mystic | 327446a3ba70b0594547bd7cb114b1e26905cb814c3dfc66bd7ddd7898d5ee87

Analysis

max time kernel
188s
max time network
256s
platform
windows10-1703_x64
resource
win10-20231023-en
resource tags

arch:x64arch:x86image:win10-20231023-enlocale:en-usos:windows10-1703-x64system
submitted
13-11-2023 09:44

Target

11Dt1708.exe
Size

276KB
MD5

21679d6b73d31e2578ef11a3dafd98c6
SHA1

cfc5d1e54dfd0136424741f799d809bdd2e064fe
SHA256

327446a3ba70b0594547bd7cb114b1e26905cb814c3dfc66bd7ddd7898d5ee87
SHA512

34b8c35d7276fd0397df69a2f74877628f0148d7ae487dfadc45f774331ab570691ff9622808db77b2e6c219315395d6a51ba63769a88a0329a4569e4ee61bdf
SSDEEP

6144:aKWeIhzyZNGuBTC5MLM27tRdwvCpgAG0MWA5jYu4hKH:aKWewyzpQ0MWARl4hK

Score

10^/10

mystic stealer

Family

mystic

http://5.42.92.43/loghub/master

Detect Mystic stealer payload 5 IoCs

resource	yara_rule
behavioral2/memory/4784-0-0x0000000000400000-0x0000000000433000-memory.dmp	mystic_family
behavioral2/memory/4784-3-0x0000000000400000-0x0000000000433000-memory.dmp	mystic_family
behavioral2/memory/4784-4-0x0000000000400000-0x0000000000433000-memory.dmp	mystic_family
behavioral2/memory/4784-5-0x0000000000400000-0x0000000000433000-memory.dmp	mystic_family
behavioral2/memory/4784-6-0x0000000000400000-0x0000000000433000-memory.dmp	mystic_family

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4972 set thread context of 4784	4972	11Dt1708.exe	72

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 4972 wrote to memory of 4784	4972	11Dt1708.exe	72
PID 4972 wrote to memory of 4784	4972	11Dt1708.exe	72
PID 4972 wrote to memory of 4784	4972	11Dt1708.exe	72
PID 4972 wrote to memory of 4784	4972	11Dt1708.exe	72
PID 4972 wrote to memory of 4784	4972	11Dt1708.exe	72
PID 4972 wrote to memory of 4784	4972	11Dt1708.exe	72
PID 4972 wrote to memory of 4784	4972	11Dt1708.exe	72
PID 4972 wrote to memory of 4784	4972	11Dt1708.exe	72
PID 4972 wrote to memory of 4784	4972	11Dt1708.exe	72
PID 4972 wrote to memory of 4784	4972	11Dt1708.exe	72

C:\Users\Admin\AppData\Local\Temp\11Dt1708.exe
"C:\Users\Admin\AppData\Local\Temp\11Dt1708.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4972
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
  2⤵
  PID:4784

memory/4784-0-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4784-3-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4784-4-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4784-5-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4784-6-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download