000-0x0000000000428000-memory.dmp	family_mystic
behavioral2/memory/1088-2-0x0000000000400000-0x0000000000428000-memory.dmp	family_mystic
behavioral2/memory/1088-3-0x0000000000400000-0x0000000000428000-memory.dmp	family_mystic
behavioral2/memory/1088-4-0x0000000000400000-0x0000000000428000-memory.dmp	family_mystic

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2368 set thread context of 1088	2368	3dc3c86de641b5098d278807e52a5326.exe	82

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 2368 wrote to memory of 1088	2368	3dc3c86de641b5098d278807e52a5326.exe	82
PID 2368 wrote to memory of 1088	2368	3dc3c86de641b5098d278807e52a5326.exe	82
PID 2368 wrote to memory of 1088	2368	3dc3c86de641b5098d278807e52a5326.exe	82
PID 2368 wrote to memory of 1088	2368	3dc3c86de641b5098d278807e52a5326.exe	82
PID 2368 wrote to memory of 1088	2368	3dc3c86de641b5098d278807e52a5326.exe	82
PID 2368 wrote to memory of 1088	2368	3dc3c86de641b5098d278807e52a5326.exe	82
PID 2368 wrote to memory of 1088	2368	3dc3c86de641b5098d278807e52a5326.exe	82
PID 2368 wrote to memory of 1088	2368	3dc3c86de641b5098d278807e52a5326.exe	82
PID 2368 wrote to memory of 1088	2368	3dc3c86de641b5098d278807e52a5326.exe	82
PID 2368 wrote to memory of 1088	2368	3dc3c86de641b5098d278807e52a5326.exe	82

C:\Users\Admin\AppData\Local\Temp\3dc3c86de641b5098d278807e52a5326.exe
"C:\Users\Admin\AppData\Local\Temp\3dc3c86de641b5098d278807e52a5326.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2368
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
  2⤵
  PID:1088

memory/1088-0-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/1088-1-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/1088-2-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/1088-3-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/1088-4-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download