mystic | 634cb5ec30bc0e9e7a2ddc62c8c83871b0adf592bdfa9a4e9771d7d0aef16c23

Analysis

max time kernel
117s
max time network
120s
platform
windows7_x64
resource
win7-20231023-en
resource tags

arch:x64arch:x86image:win7-20231023-enlocale:en-usos:windows7-x64system
submitted
13-11-2023 09:30

Target

2et8410.exe
Size

310KB
MD5

10dfeb895bcf90a5164ce7b5075dbb94
SHA1

c3bacf0357a7ca4f9d43346015ad0c62bf7d1ebf
SHA256

634cb5ec30bc0e9e7a2ddc62c8c83871b0adf592bdfa9a4e9771d7d0aef16c23
SHA512

5242a0c52487e5bdca222366bcb7dc5f1d8093acba849dc29c93d199f8c414487b26cdba4847936623a4bf8f43a633432d7708d9e3adfd79c6b65948bb28e0c0
SSDEEP

6144:rRJ4eu5tKah/T5pOMiwXH87AGImxmRK5MZLRBN/ch9NzL:rRJ4ei/T5pviwwtIMmRK5KYh9Nv

Score

10^/10

mystic stealer

Detect Mystic stealer payload 6 IoCs

resource	yara_rule
behavioral1/memory/2064-3-0x0000000000400000-0x0000000000433000-memory.dmp	mystic_family
behavioral1/memory/2064-4-0x0000000000400000-0x0000000000433000-memory.dmp	mystic_family
behavioral1/memory/2064-5-0x0000000000400000-0x0000000000433000-memory.dmp	mystic_family
behavioral1/memory/2064-7-0x0000000000400000-0x0000000000433000-memory.dmp	mystic_family
behavioral1/memory/2064-9-0x0000000000400000-0x0000000000433000-memory.dmp	mystic_family
behavioral1/memory/2064-11-0x0000000000400000-0x0000000000433000-memory.dmp	mystic_family

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1728 set thread context of 2064	1728	2et8410.exe	30

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2644	2064	WerFault.exe	30

Suspicious use of WriteProcessMemory 28 IoCs

description	pid	Process	procid_target
PID 1728 wrote to memory of 2420	1728	2et8410.exe	29
PID 1728 wrote to memory of 2420	1728	2et8410.exe	29
PID 1728 wrote to memory of 2420	1728	2et8410.exe	29
PID 1728 wrote to memory of 2420	1728	2et8410.exe	29
PID 1728 wrote to memory of 2420	1728	2et8410.exe	29
PID 1728 wrote to memory of 2420	1728	2et8410.exe	29
PID 1728 wrote to memory of 2420	1728	2et8410.exe	29
PID 1728 wrote to memory of 2064	1728	2et8410.exe	30
PID 1728 wrote to memory of 2064	1728	2et8410.exe	30
PID 1728 wrote to memory of 2064	1728	2et8410.exe	30
PID 1728 wrote to memory of 2064	1728	2et8410.exe	30
PID 1728 wrote to memory of 2064	1728	2et8410.exe	30
PID 1728 wrote to memory of 2064	1728	2et8410.exe	30
PID 1728 wrote to memory of 2064	1728	2et8410.exe	30
PID 1728 wrote to memory of 2064	1728	2et8410.exe	30
PID 1728 wrote to memory of 2064	1728	2et8410.exe	30
PID 1728 wrote to memory of 2064	1728	2et8410.exe	30
PID 1728 wrote to memory of 2064	1728	2et8410.exe	30
PID 1728 wrote to memory of 2064	1728	2et8410.exe	30
PID 1728 wrote to memory of 2064	1728	2et8410.exe	30
PID 1728 wrote to memory of 2064	1728	2et8410.exe	30
PID 2064 wrote to memory of 2644	2064	AppLaunch.exe	31
PID 2064 wrote to memory of 2644	2064	AppLaunch.exe	31
PID 2064 wrote to memory of 2644	2064	AppLaunch.exe	31
PID 2064 wrote to memory of 2644	2064	AppLaunch.exe	31
PID 2064 wrote to memory of 2644	2064	AppLaunch.exe	31
PID 2064 wrote to memory of 2644	2064	AppLaunch.exe	31
PID 2064 wrote to memory of 2644	2064	AppLaunch.exe	31

C:\Users\Admin\AppData\Local\Temp\2et8410.exe
"C:\Users\Admin\AppData\Local\Temp\2et8410.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1728
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
  2⤵
  PID:2420
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2064
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2064 -s 196
    3⤵
    - Program crash
    PID:2644

memory/2064-0-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2064-1-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2064-2-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2064-3-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2064-4-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2064-5-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2064-7-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2064-6-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmp

Filesize
4KB

Download
memory/2064-9-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2064-11-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download