mystic | 627bdf7a9650d45175723c9dd313ce63df6be286018d4e3f746c6ee42bad7e45

Analysis

max time kernel
186s
max time network
250s
platform
windows10-1703_x64
resource
win10-20231020-en
resource tags

arch:x64arch:x86image:win10-20231020-enlocale:en-usos:windows10-1703-x64system
submitted
13/11/2023, 09:39

Target

11zL5692.exe
Size

276KB
MD5

6388d171313b848164f405dc3f7f79cd
SHA1

27eaddb12dea3065f72c2e6f146b24550cb3d986
SHA256

627bdf7a9650d45175723c9dd313ce63df6be286018d4e3f746c6ee42bad7e45
SHA512

6961e784720875763ec57c8d75cf57f9cc35a6f2a7ce64873c2546ea63a9197f4c1aac4e7cf68af5b0e4e2193c27a56109885741cba60a90b1c2b1aef8c92375
SSDEEP

6144:2KWeIhzyZNGuHPqKLQGD5N15kBL28+5lJSenN+UKH:2KWewyh7LFpkxNGvK

Score

10^/10

mystic stealer

Family

mystic

http://5.42.92.43/loghub/master

Detect Mystic stealer payload 5 IoCs

resource	yara_rule
behavioral2/memory/3532-3-0x0000000000400000-0x0000000000433000-memory.dmp	mystic_family
behavioral2/memory/3532-5-0x0000000000400000-0x0000000000433000-memory.dmp	mystic_family
behavioral2/memory/3532-4-0x0000000000400000-0x0000000000433000-memory.dmp	mystic_family
behavioral2/memory/3532-0-0x0000000000400000-0x0000000000433000-memory.dmp	mystic_family
behavioral2/memory/3532-6-0x0000000000400000-0x0000000000433000-memory.dmp	mystic_family

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1504 set thread context of 3532	1504	11zL5692.exe	22

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 1504 wrote to memory of 3532	1504	11zL5692.exe	22
PID 1504 wrote to memory of 3532	1504	11zL5692.exe	22
PID 1504 wrote to memory of 3532	1504	11zL5692.exe	22
PID 1504 wrote to memory of 3532	1504	11zL5692.exe	22
PID 1504 wrote to memory of 3532	1504	11zL5692.exe	22
PID 1504 wrote to memory of 3532	1504	11zL5692.exe	22
PID 1504 wrote to memory of 3532	1504	11zL5692.exe	22
PID 1504 wrote to memory of 3532	1504	11zL5692.exe	22
PID 1504 wrote to memory of 3532	1504	11zL5692.exe	22
PID 1504 wrote to memory of 3532	1504	11zL5692.exe	22

C:\Users\Admin\AppData\Local\Temp\11zL5692.exe
"C:\Users\Admin\AppData\Local\Temp\11zL5692.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1504
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
  2⤵
  PID:3532

memory/3532-3-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3532-5-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3532-4-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3532-0-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3532-6-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download