mystic | faca33bfd08bd7926cb6bb3c5a88f9fd250ccc9886a75e5ee20260873fa6a857

Analysis

max time kernel
121s
max time network
124s
platform
windows7_x64
resource
win7-20231025-en
resource tags

arch:x64arch:x86image:win7-20231025-enlocale:en-usos:windows7-x64system
submitted
13-11-2023 09:43

Target

2HF4898.exe
Size

310KB
MD5

349717492a6edc15b6aed90588419adb
SHA1

35560e0a83b5ce2738d7202fdc6677a7ca9238e3
SHA256

faca33bfd08bd7926cb6bb3c5a88f9fd250ccc9886a75e5ee20260873fa6a857
SHA512

c88921738a5dc261d37ced4eaeff4478f2c7ee1b61f1c481efa7f27930c17372ca6ae727126a88e0f715733793c84f24a5566d9d5b7347f0fe8eaa1e3c4faed6
SSDEEP

6144:CRJ4eu5tKi68YI818at26Al3kt/vTP/atmfVQc1zEpQ+2vCUT0GeYzh9NzL:CRJ4e3898188Ed6jGmfCc1zEb2Ke0GeG

Score

10^/10

mystic stealer

Detect Mystic stealer payload 6 IoCs

resource	yara_rule
behavioral1/memory/516-7-0x0000000000400000-0x0000000000433000-memory.dmp	mystic_family
behavioral1/memory/516-5-0x0000000000400000-0x0000000000433000-memory.dmp	mystic_family
behavioral1/memory/516-4-0x0000000000400000-0x0000000000433000-memory.dmp	mystic_family
behavioral1/memory/516-3-0x0000000000400000-0x0000000000433000-memory.dmp	mystic_family
behavioral1/memory/516-9-0x0000000000400000-0x0000000000433000-memory.dmp	mystic_family
behavioral1/memory/516-11-0x0000000000400000-0x0000000000433000-memory.dmp	mystic_family

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2988 set thread context of 516	2988	2HF4898.exe	29

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2348	516	WerFault.exe	29

Suspicious use of WriteProcessMemory 21 IoCs

description	pid	Process	procid_target
PID 2988 wrote to memory of 516	2988	2HF4898.exe	29
PID 2988 wrote to memory of 516	2988	2HF4898.exe	29
PID 2988 wrote to memory of 516	2988	2HF4898.exe	29
PID 2988 wrote to memory of 516	2988	2HF4898.exe	29
PID 2988 wrote to memory of 516	2988	2HF4898.exe	29
PID 2988 wrote to memory of 516	2988	2HF4898.exe	29
PID 2988 wrote to memory of 516	2988	2HF4898.exe	29
PID 2988 wrote to memory of 516	2988	2HF4898.exe	29
PID 2988 wrote to memory of 516	2988	2HF4898.exe	29
PID 2988 wrote to memory of 516	2988	2HF4898.exe	29
PID 2988 wrote to memory of 516	2988	2HF4898.exe	29
PID 2988 wrote to memory of 516	2988	2HF4898.exe	29
PID 2988 wrote to memory of 516	2988	2HF4898.exe	29
PID 2988 wrote to memory of 516	2988	2HF4898.exe	29
PID 516 wrote to memory of 2348	516	AppLaunch.exe	30
PID 516 wrote to memory of 2348	516	AppLaunch.exe	30
PID 516 wrote to memory of 2348	516	AppLaunch.exe	30
PID 516 wrote to memory of 2348	516	AppLaunch.exe	30
PID 516 wrote to memory of 2348	516	AppLaunch.exe	30
PID 516 wrote to memory of 2348	516	AppLaunch.exe	30
PID 516 wrote to memory of 2348	516	AppLaunch.exe	30

memory/516-2-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/516-6-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmp

Filesize
4KB

Download
memory/516-7-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/516-5-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/516-4-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/516-3-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/516-1-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/516-0-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/516-9-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/516-11-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download