mystic | 242d7eb297977345bf579aa734947f851e21a7c4547f078e81c0606a297df502

Analysis

max time kernel
138s
max time network
162s
platform
windows10-2004_x64
resource
win10v2004-20230915-en
resource tags

arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
submitted
12/10/2023, 18:48

Target

file.exe
Size

371KB
MD5

6dd0cddbeeb79ae27641ef92e05fee83
SHA1

76e4f4fdd1cb1e1849f7c2cb28cdc6c7d2494ccb
SHA256

242d7eb297977345bf579aa734947f851e21a7c4547f078e81c0606a297df502
SHA512

db90bfd2a2c8488e9a9ab9272260f994fd21f818a985dfc744aea9be2eb6f8c412fbfbe5b7500b20d92629b8232e927181f272506b4367298d35e2b0194d3191
SSDEEP

6144:lRvJm09zORs+z/TMify9DAO3gQJ/dBM5qqdKvMgAT7tn165R8/:lxw09CK5Nu0BMnAMtTp1QR8/

Score

10^/10

mystic stealer

Detect Mystic stealer payload 5 IoCs

resource	yara_rule
behavioral2/memory/4468-0-0x0000000000400000-0x0000000000428000-memory.dmp	family_mystic
behavioral2/memory/4468-1-0x0000000000400000-0x0000000000428000-memory.dmp	family_mystic
behavioral2/memory/4468-2-0x0000000000400000-0x0000000000428000-memory.dmp	family_mystic
behavioral2/memory/4468-3-0x0000000000400000-0x0000000000428000-memory.dmp	family_mystic
behavioral2/memory/4468-4-0x0000000000400000-0x0000000000428000-memory.dmp	family_mystic

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 5096 set thread context of 4468	5096	file.exe	84

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 5096 wrote to memory of 4468	5096	file.exe	84
PID 5096 wrote to memory of 4468	5096	file.exe	84
PID 5096 wrote to memory of 4468	5096	file.exe	84
PID 5096 wrote to memory of 4468	5096	file.exe	84
PID 5096 wrote to memory of 4468	5096	file.exe	84
PID 5096 wrote to memory of 4468	5096	file.exe	84
PID 5096 wrote to memory of 4468	5096	file.exe	84
PID 5096 wrote to memory of 4468	5096	file.exe	84
PID 5096 wrote to memory of 4468	5096	file.exe	84
PID 5096 wrote to memory of 4468	5096	file.exe	84

C:\Users\Admin\AppData\Local\Temp\file.exe
"C:\Users\Admin\AppData\Local\Temp\file.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:5096
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
  2⤵
  PID:4468

memory/4468-0-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/4468-1-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/4468-2-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/4468-3-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/4468-4-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download