mystic | 627bdf7a9650d45175723c9dd313ce63df6be286018d4e3f746c6ee42bad7e45

Analysis

max time kernel
118s
max time network
122s
platform
windows7_x64
resource
win7-20231025-en
resource tags

arch:x64arch:x86image:win7-20231025-enlocale:en-usos:windows7-x64system
submitted
13/11/2023, 09:39

Target

11zL5692.exe
Size

276KB
MD5

6388d171313b848164f405dc3f7f79cd
SHA1

27eaddb12dea3065f72c2e6f146b24550cb3d986
SHA256

627bdf7a9650d45175723c9dd313ce63df6be286018d4e3f746c6ee42bad7e45
SHA512

6961e784720875763ec57c8d75cf57f9cc35a6f2a7ce64873c2546ea63a9197f4c1aac4e7cf68af5b0e4e2193c27a56109885741cba60a90b1c2b1aef8c92375
SSDEEP

6144:2KWeIhzyZNGuHPqKLQGD5N15kBL28+5lJSenN+UKH:2KWewyh7LFpkxNGvK

Score

10^/10

mystic stealer

Detect Mystic stealer payload 6 IoCs

resource	yara_rule
behavioral1/memory/1016-7-0x0000000000400000-0x0000000000433000-memory.dmp	mystic_family
behavioral1/memory/1016-11-0x0000000000400000-0x0000000000433000-memory.dmp	mystic_family
behavioral1/memory/1016-9-0x0000000000400000-0x0000000000433000-memory.dmp	mystic_family
behavioral1/memory/1016-5-0x0000000000400000-0x0000000000433000-memory.dmp	mystic_family
behavioral1/memory/1016-4-0x0000000000400000-0x0000000000433000-memory.dmp	mystic_family
behavioral1/memory/1016-3-0x0000000000400000-0x0000000000433000-memory.dmp	mystic_family

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1976 set thread context of 1016	1976	11zL5692.exe	21

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1700	1016	WerFault.exe	21

Suspicious use of WriteProcessMemory 21 IoCs

description	pid	Process	procid_target
PID 1976 wrote to memory of 1016	1976	11zL5692.exe	21
PID 1976 wrote to memory of 1016	1976	11zL5692.exe	21
PID 1976 wrote to memory of 1016	1976	11zL5692.exe	21
PID 1976 wrote to memory of 1016	1976	11zL5692.exe	21
PID 1976 wrote to memory of 1016	1976	11zL5692.exe	21
PID 1976 wrote to memory of 1016	1976	11zL5692.exe	21
PID 1976 wrote to memory of 1016	1976	11zL5692.exe	21
PID 1976 wrote to memory of 1016	1976	11zL5692.exe	21
PID 1976 wrote to memory of 1016	1976	11zL5692.exe	21
PID 1976 wrote to memory of 1016	1976	11zL5692.exe	21
PID 1976 wrote to memory of 1016	1976	11zL5692.exe	21
PID 1976 wrote to memory of 1016	1976	11zL5692.exe	21
PID 1976 wrote to memory of 1016	1976	11zL5692.exe	21
PID 1976 wrote to memory of 1016	1976	11zL5692.exe	21
PID 1016 wrote to memory of 1700	1016	AppLaunch.exe	30
PID 1016 wrote to memory of 1700	1016	AppLaunch.exe	30
PID 1016 wrote to memory of 1700	1016	AppLaunch.exe	30
PID 1016 wrote to memory of 1700	1016	AppLaunch.exe	30
PID 1016 wrote to memory of 1700	1016	AppLaunch.exe	30
PID 1016 wrote to memory of 1700	1016	AppLaunch.exe	30
PID 1016 wrote to memory of 1700	1016	AppLaunch.exe	30

memory/1016-7-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1016-11-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1016-9-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1016-6-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmp

Filesize
4KB

Download
memory/1016-5-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1016-4-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1016-3-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1016-2-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1016-1-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1016-0-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download