mystic | 4d5f340b7d57382d4a19355b9b375c61d5fc14418936840c051e4fddefb95830

Analysis

max time kernel
187s
max time network
294s
platform
windows10-1703_x64
resource
win10-20231020-en
resource tags

arch:x64arch:x86image:win10-20231020-enlocale:en-usos:windows10-1703-x64system
submitted
13-11-2023 09:33

Target

11tY2884.exe
Size

276KB
MD5

edba3d62dc68ea88ea645be58f11be88
SHA1

9c131a66d6ec32af181b0479c3e90d55b2c642ba
SHA256

4d5f340b7d57382d4a19355b9b375c61d5fc14418936840c051e4fddefb95830
SHA512

066c53e425b5073d559cfbd2a885c7c7e9a86c7b581301729d7ec307ae7ad5a42809c75a538ee21e235f02f3a5bc1c71f260ddf2089a1732392fd37695e9aae2
SSDEEP

6144:MKWeIhzyZNGu42AfYHXHYY6o5Eob1B7uj/sQ1J8wcazdKH:MKWewyQfYmgDpUjpfcapK

Score

10^/10

mystic stealer

Family

mystic

http://5.42.92.43/loghub/master

Detect Mystic stealer payload 5 IoCs

resource	yara_rule
behavioral2/memory/4104-0-0x0000000000400000-0x0000000000433000-memory.dmp	mystic_family
behavioral2/memory/4104-4-0x0000000000400000-0x0000000000433000-memory.dmp	mystic_family
behavioral2/memory/4104-5-0x0000000000400000-0x0000000000433000-memory.dmp	mystic_family
behavioral2/memory/4104-3-0x0000000000400000-0x0000000000433000-memory.dmp	mystic_family
behavioral2/memory/4104-6-0x0000000000400000-0x0000000000433000-memory.dmp	mystic_family

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2336 set thread context of 4104	2336	11tY2884.exe	72

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 2336 wrote to memory of 4104	2336	11tY2884.exe	72
PID 2336 wrote to memory of 4104	2336	11tY2884.exe	72
PID 2336 wrote to memory of 4104	2336	11tY2884.exe	72
PID 2336 wrote to memory of 4104	2336	11tY2884.exe	72
PID 2336 wrote to memory of 4104	2336	11tY2884.exe	72
PID 2336 wrote to memory of 4104	2336	11tY2884.exe	72
PID 2336 wrote to memory of 4104	2336	11tY2884.exe	72
PID 2336 wrote to memory of 4104	2336	11tY2884.exe	72
PID 2336 wrote to memory of 4104	2336	11tY2884.exe	72
PID 2336 wrote to memory of 4104	2336	11tY2884.exe	72

C:\Users\Admin\AppData\Local\Temp\11tY2884.exe
"C:\Users\Admin\AppData\Local\Temp\11tY2884.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2336
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
  2⤵
  PID:4104

memory/4104-0-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4104-4-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4104-5-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4104-3-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4104-6-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download