mystic | ebf9de73a31764f9b6f0db98c3173a2298f7504df6f90423fe41158b9a68ea6a

Analysis

max time kernel
186s
max time network
304s
platform
windows10-1703_x64
resource
win10-20231020-en
resource tags

arch:x64arch:x86image:win10-20231020-enlocale:en-usos:windows10-1703-x64system
submitted
13-11-2023 09:40

Target

11eR3753.exe
Size

276KB
MD5

63cdde39ca1956aaf5895889df3764da
SHA1

b5b8a877f68b8bda37b5e5d14b69649b8c71e805
SHA256

ebf9de73a31764f9b6f0db98c3173a2298f7504df6f90423fe41158b9a68ea6a
SHA512

b640b2036547b84e88b8a379a18764d0a98cd3d0aeabef2d90db7db3fe1e871185437ebae9ede024e252738b187cd2c18299be277fa7ce9da2ab125ea3fc6b41
SSDEEP

6144:0KWeIhzyZNGuxq2tRR6C1xeBU+VGGZAcjcA5R8Xj7KH:0KWewyC2tRR6C1ceSCcjcA5R4j7K

Score

10^/10

mystic stealer

Family

mystic

http://5.42.92.43/loghub/master

Detect Mystic stealer payload 5 IoCs

resource	yara_rule
behavioral2/memory/4340-5-0x0000000000400000-0x0000000000433000-memory.dmp	mystic_family
behavioral2/memory/4340-4-0x0000000000400000-0x0000000000433000-memory.dmp	mystic_family
behavioral2/memory/4340-3-0x0000000000400000-0x0000000000433000-memory.dmp	mystic_family
behavioral2/memory/4340-0-0x0000000000400000-0x0000000000433000-memory.dmp	mystic_family
behavioral2/memory/4340-6-0x0000000000400000-0x0000000000433000-memory.dmp	mystic_family

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4832 set thread context of 4340	4832	11eR3753.exe	72

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 4832 wrote to memory of 4340	4832	11eR3753.exe	72
PID 4832 wrote to memory of 4340	4832	11eR3753.exe	72
PID 4832 wrote to memory of 4340	4832	11eR3753.exe	72
PID 4832 wrote to memory of 4340	4832	11eR3753.exe	72
PID 4832 wrote to memory of 4340	4832	11eR3753.exe	72
PID 4832 wrote to memory of 4340	4832	11eR3753.exe	72
PID 4832 wrote to memory of 4340	4832	11eR3753.exe	72
PID 4832 wrote to memory of 4340	4832	11eR3753.exe	72
PID 4832 wrote to memory of 4340	4832	11eR3753.exe	72
PID 4832 wrote to memory of 4340	4832	11eR3753.exe	72

C:\Users\Admin\AppData\Local\Temp\11eR3753.exe
"C:\Users\Admin\AppData\Local\Temp\11eR3753.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4832
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
  2⤵
  PID:4340

memory/4340-5-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4340-4-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4340-3-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4340-0-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4340-6-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download