mystic | 17c5493764b63ba22597cb565428e2d472757bab2f101fe18d04a7e34a85f6c0

Analysis

max time kernel
188s
max time network
261s
platform
windows10-1703_x64
resource
win10-20231020-en
resource tags

arch:x64arch:x86image:win10-20231020-enlocale:en-usos:windows10-1703-x64system
submitted
13/11/2023, 09:42

Target

11Il0117.exe
Size

283KB
MD5

7cd5f80ecc3e54409922dc7fd2896848
SHA1

cd6f8afa11079385f58b80e23185eee199a84b95
SHA256

17c5493764b63ba22597cb565428e2d472757bab2f101fe18d04a7e34a85f6c0
SHA512

2e5e990dc7aca41babc23a0c5df5bfed2f4bc344bc1a3f8192bfefe204521e67bcec56e553f3bea9305fe98e5c0db1825d3ce53ebac14da555c513148d95a361
SSDEEP

6144:mab74GR3s+TA3UcT+NLa6d7LdHnuMsGkCdolmqq4b97Ud3:TbFs+E3UzLa6d9HnuJGlduWg97Ud3

Score

10^/10

mystic stealer

Family

mystic

http://5.42.92.43/loghub/master

Detect Mystic stealer payload 5 IoCs

resource	yara_rule
behavioral2/memory/3672-0-0x0000000000400000-0x0000000000433000-memory.dmp	mystic_family
behavioral2/memory/3672-3-0x0000000000400000-0x0000000000433000-memory.dmp	mystic_family
behavioral2/memory/3672-4-0x0000000000400000-0x0000000000433000-memory.dmp	mystic_family
behavioral2/memory/3672-5-0x0000000000400000-0x0000000000433000-memory.dmp	mystic_family
behavioral2/memory/3672-6-0x0000000000400000-0x0000000000433000-memory.dmp	mystic_family

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 5008 set thread context of 3672	5008	11Il0117.exe	71

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 5008 wrote to memory of 3672	5008	11Il0117.exe	71
PID 5008 wrote to memory of 3672	5008	11Il0117.exe	71
PID 5008 wrote to memory of 3672	5008	11Il0117.exe	71
PID 5008 wrote to memory of 3672	5008	11Il0117.exe	71
PID 5008 wrote to memory of 3672	5008	11Il0117.exe	71
PID 5008 wrote to memory of 3672	5008	11Il0117.exe	71
PID 5008 wrote to memory of 3672	5008	11Il0117.exe	71
PID 5008 wrote to memory of 3672	5008	11Il0117.exe	71
PID 5008 wrote to memory of 3672	5008	11Il0117.exe	71
PID 5008 wrote to memory of 3672	5008	11Il0117.exe	71

C:\Users\Admin\AppData\Local\Temp\11Il0117.exe
"C:\Users\Admin\AppData\Local\Temp\11Il0117.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:5008
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
  2⤵
  PID:3672

memory/3672-0-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3672-3-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3672-4-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3672-5-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3672-6-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download