mystic | 17c5493764b63ba22597cb565428e2d472757bab2f101fe18d04a7e34a85f6c0

Analysis

max time kernel
118s
max time network
125s
platform
windows7_x64
resource
win7-20231023-en
resource tags

arch:x64arch:x86image:win7-20231023-enlocale:en-usos:windows7-x64system
submitted
13/11/2023, 09:42

Target

11Il0117.exe
Size

283KB
MD5

7cd5f80ecc3e54409922dc7fd2896848
SHA1

cd6f8afa11079385f58b80e23185eee199a84b95
SHA256

17c5493764b63ba22597cb565428e2d472757bab2f101fe18d04a7e34a85f6c0
SHA512

2e5e990dc7aca41babc23a0c5df5bfed2f4bc344bc1a3f8192bfefe204521e67bcec56e553f3bea9305fe98e5c0db1825d3ce53ebac14da555c513148d95a361
SSDEEP

6144:mab74GR3s+TA3UcT+NLa6d7LdHnuMsGkCdolmqq4b97Ud3:TbFs+E3UzLa6d9HnuJGlduWg97Ud3

Score

10^/10

mystic stealer

Detect Mystic stealer payload 6 IoCs

resource	yara_rule
behavioral1/memory/1876-5-0x0000000000400000-0x0000000000433000-memory.dmp	mystic_family
behavioral1/memory/1876-7-0x0000000000400000-0x0000000000433000-memory.dmp	mystic_family
behavioral1/memory/1876-4-0x0000000000400000-0x0000000000433000-memory.dmp	mystic_family
behavioral1/memory/1876-3-0x0000000000400000-0x0000000000433000-memory.dmp	mystic_family
behavioral1/memory/1876-9-0x0000000000400000-0x0000000000433000-memory.dmp	mystic_family
behavioral1/memory/1876-11-0x0000000000400000-0x0000000000433000-memory.dmp	mystic_family

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2360 set thread context of 1876	2360	11Il0117.exe	29

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2776	1876	WerFault.exe	29

Suspicious use of WriteProcessMemory 21 IoCs

description	pid	Process	procid_target
PID 2360 wrote to memory of 1876	2360	11Il0117.exe	29
PID 2360 wrote to memory of 1876	2360	11Il0117.exe	29
PID 2360 wrote to memory of 1876	2360	11Il0117.exe	29
PID 2360 wrote to memory of 1876	2360	11Il0117.exe	29
PID 2360 wrote to memory of 1876	2360	11Il0117.exe	29
PID 2360 wrote to memory of 1876	2360	11Il0117.exe	29
PID 2360 wrote to memory of 1876	2360	11Il0117.exe	29
PID 2360 wrote to memory of 1876	2360	11Il0117.exe	29
PID 2360 wrote to memory of 1876	2360	11Il0117.exe	29
PID 2360 wrote to memory of 1876	2360	11Il0117.exe	29
PID 2360 wrote to memory of 1876	2360	11Il0117.exe	29
PID 2360 wrote to memory of 1876	2360	11Il0117.exe	29
PID 2360 wrote to memory of 1876	2360	11Il0117.exe	29
PID 2360 wrote to memory of 1876	2360	11Il0117.exe	29
PID 1876 wrote to memory of 2776	1876	AppLaunch.exe	30
PID 1876 wrote to memory of 2776	1876	AppLaunch.exe	30
PID 1876 wrote to memory of 2776	1876	AppLaunch.exe	30
PID 1876 wrote to memory of 2776	1876	AppLaunch.exe	30
PID 1876 wrote to memory of 2776	1876	AppLaunch.exe	30
PID 1876 wrote to memory of 2776	1876	AppLaunch.exe	30
PID 1876 wrote to memory of 2776	1876	AppLaunch.exe	30

memory/1876-0-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1876-5-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1876-7-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1876-6-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmp

Filesize
4KB

Download
memory/1876-4-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1876-3-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1876-2-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1876-1-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1876-9-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1876-11-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download