mystic | 242d7eb297977345bf579aa734947f851e21a7c4547f078e81c0606a297df502

Analysis

max time kernel
118s
max time network
124s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
12/10/2023, 18:48

Target

file.exe
Size

371KB
MD5

6dd0cddbeeb79ae27641ef92e05fee83
SHA1

76e4f4fdd1cb1e1849f7c2cb28cdc6c7d2494ccb
SHA256

242d7eb297977345bf579aa734947f851e21a7c4547f078e81c0606a297df502
SHA512

db90bfd2a2c8488e9a9ab9272260f994fd21f818a985dfc744aea9be2eb6f8c412fbfbe5b7500b20d92629b8232e927181f272506b4367298d35e2b0194d3191
SSDEEP

6144:lRvJm09zORs+z/TMify9DAO3gQJ/dBM5qqdKvMgAT7tn165R8/:lxw09CK5Nu0BMnAMtTp1QR8/

Score

10^/10

mystic stealer

Detect Mystic stealer payload 6 IoCs

resource	yara_rule
behavioral1/memory/2828-3-0x0000000000400000-0x0000000000428000-memory.dmp	family_mystic
behavioral1/memory/2828-4-0x0000000000400000-0x0000000000428000-memory.dmp	family_mystic
behavioral1/memory/2828-5-0x0000000000400000-0x0000000000428000-memory.dmp	family_mystic
behavioral1/memory/2828-7-0x0000000000400000-0x0000000000428000-memory.dmp	family_mystic
behavioral1/memory/2828-9-0x0000000000400000-0x0000000000428000-memory.dmp	family_mystic
behavioral1/memory/2828-11-0x0000000000400000-0x0000000000428000-memory.dmp	family_mystic

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1936 set thread context of 2828	1936	file.exe	28

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2660	2828	WerFault.exe	28

Suspicious use of WriteProcessMemory 21 IoCs

description	pid	Process	procid_target
PID 1936 wrote to memory of 2828	1936	file.exe	28
PID 1936 wrote to memory of 2828	1936	file.exe	28
PID 1936 wrote to memory of 2828	1936	file.exe	28
PID 1936 wrote to memory of 2828	1936	file.exe	28
PID 1936 wrote to memory of 2828	1936	file.exe	28
PID 1936 wrote to memory of 2828	1936	file.exe	28
PID 1936 wrote to memory of 2828	1936	file.exe	28
PID 1936 wrote to memory of 2828	1936	file.exe	28
PID 1936 wrote to memory of 2828	1936	file.exe	28
PID 1936 wrote to memory of 2828	1936	file.exe	28
PID 1936 wrote to memory of 2828	1936	file.exe	28
PID 1936 wrote to memory of 2828	1936	file.exe	28
PID 1936 wrote to memory of 2828	1936	file.exe	28
PID 1936 wrote to memory of 2828	1936	file.exe	28
PID 2828 wrote to memory of 2660	2828	AppLaunch.exe	29
PID 2828 wrote to memory of 2660	2828	AppLaunch.exe	29
PID 2828 wrote to memory of 2660	2828	AppLaunch.exe	29
PID 2828 wrote to memory of 2660	2828	AppLaunch.exe	29
PID 2828 wrote to memory of 2660	2828	AppLaunch.exe	29
PID 2828 wrote to memory of 2660	2828	AppLaunch.exe	29
PID 2828 wrote to memory of 2660	2828	AppLaunch.exe	29

memory/2828-0-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/2828-1-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/2828-2-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/2828-3-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/2828-4-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/2828-5-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/2828-6-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmp

Filesize
4KB

Download
memory/2828-7-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/2828-9-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/2828-11-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download