mystic | d230a93c74262d42f43afebc9b31e865a65c2aa10ca201b7aad30947cdd4c373

Analysis

max time kernel
118s
max time network
122s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
14/10/2023, 01:41

Target

file.exe
Size

342KB
MD5

c6525c5ef938105d1ac779484cc22cbf
SHA1

f02c0855a29b5e30795f421eb9fc52642d4e5963
SHA256

d230a93c74262d42f43afebc9b31e865a65c2aa10ca201b7aad30947cdd4c373
SHA512

9999e86078ec6abda23e7471bd085f677061c8d1edc315fdd42a4a1a349e78edd0f1f581e388954376b666898a874b7a2f6a6e1026c94f1c8769b11e19fc73f4
SSDEEP

6144:7HxiKL/yfYb5B+BO99c0s0ZVtAOfg9bKXka8/jqjD1Xo0QE9:Dx//yfYb5BIQZVtRCbykp/jqF59

Score

10^/10

mystic stealer

Detect Mystic stealer payload 6 IoCs

resource	yara_rule
behavioral1/memory/2984-3-0x0000000000400000-0x0000000000428000-memory.dmp	family_mystic
behavioral1/memory/2984-7-0x0000000000400000-0x0000000000428000-memory.dmp	family_mystic
behavioral1/memory/2984-5-0x0000000000400000-0x0000000000428000-memory.dmp	family_mystic
behavioral1/memory/2984-4-0x0000000000400000-0x0000000000428000-memory.dmp	family_mystic
behavioral1/memory/2984-9-0x0000000000400000-0x0000000000428000-memory.dmp	family_mystic
behavioral1/memory/2984-11-0x0000000000400000-0x0000000000428000-memory.dmp	family_mystic

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2944 set thread context of 2984	2944	file.exe	29

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2640	2984	WerFault.exe	29

Suspicious use of WriteProcessMemory 21 IoCs

description	pid	Process	procid_target
PID 2944 wrote to memory of 2984	2944	file.exe	29
PID 2944 wrote to memory of 2984	2944	file.exe	29
PID 2944 wrote to memory of 2984	2944	file.exe	29
PID 2944 wrote to memory of 2984	2944	file.exe	29
PID 2944 wrote to memory of 2984	2944	file.exe	29
PID 2944 wrote to memory of 2984	2944	file.exe	29
PID 2944 wrote to memory of 2984	2944	file.exe	29
PID 2944 wrote to memory of 2984	2944	file.exe	29
PID 2944 wrote to memory of 2984	2944	file.exe	29
PID 2944 wrote to memory of 2984	2944	file.exe	29
PID 2944 wrote to memory of 2984	2944	file.exe	29
PID 2944 wrote to memory of 2984	2944	file.exe	29
PID 2944 wrote to memory of 2984	2944	file.exe	29
PID 2944 wrote to memory of 2984	2944	file.exe	29
PID 2984 wrote to memory of 2640	2984	AppLaunch.exe	30
PID 2984 wrote to memory of 2640	2984	AppLaunch.exe	30
PID 2984 wrote to memory of 2640	2984	AppLaunch.exe	30
PID 2984 wrote to memory of 2640	2984	AppLaunch.exe	30
PID 2984 wrote to memory of 2640	2984	AppLaunch.exe	30
PID 2984 wrote to memory of 2640	2984	AppLaunch.exe	30
PID 2984 wrote to memory of 2640	2984	AppLaunch.exe	30

memory/2984-2-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/2984-3-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/2984-1-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/2984-0-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/2984-7-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/2984-6-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmp

Filesize
4KB

Download
memory/2984-5-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/2984-4-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/2984-9-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/2984-11-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download