mystic | 91e9fea87e0dcd09477cca6655fc7c0e9c69dcd78db17ce71978baac81c11114

Analysis

max time kernel
122s
max time network
126s
platform
windows7_x64
resource
win7-20231025-en
resource tags

arch:x64arch:x86image:win7-20231025-enlocale:en-usos:windows7-x64system
submitted
13/11/2023, 09:30

Target

11or5678.exe
Size

276KB
MD5

3e39720bda10dbb894b99a4aef9d57a4
SHA1

4f0044c9d40096f13714dd47ef4d5a41132a88ce
SHA256

91e9fea87e0dcd09477cca6655fc7c0e9c69dcd78db17ce71978baac81c11114
SHA512

fb5d9f7796a185d40fb842531e30eceb4d7ef7ee9ccd538fd33e86249dff80d9441ad73631cf62ab27e6dccc95eff9caa8dcc0885519ccfa0631582e3a88cf7c
SSDEEP

6144:QKWeIhzyZNGuA4d5dikcydcaxbLRDlxLrtdqmA2WrpKH:QKWewyLd5diktdR1LdlxLRdqH2WNK

Score

10^/10

mystic stealer

Detect Mystic stealer payload 6 IoCs

resource	yara_rule
behavioral1/memory/1860-7-0x0000000000400000-0x0000000000433000-memory.dmp	mystic_family
behavioral1/memory/1860-5-0x0000000000400000-0x0000000000433000-memory.dmp	mystic_family
behavioral1/memory/1860-4-0x0000000000400000-0x0000000000433000-memory.dmp	mystic_family
behavioral1/memory/1860-3-0x0000000000400000-0x0000000000433000-memory.dmp	mystic_family
behavioral1/memory/1860-9-0x0000000000400000-0x0000000000433000-memory.dmp	mystic_family
behavioral1/memory/1860-11-0x0000000000400000-0x0000000000433000-memory.dmp	mystic_family

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1728 set thread context of 1860	1728	11or5678.exe	29

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1164	1860	WerFault.exe	29

Suspicious use of WriteProcessMemory 21 IoCs

description	pid	Process	procid_target
PID 1728 wrote to memory of 1860	1728	11or5678.exe	29
PID 1728 wrote to memory of 1860	1728	11or5678.exe	29
PID 1728 wrote to memory of 1860	1728	11or5678.exe	29
PID 1728 wrote to memory of 1860	1728	11or5678.exe	29
PID 1728 wrote to memory of 1860	1728	11or5678.exe	29
PID 1728 wrote to memory of 1860	1728	11or5678.exe	29
PID 1728 wrote to memory of 1860	1728	11or5678.exe	29
PID 1728 wrote to memory of 1860	1728	11or5678.exe	29
PID 1728 wrote to memory of 1860	1728	11or5678.exe	29
PID 1728 wrote to memory of 1860	1728	11or5678.exe	29
PID 1728 wrote to memory of 1860	1728	11or5678.exe	29
PID 1728 wrote to memory of 1860	1728	11or5678.exe	29
PID 1728 wrote to memory of 1860	1728	11or5678.exe	29
PID 1728 wrote to memory of 1860	1728	11or5678.exe	29
PID 1860 wrote to memory of 1164	1860	AppLaunch.exe	30
PID 1860 wrote to memory of 1164	1860	AppLaunch.exe	30
PID 1860 wrote to memory of 1164	1860	AppLaunch.exe	30
PID 1860 wrote to memory of 1164	1860	AppLaunch.exe	30
PID 1860 wrote to memory of 1164	1860	AppLaunch.exe	30
PID 1860 wrote to memory of 1164	1860	AppLaunch.exe	30
PID 1860 wrote to memory of 1164	1860	AppLaunch.exe	30

memory/1860-2-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1860-6-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmp

Filesize
4KB

Download
memory/1860-7-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1860-5-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1860-4-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1860-3-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1860-1-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1860-0-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1860-9-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1860-11-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download