mystic | 5a604e6252c8f88e69257f8687d8d2c10a9489268d518436e8b52e0217d990b1

Analysis

max time kernel
184s
max time network
256s
platform
windows10-1703_x64
resource
win10-20231023-en
resource tags

arch:x64arch:x86image:win10-20231023-enlocale:en-usos:windows10-1703-x64system
submitted
13/11/2023, 09:42

Target

2ag1322.exe
Size

310KB
MD5

8aac4d41ead6423b9a11a054b0281f82
SHA1

d54dae895b314fcd3be9533858f407abd9569333
SHA256

5a604e6252c8f88e69257f8687d8d2c10a9489268d518436e8b52e0217d990b1
SHA512

3ad44c25a80e3164435e82732f40419c95edbabbe8d59aa6ac37bbbf8e71575be78a2cb1a62d84004101e0b93941608bc1673e4607b88beb1fc7f231aa4ffc96
SSDEEP

6144:HRJ4eu5tK+synMHrVXyTGjUYCtsa3c1nnnS1+IDkRrh9NzL:HRJ4ekMHrZjUYCtennnS1+xh9Nv

Score

10^/10

mystic stealer

Family

mystic

http://5.42.92.43/loghub/master

Detect Mystic stealer payload 5 IoCs

resource	yara_rule
behavioral2/memory/5104-0-0x0000000000400000-0x0000000000433000-memory.dmp	mystic_family
behavioral2/memory/5104-3-0x0000000000400000-0x0000000000433000-memory.dmp	mystic_family
behavioral2/memory/5104-4-0x0000000000400000-0x0000000000433000-memory.dmp	mystic_family
behavioral2/memory/5104-5-0x0000000000400000-0x0000000000433000-memory.dmp	mystic_family
behavioral2/memory/5104-6-0x0000000000400000-0x0000000000433000-memory.dmp	mystic_family

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3388 set thread context of 5104	3388	2ag1322.exe	72

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 3388 wrote to memory of 5104	3388	2ag1322.exe	72
PID 3388 wrote to memory of 5104	3388	2ag1322.exe	72
PID 3388 wrote to memory of 5104	3388	2ag1322.exe	72
PID 3388 wrote to memory of 5104	3388	2ag1322.exe	72
PID 3388 wrote to memory of 5104	3388	2ag1322.exe	72
PID 3388 wrote to memory of 5104	3388	2ag1322.exe	72
PID 3388 wrote to memory of 5104	3388	2ag1322.exe	72
PID 3388 wrote to memory of 5104	3388	2ag1322.exe	72
PID 3388 wrote to memory of 5104	3388	2ag1322.exe	72
PID 3388 wrote to memory of 5104	3388	2ag1322.exe	72

C:\Users\Admin\AppData\Local\Temp\2ag1322.exe
"C:\Users\Admin\AppData\Local\Temp\2ag1322.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3388
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
  2⤵
  PID:5104

memory/5104-0-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/5104-3-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/5104-4-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/5104-5-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/5104-6-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download