mystic | eb89d62ad97d191a663e7839fde1e5ea5b7df92861ad3a7f9650f5715e54ff74

Analysis

max time kernel
118s
max time network
122s
platform
windows7_x64
resource
win7-20231023-en
resource tags

arch:x64arch:x86image:win7-20231023-enlocale:en-usos:windows7-x64system
submitted
13-11-2023 09:43

Target

2PZ1181.exe
Size

310KB
MD5

8e2f0a5d1308ab1b7497bf578a669a2d
SHA1

bb92856fd0bee94a830bbd70f564ec94b5502bcd
SHA256

eb89d62ad97d191a663e7839fde1e5ea5b7df92861ad3a7f9650f5715e54ff74
SHA512

75b10b0d965fdeb845273fc601176bf61e0c36b880c691fc5f20dec5f3263b6c72ca0075696fb46c9f5db8e776aab457ab3df08fd1536d53541de16e92303889
SSDEEP

6144:kRJ4eu5tKp9NaKalKcdvu+mH6GvF+9rQKuAsezd4j0dkKh9NzL:kRJ4ezGlKqvuddvFtA32Kh9Nv

Score

10^/10

mystic stealer

Detect Mystic stealer payload 6 IoCs

resource	yara_rule
behavioral1/memory/2436-5-0x0000000000400000-0x0000000000433000-memory.dmp	mystic_family
behavioral1/memory/2436-7-0x0000000000400000-0x0000000000433000-memory.dmp	mystic_family
behavioral1/memory/2436-4-0x0000000000400000-0x0000000000433000-memory.dmp	mystic_family
behavioral1/memory/2436-3-0x0000000000400000-0x0000000000433000-memory.dmp	mystic_family
behavioral1/memory/2436-9-0x0000000000400000-0x0000000000433000-memory.dmp	mystic_family
behavioral1/memory/2436-11-0x0000000000400000-0x0000000000433000-memory.dmp	mystic_family

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2184 set thread context of 2436	2184	2PZ1181.exe	29

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2116	2436	WerFault.exe	29

Suspicious use of WriteProcessMemory 21 IoCs

description	pid	Process	procid_target
PID 2184 wrote to memory of 2436	2184	2PZ1181.exe	29
PID 2184 wrote to memory of 2436	2184	2PZ1181.exe	29
PID 2184 wrote to memory of 2436	2184	2PZ1181.exe	29
PID 2184 wrote to memory of 2436	2184	2PZ1181.exe	29
PID 2184 wrote to memory of 2436	2184	2PZ1181.exe	29
PID 2184 wrote to memory of 2436	2184	2PZ1181.exe	29
PID 2184 wrote to memory of 2436	2184	2PZ1181.exe	29
PID 2184 wrote to memory of 2436	2184	2PZ1181.exe	29
PID 2184 wrote to memory of 2436	2184	2PZ1181.exe	29
PID 2184 wrote to memory of 2436	2184	2PZ1181.exe	29
PID 2184 wrote to memory of 2436	2184	2PZ1181.exe	29
PID 2184 wrote to memory of 2436	2184	2PZ1181.exe	29
PID 2184 wrote to memory of 2436	2184	2PZ1181.exe	29
PID 2184 wrote to memory of 2436	2184	2PZ1181.exe	29
PID 2436 wrote to memory of 2116	2436	AppLaunch.exe	30
PID 2436 wrote to memory of 2116	2436	AppLaunch.exe	30
PID 2436 wrote to memory of 2116	2436	AppLaunch.exe	30
PID 2436 wrote to memory of 2116	2436	AppLaunch.exe	30
PID 2436 wrote to memory of 2116	2436	AppLaunch.exe	30
PID 2436 wrote to memory of 2116	2436	AppLaunch.exe	30
PID 2436 wrote to memory of 2116	2436	AppLaunch.exe	30

memory/2436-0-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2436-5-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2436-6-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmp

Filesize
4KB

Download
memory/2436-7-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2436-4-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2436-3-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2436-2-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2436-1-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2436-9-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2436-11-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download