mystic | b5bd5b24b3f18001deeb9f76b7b084cf4ef00598aff02f9acd6602a5891ebe78

Analysis

max time kernel
181s
max time network
246s
platform
windows10-1703_x64
resource
win10-20231020-en
resource tags

arch:x64arch:x86image:win10-20231020-enlocale:en-usos:windows10-1703-x64system
submitted
13-11-2023 09:43

Target

2fo0484.exe
Size

310KB
MD5

fda8db9cb3929dcb961b9fae3b9d7173
SHA1

d860a4906cc227590805b01cc7edd854a5bd012d
SHA256

b5bd5b24b3f18001deeb9f76b7b084cf4ef00598aff02f9acd6602a5891ebe78
SHA512

5dfacccae021ef83cce766c8d8a5fc03a098ad3230e9c35c4b6fa8d0a18e3f757303e1874086ac56f1bd8344d7d3f9e15f82a92df10c1af9d8a6c9ef0b5303e0
SSDEEP

6144:VRJ4eu5tKjyBhpjgSYMzbRQVep9se9t+Hz8h9NzL:VRJ4e6npjPzmVepj9UHz8h9Nv

Score

10^/10

mystic stealer

Family

mystic

http://5.42.92.43/loghub/master

Detect Mystic stealer payload 5 IoCs

resource	yara_rule
behavioral2/memory/4492-0-0x0000000000400000-0x0000000000433000-memory.dmp	mystic_family
behavioral2/memory/4492-3-0x0000000000400000-0x0000000000433000-memory.dmp	mystic_family
behavioral2/memory/4492-4-0x0000000000400000-0x0000000000433000-memory.dmp	mystic_family
behavioral2/memory/4492-5-0x0000000000400000-0x0000000000433000-memory.dmp	mystic_family
behavioral2/memory/4492-6-0x0000000000400000-0x0000000000433000-memory.dmp	mystic_family

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4308 set thread context of 4492	4308	2fo0484.exe	71

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 4308 wrote to memory of 4492	4308	2fo0484.exe	71
PID 4308 wrote to memory of 4492	4308	2fo0484.exe	71
PID 4308 wrote to memory of 4492	4308	2fo0484.exe	71
PID 4308 wrote to memory of 4492	4308	2fo0484.exe	71
PID 4308 wrote to memory of 4492	4308	2fo0484.exe	71
PID 4308 wrote to memory of 4492	4308	2fo0484.exe	71
PID 4308 wrote to memory of 4492	4308	2fo0484.exe	71
PID 4308 wrote to memory of 4492	4308	2fo0484.exe	71
PID 4308 wrote to memory of 4492	4308	2fo0484.exe	71
PID 4308 wrote to memory of 4492	4308	2fo0484.exe	71

C:\Users\Admin\AppData\Local\Temp\2fo0484.exe
"C:\Users\Admin\AppData\Local\Temp\2fo0484.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4308
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
  2⤵
  PID:4492

memory/4492-0-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4492-3-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4492-4-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4492-5-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4492-6-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download