mystic | 5a604e6252c8f88e69257f8687d8d2c10a9489268d518436e8b52e0217d990b1

Analysis

max time kernel
117s
max time network
120s
platform
windows7_x64
resource
win7-20231025-en
resource tags

arch:x64arch:x86image:win7-20231025-enlocale:en-usos:windows7-x64system
submitted
13/11/2023, 09:42

Target

2ag1322.exe
Size

310KB
MD5

8aac4d41ead6423b9a11a054b0281f82
SHA1

d54dae895b314fcd3be9533858f407abd9569333
SHA256

5a604e6252c8f88e69257f8687d8d2c10a9489268d518436e8b52e0217d990b1
SHA512

3ad44c25a80e3164435e82732f40419c95edbabbe8d59aa6ac37bbbf8e71575be78a2cb1a62d84004101e0b93941608bc1673e4607b88beb1fc7f231aa4ffc96
SSDEEP

6144:HRJ4eu5tK+synMHrVXyTGjUYCtsa3c1nnnS1+IDkRrh9NzL:HRJ4ekMHrZjUYCtennnS1+xh9Nv

Score

10^/10

mystic stealer

Detect Mystic stealer payload 6 IoCs

resource	yara_rule
behavioral1/memory/2212-3-0x0000000000400000-0x0000000000433000-memory.dmp	mystic_family
behavioral1/memory/2212-5-0x0000000000400000-0x0000000000433000-memory.dmp	mystic_family
behavioral1/memory/2212-4-0x0000000000400000-0x0000000000433000-memory.dmp	mystic_family
behavioral1/memory/2212-7-0x0000000000400000-0x0000000000433000-memory.dmp	mystic_family
behavioral1/memory/2212-9-0x0000000000400000-0x0000000000433000-memory.dmp	mystic_family
behavioral1/memory/2212-11-0x0000000000400000-0x0000000000433000-memory.dmp	mystic_family

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2936 set thread context of 2212	2936	2ag1322.exe	29

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2236	2212	WerFault.exe	29

Suspicious use of WriteProcessMemory 21 IoCs

description	pid	Process	procid_target
PID 2936 wrote to memory of 2212	2936	2ag1322.exe	29
PID 2936 wrote to memory of 2212	2936	2ag1322.exe	29
PID 2936 wrote to memory of 2212	2936	2ag1322.exe	29
PID 2936 wrote to memory of 2212	2936	2ag1322.exe	29
PID 2936 wrote to memory of 2212	2936	2ag1322.exe	29
PID 2936 wrote to memory of 2212	2936	2ag1322.exe	29
PID 2936 wrote to memory of 2212	2936	2ag1322.exe	29
PID 2936 wrote to memory of 2212	2936	2ag1322.exe	29
PID 2936 wrote to memory of 2212	2936	2ag1322.exe	29
PID 2936 wrote to memory of 2212	2936	2ag1322.exe	29
PID 2936 wrote to memory of 2212	2936	2ag1322.exe	29
PID 2936 wrote to memory of 2212	2936	2ag1322.exe	29
PID 2936 wrote to memory of 2212	2936	2ag1322.exe	29
PID 2936 wrote to memory of 2212	2936	2ag1322.exe	29
PID 2212 wrote to memory of 2236	2212	AppLaunch.exe	30
PID 2212 wrote to memory of 2236	2212	AppLaunch.exe	30
PID 2212 wrote to memory of 2236	2212	AppLaunch.exe	30
PID 2212 wrote to memory of 2236	2212	AppLaunch.exe	30
PID 2212 wrote to memory of 2236	2212	AppLaunch.exe	30
PID 2212 wrote to memory of 2236	2212	AppLaunch.exe	30
PID 2212 wrote to memory of 2236	2212	AppLaunch.exe	30

memory/2212-0-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2212-1-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2212-2-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2212-3-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2212-5-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2212-4-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2212-6-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmp

Filesize
4KB

Download
memory/2212-7-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2212-9-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2212-11-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download