mystic | 6528ab87830224a945c2e98d632b7ec84ca328a5e73e306706577d9f00725d97

Analysis

max time kernel
120s
max time network
124s
platform
windows7_x64
resource
win7-20231025-en
resource tags

arch:x64arch:x86image:win7-20231025-enlocale:en-usos:windows7-x64system
submitted
15-11-2023 00:13

Target

NEAS.5f08e677917e7790c80dd75f2def4790.exe
Size

283KB
MD5

5f08e677917e7790c80dd75f2def4790
SHA1

84377b96a5b607652024ac14f09ec2234f41cd21
SHA256

6528ab87830224a945c2e98d632b7ec84ca328a5e73e306706577d9f00725d97
SHA512

068cd1313b1e7a18a6cf45b2cd9f6dea88296c8dac881f8d872ab626acd011d93d185d2b4e67f4b77c0308b8c308f751376724979a792aac9ce00b0ced34ce27
SSDEEP

6144:mc/LobWnIngFIJjifGPkD0+qqH2gMt8S5VTTTO4jvqm7Ud3:V/wV+0+qqH2vqm7Ud3

Score

10^/10

mystic stealer

Detect Mystic stealer payload 6 IoCs

resource	yara_rule
behavioral1/memory/2944-4-0x0000000000400000-0x0000000000433000-memory.dmp	mystic_family
behavioral1/memory/2944-3-0x0000000000400000-0x0000000000433000-memory.dmp	mystic_family
behavioral1/memory/2944-5-0x0000000000400000-0x0000000000433000-memory.dmp	mystic_family
behavioral1/memory/2944-7-0x0000000000400000-0x0000000000433000-memory.dmp	mystic_family
behavioral1/memory/2944-9-0x0000000000400000-0x0000000000433000-memory.dmp	mystic_family
behavioral1/memory/2944-11-0x0000000000400000-0x0000000000433000-memory.dmp	mystic_family

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2600 set thread context of 2944	2600	NEAS.5f08e677917e7790c80dd75f2def4790.exe	29

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2664	2944	WerFault.exe	29

Suspicious use of WriteProcessMemory 21 IoCs

description	pid	Process	procid_target
PID 2600 wrote to memory of 2944	2600	NEAS.5f08e677917e7790c80dd75f2def4790.exe	29
PID 2600 wrote to memory of 2944	2600	NEAS.5f08e677917e7790c80dd75f2def4790.exe	29
PID 2600 wrote to memory of 2944	2600	NEAS.5f08e677917e7790c80dd75f2def4790.exe	29
PID 2600 wrote to memory of 2944	2600	NEAS.5f08e677917e7790c80dd75f2def4790.exe	29
PID 2600 wrote to memory of 2944	2600	NEAS.5f08e677917e7790c80dd75f2def4790.exe	29
PID 2600 wrote to memory of 2944	2600	NEAS.5f08e677917e7790c80dd75f2def4790.exe	29
PID 2600 wrote to memory of 2944	2600	NEAS.5f08e677917e7790c80dd75f2def4790.exe	29
PID 2600 wrote to memory of 2944	2600	NEAS.5f08e677917e7790c80dd75f2def4790.exe	29
PID 2600 wrote to memory of 2944	2600	NEAS.5f08e677917e7790c80dd75f2def4790.exe	29
PID 2600 wrote to memory of 2944	2600	NEAS.5f08e677917e7790c80dd75f2def4790.exe	29
PID 2600 wrote to memory of 2944	2600	NEAS.5f08e677917e7790c80dd75f2def4790.exe	29
PID 2600 wrote to memory of 2944	2600	NEAS.5f08e677917e7790c80dd75f2def4790.exe	29
PID 2600 wrote to memory of 2944	2600	NEAS.5f08e677917e7790c80dd75f2def4790.exe	29
PID 2600 wrote to memory of 2944	2600	NEAS.5f08e677917e7790c80dd75f2def4790.exe	29
PID 2944 wrote to memory of 2664	2944	AppLaunch.exe	30
PID 2944 wrote to memory of 2664	2944	AppLaunch.exe	30
PID 2944 wrote to memory of 2664	2944	AppLaunch.exe	30
PID 2944 wrote to memory of 2664	2944	AppLaunch.exe	30
PID 2944 wrote to memory of 2664	2944	AppLaunch.exe	30
PID 2944 wrote to memory of 2664	2944	AppLaunch.exe	30
PID 2944 wrote to memory of 2664	2944	AppLaunch.exe	30

memory/2944-0-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2944-1-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2944-2-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2944-4-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2944-3-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2944-5-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2944-6-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmp

Filesize
4KB

Download
memory/2944-7-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2944-9-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2944-11-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download