mystic | 51b049325e743d3d967ff456d330d49237fe530279e70a41cefd4b2772f17706

Analysis

max time kernel
121s
max time network
126s
platform
windows7_x64
resource
win7-20231023-en
resource tags

arch:x64arch:x86image:win7-20231023-enlocale:en-usos:windows7-x64system
submitted
13/11/2023, 09:38

Target

11Nc2625.exe
Size

283KB
MD5

a5a72317c8edf1f614090e2821caa402
SHA1

541348e1edf2f7f26e4f1744fe1f31166e3e3e46
SHA256

51b049325e743d3d967ff456d330d49237fe530279e70a41cefd4b2772f17706
SHA512

d8f63480b22c94af43fca7b6f6ff17fb6be42f845771efb944b907e26a06f55fd284882003557f5aea61e9e1145050965903085ff0d6369ed77eadd06fbd12cd
SSDEEP

6144:Zab74vR70tWwD3h8pkuc6RzRQZ9cP+uC7Ud3:Ib4wDR8p3c6x2Z9cP+t7Ud3

Score

10^/10

mystic stealer

Detect Mystic stealer payload 6 IoCs

resource	yara_rule
behavioral1/memory/2424-9-0x0000000000400000-0x0000000000433000-memory.dmp	mystic_family
behavioral1/memory/2424-11-0x0000000000400000-0x0000000000433000-memory.dmp	mystic_family
behavioral1/memory/2424-7-0x0000000000400000-0x0000000000433000-memory.dmp	mystic_family
behavioral1/memory/2424-5-0x0000000000400000-0x0000000000433000-memory.dmp	mystic_family
behavioral1/memory/2424-4-0x0000000000400000-0x0000000000433000-memory.dmp	mystic_family
behavioral1/memory/2424-3-0x0000000000400000-0x0000000000433000-memory.dmp	mystic_family

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1612 set thread context of 2424	1612	11Nc2625.exe	29

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2064	2424	WerFault.exe	29

Suspicious use of WriteProcessMemory 21 IoCs

description	pid	Process	procid_target
PID 1612 wrote to memory of 2424	1612	11Nc2625.exe	29
PID 1612 wrote to memory of 2424	1612	11Nc2625.exe	29
PID 1612 wrote to memory of 2424	1612	11Nc2625.exe	29
PID 1612 wrote to memory of 2424	1612	11Nc2625.exe	29
PID 1612 wrote to memory of 2424	1612	11Nc2625.exe	29
PID 1612 wrote to memory of 2424	1612	11Nc2625.exe	29
PID 1612 wrote to memory of 2424	1612	11Nc2625.exe	29
PID 1612 wrote to memory of 2424	1612	11Nc2625.exe	29
PID 1612 wrote to memory of 2424	1612	11Nc2625.exe	29
PID 1612 wrote to memory of 2424	1612	11Nc2625.exe	29
PID 1612 wrote to memory of 2424	1612	11Nc2625.exe	29
PID 1612 wrote to memory of 2424	1612	11Nc2625.exe	29
PID 1612 wrote to memory of 2424	1612	11Nc2625.exe	29
PID 1612 wrote to memory of 2424	1612	11Nc2625.exe	29
PID 2424 wrote to memory of 2064	2424	AppLaunch.exe	30
PID 2424 wrote to memory of 2064	2424	AppLaunch.exe	30
PID 2424 wrote to memory of 2064	2424	AppLaunch.exe	30
PID 2424 wrote to memory of 2064	2424	AppLaunch.exe	30
PID 2424 wrote to memory of 2064	2424	AppLaunch.exe	30
PID 2424 wrote to memory of 2064	2424	AppLaunch.exe	30
PID 2424 wrote to memory of 2064	2424	AppLaunch.exe	30

memory/2424-1-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2424-0-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2424-2-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2424-9-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2424-11-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2424-7-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2424-6-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmp

Filesize
4KB

Download
memory/2424-5-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2424-4-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2424-3-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download