mystic | 51b049325e743d3d967ff456d330d49237fe530279e70a41cefd4b2772f17706

Analysis

max time kernel
63s
max time network
176s
platform
windows10-1703_x64
resource
win10-20231020-en
resource tags

arch:x64arch:x86image:win10-20231020-enlocale:en-usos:windows10-1703-x64system
submitted
13/11/2023, 09:38

Target

11Nc2625.exe
Size

283KB
MD5

a5a72317c8edf1f614090e2821caa402
SHA1

541348e1edf2f7f26e4f1744fe1f31166e3e3e46
SHA256

51b049325e743d3d967ff456d330d49237fe530279e70a41cefd4b2772f17706
SHA512

d8f63480b22c94af43fca7b6f6ff17fb6be42f845771efb944b907e26a06f55fd284882003557f5aea61e9e1145050965903085ff0d6369ed77eadd06fbd12cd
SSDEEP

6144:Zab74vR70tWwD3h8pkuc6RzRQZ9cP+uC7Ud3:Ib4wDR8p3c6x2Z9cP+t7Ud3

Score

10^/10

mystic stealer

Family

mystic

http://5.42.92.43/loghub/master

Detect Mystic stealer payload 5 IoCs

resource	yara_rule
behavioral2/memory/4932-0-0x0000000000400000-0x0000000000433000-memory.dmp	mystic_family
behavioral2/memory/4932-3-0x0000000000400000-0x0000000000433000-memory.dmp	mystic_family
behavioral2/memory/4932-4-0x0000000000400000-0x0000000000433000-memory.dmp	mystic_family
behavioral2/memory/4932-5-0x0000000000400000-0x0000000000433000-memory.dmp	mystic_family
behavioral2/memory/4932-6-0x0000000000400000-0x0000000000433000-memory.dmp	mystic_family

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3032 set thread context of 4932	3032	11Nc2625.exe	76

Suspicious use of WriteProcessMemory 22 IoCs

description	pid	Process	procid_target
PID 3032 wrote to memory of 1388	3032	11Nc2625.exe	72
PID 3032 wrote to memory of 1388	3032	11Nc2625.exe	72
PID 3032 wrote to memory of 1388	3032	11Nc2625.exe	72
PID 3032 wrote to memory of 3824	3032	11Nc2625.exe	73
PID 3032 wrote to memory of 3824	3032	11Nc2625.exe	73
PID 3032 wrote to memory of 3824	3032	11Nc2625.exe	73
PID 3032 wrote to memory of 3696	3032	11Nc2625.exe	74
PID 3032 wrote to memory of 3696	3032	11Nc2625.exe	74
PID 3032 wrote to memory of 3696	3032	11Nc2625.exe	74
PID 3032 wrote to memory of 4520	3032	11Nc2625.exe	75
PID 3032 wrote to memory of 4520	3032	11Nc2625.exe	75
PID 3032 wrote to memory of 4520	3032	11Nc2625.exe	75
PID 3032 wrote to memory of 4932	3032	11Nc2625.exe	76
PID 3032 wrote to memory of 4932	3032	11Nc2625.exe	76
PID 3032 wrote to memory of 4932	3032	11Nc2625.exe	76
PID 3032 wrote to memory of 4932	3032	11Nc2625.exe	76
PID 3032 wrote to memory of 4932	3032	11Nc2625.exe	76
PID 3032 wrote to memory of 4932	3032	11Nc2625.exe	76
PID 3032 wrote to memory of 4932	3032	11Nc2625.exe	76
PID 3032 wrote to memory of 4932	3032	11Nc2625.exe	76
PID 3032 wrote to memory of 4932	3032	11Nc2625.exe	76
PID 3032 wrote to memory of 4932	3032	11Nc2625.exe	76

C:\Users\Admin\AppData\Local\Temp\11Nc2625.exe
"C:\Users\Admin\AppData\Local\Temp\11Nc2625.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3032
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
  2⤵
  PID:1388
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
  2⤵
  PID:3824
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
  2⤵
  PID:3696
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
  2⤵
  PID:4520
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
  2⤵
  PID:4932

memory/4932-0-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4932-3-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4932-4-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4932-5-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4932-6-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download