mystic | faca33bfd08bd7926cb6bb3c5a88f9fd250ccc9886a75e5ee20260873fa6a857

Analysis

max time kernel
185s
max time network
260s
platform
windows10-1703_x64
resource
win10-20231023-en
resource tags

arch:x64arch:x86image:win10-20231023-enlocale:en-usos:windows10-1703-x64system
submitted
13-11-2023 09:43

Target

2HF4898.exe
Size

310KB
MD5

349717492a6edc15b6aed90588419adb
SHA1

35560e0a83b5ce2738d7202fdc6677a7ca9238e3
SHA256

faca33bfd08bd7926cb6bb3c5a88f9fd250ccc9886a75e5ee20260873fa6a857
SHA512

c88921738a5dc261d37ced4eaeff4478f2c7ee1b61f1c481efa7f27930c17372ca6ae727126a88e0f715733793c84f24a5566d9d5b7347f0fe8eaa1e3c4faed6
SSDEEP

6144:CRJ4eu5tKi68YI818at26Al3kt/vTP/atmfVQc1zEpQ+2vCUT0GeYzh9NzL:CRJ4e3898188Ed6jGmfCc1zEb2Ke0GeG

Score

10^/10

mystic stealer

Family

mystic

http://5.42.92.43/loghub/master

Detect Mystic stealer payload 5 IoCs

resource	yara_rule
behavioral2/memory/1420-0-0x0000000000400000-0x0000000000433000-memory.dmp	mystic_family
behavioral2/memory/1420-3-0x0000000000400000-0x0000000000433000-memory.dmp	mystic_family
behavioral2/memory/1420-4-0x0000000000400000-0x0000000000433000-memory.dmp	mystic_family
behavioral2/memory/1420-5-0x0000000000400000-0x0000000000433000-memory.dmp	mystic_family
behavioral2/memory/1420-6-0x0000000000400000-0x0000000000433000-memory.dmp	mystic_family

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3236 set thread context of 1420	3236	2HF4898.exe	72

Suspicious use of WriteProcessMemory 13 IoCs

description	pid	Process	procid_target
PID 3236 wrote to memory of 5048	3236	2HF4898.exe	71
PID 3236 wrote to memory of 5048	3236	2HF4898.exe	71
PID 3236 wrote to memory of 5048	3236	2HF4898.exe	71
PID 3236 wrote to memory of 1420	3236	2HF4898.exe	72
PID 3236 wrote to memory of 1420	3236	2HF4898.exe	72
PID 3236 wrote to memory of 1420	3236	2HF4898.exe	72
PID 3236 wrote to memory of 1420	3236	2HF4898.exe	72
PID 3236 wrote to memory of 1420	3236	2HF4898.exe	72
PID 3236 wrote to memory of 1420	3236	2HF4898.exe	72
PID 3236 wrote to memory of 1420	3236	2HF4898.exe	72
PID 3236 wrote to memory of 1420	3236	2HF4898.exe	72
PID 3236 wrote to memory of 1420	3236	2HF4898.exe	72
PID 3236 wrote to memory of 1420	3236	2HF4898.exe	72

C:\Users\Admin\AppData\Local\Temp\2HF4898.exe
"C:\Users\Admin\AppData\Local\Temp\2HF4898.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3236
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
  2⤵
  PID:5048
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
  2⤵
  PID:1420

memory/1420-0-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1420-3-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1420-4-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1420-5-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1420-6-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download