mystic | eb89d62ad97d191a663e7839fde1e5ea5b7df92861ad3a7f9650f5715e54ff74

Analysis

max time kernel
187s
max time network
295s
platform
windows10-1703_x64
resource
win10-20231020-en
resource tags

arch:x64arch:x86image:win10-20231020-enlocale:en-usos:windows10-1703-x64system
submitted
13-11-2023 09:43

Target

2PZ1181.exe
Size

310KB
MD5

8e2f0a5d1308ab1b7497bf578a669a2d
SHA1

bb92856fd0bee94a830bbd70f564ec94b5502bcd
SHA256

eb89d62ad97d191a663e7839fde1e5ea5b7df92861ad3a7f9650f5715e54ff74
SHA512

75b10b0d965fdeb845273fc601176bf61e0c36b880c691fc5f20dec5f3263b6c72ca0075696fb46c9f5db8e776aab457ab3df08fd1536d53541de16e92303889
SSDEEP

6144:kRJ4eu5tKp9NaKalKcdvu+mH6GvF+9rQKuAsezd4j0dkKh9NzL:kRJ4ezGlKqvuddvFtA32Kh9Nv

Score

10^/10

mystic stealer

Family

mystic

http://5.42.92.43/loghub/master

Detect Mystic stealer payload 5 IoCs

resource	yara_rule
behavioral2/memory/4928-0-0x0000000000400000-0x0000000000433000-memory.dmp	mystic_family
behavioral2/memory/4928-4-0x0000000000400000-0x0000000000433000-memory.dmp	mystic_family
behavioral2/memory/4928-3-0x0000000000400000-0x0000000000433000-memory.dmp	mystic_family
behavioral2/memory/4928-5-0x0000000000400000-0x0000000000433000-memory.dmp	mystic_family
behavioral2/memory/4928-6-0x0000000000400000-0x0000000000433000-memory.dmp	mystic_family

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4692 set thread context of 4928	4692	2PZ1181.exe	71

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 4692 wrote to memory of 4928	4692	2PZ1181.exe	71
PID 4692 wrote to memory of 4928	4692	2PZ1181.exe	71
PID 4692 wrote to memory of 4928	4692	2PZ1181.exe	71
PID 4692 wrote to memory of 4928	4692	2PZ1181.exe	71
PID 4692 wrote to memory of 4928	4692	2PZ1181.exe	71
PID 4692 wrote to memory of 4928	4692	2PZ1181.exe	71
PID 4692 wrote to memory of 4928	4692	2PZ1181.exe	71
PID 4692 wrote to memory of 4928	4692	2PZ1181.exe	71
PID 4692 wrote to memory of 4928	4692	2PZ1181.exe	71
PID 4692 wrote to memory of 4928	4692	2PZ1181.exe	71

C:\Users\Admin\AppData\Local\Temp\2PZ1181.exe
"C:\Users\Admin\AppData\Local\Temp\2PZ1181.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4692
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
  2⤵
  PID:4928

memory/4928-0-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4928-4-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4928-3-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4928-5-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4928-6-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download