mystic | b5bd5b24b3f18001deeb9f76b7b084cf4ef00598aff02f9acd6602a5891ebe78

Analysis

max time kernel
122s
max time network
128s
platform
windows7_x64
resource
win7-20231020-en
resource tags

arch:x64arch:x86image:win7-20231020-enlocale:en-usos:windows7-x64system
submitted
13-11-2023 09:43

Target

2fo0484.exe
Size

310KB
MD5

fda8db9cb3929dcb961b9fae3b9d7173
SHA1

d860a4906cc227590805b01cc7edd854a5bd012d
SHA256

b5bd5b24b3f18001deeb9f76b7b084cf4ef00598aff02f9acd6602a5891ebe78
SHA512

5dfacccae021ef83cce766c8d8a5fc03a098ad3230e9c35c4b6fa8d0a18e3f757303e1874086ac56f1bd8344d7d3f9e15f82a92df10c1af9d8a6c9ef0b5303e0
SSDEEP

6144:VRJ4eu5tKjyBhpjgSYMzbRQVep9se9t+Hz8h9NzL:VRJ4e6npjPzmVepj9UHz8h9Nv

Score

10^/10

mystic stealer

Detect Mystic stealer payload 6 IoCs

resource	yara_rule
behavioral1/memory/2744-3-0x0000000000400000-0x0000000000433000-memory.dmp	mystic_family
behavioral1/memory/2744-5-0x0000000000400000-0x0000000000433000-memory.dmp	mystic_family
behavioral1/memory/2744-4-0x0000000000400000-0x0000000000433000-memory.dmp	mystic_family
behavioral1/memory/2744-7-0x0000000000400000-0x0000000000433000-memory.dmp	mystic_family
behavioral1/memory/2744-9-0x0000000000400000-0x0000000000433000-memory.dmp	mystic_family
behavioral1/memory/2744-11-0x0000000000400000-0x0000000000433000-memory.dmp	mystic_family

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2016 set thread context of 2744	2016	2fo0484.exe	30

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2684	2744	WerFault.exe	30

Suspicious use of WriteProcessMemory 28 IoCs

description	pid	Process	procid_target
PID 2016 wrote to memory of 1468	2016	2fo0484.exe	29
PID 2016 wrote to memory of 1468	2016	2fo0484.exe	29
PID 2016 wrote to memory of 1468	2016	2fo0484.exe	29
PID 2016 wrote to memory of 1468	2016	2fo0484.exe	29
PID 2016 wrote to memory of 1468	2016	2fo0484.exe	29
PID 2016 wrote to memory of 1468	2016	2fo0484.exe	29
PID 2016 wrote to memory of 1468	2016	2fo0484.exe	29
PID 2016 wrote to memory of 2744	2016	2fo0484.exe	30
PID 2016 wrote to memory of 2744	2016	2fo0484.exe	30
PID 2016 wrote to memory of 2744	2016	2fo0484.exe	30
PID 2016 wrote to memory of 2744	2016	2fo0484.exe	30
PID 2016 wrote to memory of 2744	2016	2fo0484.exe	30
PID 2016 wrote to memory of 2744	2016	2fo0484.exe	30
PID 2016 wrote to memory of 2744	2016	2fo0484.exe	30
PID 2016 wrote to memory of 2744	2016	2fo0484.exe	30
PID 2016 wrote to memory of 2744	2016	2fo0484.exe	30
PID 2016 wrote to memory of 2744	2016	2fo0484.exe	30
PID 2016 wrote to memory of 2744	2016	2fo0484.exe	30
PID 2016 wrote to memory of 2744	2016	2fo0484.exe	30
PID 2016 wrote to memory of 2744	2016	2fo0484.exe	30
PID 2016 wrote to memory of 2744	2016	2fo0484.exe	30
PID 2744 wrote to memory of 2684	2744	AppLaunch.exe	31
PID 2744 wrote to memory of 2684	2744	AppLaunch.exe	31
PID 2744 wrote to memory of 2684	2744	AppLaunch.exe	31
PID 2744 wrote to memory of 2684	2744	AppLaunch.exe	31
PID 2744 wrote to memory of 2684	2744	AppLaunch.exe	31
PID 2744 wrote to memory of 2684	2744	AppLaunch.exe	31
PID 2744 wrote to memory of 2684	2744	AppLaunch.exe	31

C:\Users\Admin\AppData\Local\Temp\2fo0484.exe
"C:\Users\Admin\AppData\Local\Temp\2fo0484.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2016
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
  2⤵
  PID:1468
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2744
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2744 -s 196
    3⤵
    - Program crash
    PID:2684

memory/2744-0-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2744-1-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2744-2-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2744-3-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2744-5-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2744-4-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2744-6-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmp

Filesize
4KB

Download
memory/2744-7-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2744-9-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2744-11-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download