mystic | ebf9de73a31764f9b6f0db98c3173a2298f7504df6f90423fe41158b9a68ea6a

Analysis

max time kernel
117s
max time network
120s
platform
windows7_x64
resource
win7-20231023-en
resource tags

arch:x64arch:x86image:win7-20231023-enlocale:en-usos:windows7-x64system
submitted
13-11-2023 09:40

Target

11eR3753.exe
Size

276KB
MD5

63cdde39ca1956aaf5895889df3764da
SHA1

b5b8a877f68b8bda37b5e5d14b69649b8c71e805
SHA256

ebf9de73a31764f9b6f0db98c3173a2298f7504df6f90423fe41158b9a68ea6a
SHA512

b640b2036547b84e88b8a379a18764d0a98cd3d0aeabef2d90db7db3fe1e871185437ebae9ede024e252738b187cd2c18299be277fa7ce9da2ab125ea3fc6b41
SSDEEP

6144:0KWeIhzyZNGuxq2tRR6C1xeBU+VGGZAcjcA5R8Xj7KH:0KWewyC2tRR6C1ceSCcjcA5R4j7K

Score

10^/10

mystic stealer

Family

mystic

http://5.42.92.43/loghub/master

Detect Mystic stealer payload 8 IoCs

resource	yara_rule
behavioral1/memory/2176-6-0x0000000000400000-0x0000000000433000-memory.dmp	mystic_family
behavioral1/memory/2176-8-0x0000000000400000-0x0000000000433000-memory.dmp	mystic_family
behavioral1/memory/2176-15-0x0000000000400000-0x0000000000433000-memory.dmp	mystic_family
behavioral1/memory/2176-17-0x0000000000400000-0x0000000000433000-memory.dmp	mystic_family
behavioral1/memory/2176-18-0x0000000000400000-0x0000000000433000-memory.dmp	mystic_family
behavioral1/memory/2176-13-0x0000000000400000-0x0000000000433000-memory.dmp	mystic_family
behavioral1/memory/2176-10-0x0000000000400000-0x0000000000433000-memory.dmp	mystic_family
behavioral1/memory/2176-19-0x0000000000400000-0x0000000000433000-memory.dmp	mystic_family

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2712 set thread context of 2176	2712	11eR3753.exe	29

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 2712 wrote to memory of 2176	2712	11eR3753.exe	29
PID 2712 wrote to memory of 2176	2712	11eR3753.exe	29
PID 2712 wrote to memory of 2176	2712	11eR3753.exe	29
PID 2712 wrote to memory of 2176	2712	11eR3753.exe	29
PID 2712 wrote to memory of 2176	2712	11eR3753.exe	29
PID 2712 wrote to memory of 2176	2712	11eR3753.exe	29
PID 2712 wrote to memory of 2176	2712	11eR3753.exe	29
PID 2712 wrote to memory of 2176	2712	11eR3753.exe	29
PID 2712 wrote to memory of 2176	2712	11eR3753.exe	29
PID 2712 wrote to memory of 2176	2712	11eR3753.exe	29
PID 2712 wrote to memory of 2176	2712	11eR3753.exe	29
PID 2712 wrote to memory of 2176	2712	11eR3753.exe	29
PID 2712 wrote to memory of 2176	2712	11eR3753.exe	29
PID 2712 wrote to memory of 2176	2712	11eR3753.exe	29

C:\Users\Admin\AppData\Local\Temp\11eR3753.exe
"C:\Users\Admin\AppData\Local\Temp\11eR3753.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2712
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
  2⤵
  PID:2176

memory/2176-2-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2176-4-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2176-0-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2176-6-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2176-8-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2176-12-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmp

Filesize
4KB

Download
memory/2176-15-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2176-17-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2176-18-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2176-13-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2176-10-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2176-19-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download