mystic | 0b97349ab62a3582989a397e3bfb760fac9a40c9b1ccd66762becaa4fe9f6240

Analysis

max time kernel
119s
max time network
122s
platform
windows7_x64
resource
win7-20231020-en
resource tags

arch:x64arch:x86image:win7-20231020-enlocale:en-usos:windows7-x64system
submitted
11/11/2023, 23:19

Target

0x0006000000022d83-182.exe
Size

276KB
MD5

9da18462094598c8f3aa4362df1c3a11
SHA1

8b9babe7903214bb3dd4e6d85dc946f022e51a36
SHA256

2e20217dcf30dc1859d7ee61dd1d2432173f955adc59d51587af8e606dbadd7a
SHA512

9e526426933e974e533c2de60bb9685b52b82e4e5e5c8466f515a883335e457812ff6e15d5506279a69483fee8004a480c17a76035d84c9aee0a94d7d481cb0b
SSDEEP

6144:3KWeIhzyZNGutFgaVg5z2yOht19EvdfcqpD6xqKY/moKavQfKH:3KWewyYBODYFvggdQfK

Score

10^/10

mystic stealer

Detect Mystic stealer payload 6 IoCs

resource	yara_rule
behavioral4/memory/2452-3-0x0000000000400000-0x0000000000433000-memory.dmp	mystic_family
behavioral4/memory/2452-7-0x0000000000400000-0x0000000000433000-memory.dmp	mystic_family
behavioral4/memory/2452-5-0x0000000000400000-0x0000000000433000-memory.dmp	mystic_family
behavioral4/memory/2452-4-0x0000000000400000-0x0000000000433000-memory.dmp	mystic_family
behavioral4/memory/2452-9-0x0000000000400000-0x0000000000433000-memory.dmp	mystic_family
behavioral4/memory/2452-11-0x0000000000400000-0x0000000000433000-memory.dmp	mystic_family

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2160 set thread context of 2452	2160	0x0006000000022d83-182.exe	29

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2844	2452	WerFault.exe	29

Suspicious use of WriteProcessMemory 21 IoCs

description	pid	Process	procid_target
PID 2160 wrote to memory of 2452	2160	0x0006000000022d83-182.exe	29
PID 2160 wrote to memory of 2452	2160	0x0006000000022d83-182.exe	29
PID 2160 wrote to memory of 2452	2160	0x0006000000022d83-182.exe	29
PID 2160 wrote to memory of 2452	2160	0x0006000000022d83-182.exe	29
PID 2160 wrote to memory of 2452	2160	0x0006000000022d83-182.exe	29
PID 2160 wrote to memory of 2452	2160	0x0006000000022d83-182.exe	29
PID 2160 wrote to memory of 2452	2160	0x0006000000022d83-182.exe	29
PID 2160 wrote to memory of 2452	2160	0x0006000000022d83-182.exe	29
PID 2160 wrote to memory of 2452	2160	0x0006000000022d83-182.exe	29
PID 2160 wrote to memory of 2452	2160	0x0006000000022d83-182.exe	29
PID 2160 wrote to memory of 2452	2160	0x0006000000022d83-182.exe	29
PID 2160 wrote to memory of 2452	2160	0x0006000000022d83-182.exe	29
PID 2160 wrote to memory of 2452	2160	0x0006000000022d83-182.exe	29
PID 2160 wrote to memory of 2452	2160	0x0006000000022d83-182.exe	29
PID 2452 wrote to memory of 2844	2452	AppLaunch.exe	30
PID 2452 wrote to memory of 2844	2452	AppLaunch.exe	30
PID 2452 wrote to memory of 2844	2452	AppLaunch.exe	30
PID 2452 wrote to memory of 2844	2452	AppLaunch.exe	30
PID 2452 wrote to memory of 2844	2452	AppLaunch.exe	30
PID 2452 wrote to memory of 2844	2452	AppLaunch.exe	30
PID 2452 wrote to memory of 2844	2452	AppLaunch.exe	30

memory/2452-0-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2452-1-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2452-3-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2452-2-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2452-6-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmp

Filesize
4KB

Download
memory/2452-7-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2452-5-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2452-4-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2452-9-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2452-11-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download