mystic | 6528ab87830224a945c2e98d632b7ec84ca328a5e73e306706577d9f00725d97

Analysis

max time kernel
138s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20231023-en
resource tags

arch:x64arch:x86image:win10v2004-20231023-enlocale:en-usos:windows10-2004-x64system
submitted
15-11-2023 00:13

Target

NEAS.5f08e677917e7790c80dd75f2def4790.exe
Size

283KB
MD5

5f08e677917e7790c80dd75f2def4790
SHA1

84377b96a5b607652024ac14f09ec2234f41cd21
SHA256

6528ab87830224a945c2e98d632b7ec84ca328a5e73e306706577d9f00725d97
SHA512

068cd1313b1e7a18a6cf45b2cd9f6dea88296c8dac881f8d872ab626acd011d93d185d2b4e67f4b77c0308b8c308f751376724979a792aac9ce00b0ced34ce27
SSDEEP

6144:mc/LobWnIngFIJjifGPkD0+qqH2gMt8S5VTTTO4jvqm7Ud3:V/wV+0+qqH2vqm7Ud3

Score

10^/10

mystic stealer

Detect Mystic stealer payload 5 IoCs

resource	yara_rule
behavioral2/memory/3088-0-0x0000000000400000-0x0000000000433000-memory.dmp	mystic_family
behavioral2/memory/3088-1-0x0000000000400000-0x0000000000433000-memory.dmp	mystic_family
behavioral2/memory/3088-2-0x0000000000400000-0x0000000000433000-memory.dmp	mystic_family
behavioral2/memory/3088-3-0x0000000000400000-0x0000000000433000-memory.dmp	mystic_family
behavioral2/memory/3088-4-0x0000000000400000-0x0000000000433000-memory.dmp	mystic_family

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1852 set thread context of 3088	1852	NEAS.5f08e677917e7790c80dd75f2def4790.exe	93

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 1852 wrote to memory of 3088	1852	NEAS.5f08e677917e7790c80dd75f2def4790.exe	93
PID 1852 wrote to memory of 3088	1852	NEAS.5f08e677917e7790c80dd75f2def4790.exe	93
PID 1852 wrote to memory of 3088	1852	NEAS.5f08e677917e7790c80dd75f2def4790.exe	93
PID 1852 wrote to memory of 3088	1852	NEAS.5f08e677917e7790c80dd75f2def4790.exe	93
PID 1852 wrote to memory of 3088	1852	NEAS.5f08e677917e7790c80dd75f2def4790.exe	93
PID 1852 wrote to memory of 3088	1852	NEAS.5f08e677917e7790c80dd75f2def4790.exe	93
PID 1852 wrote to memory of 3088	1852	NEAS.5f08e677917e7790c80dd75f2def4790.exe	93
PID 1852 wrote to memory of 3088	1852	NEAS.5f08e677917e7790c80dd75f2def4790.exe	93
PID 1852 wrote to memory of 3088	1852	NEAS.5f08e677917e7790c80dd75f2def4790.exe	93
PID 1852 wrote to memory of 3088	1852	NEAS.5f08e677917e7790c80dd75f2def4790.exe	93

C:\Users\Admin\AppData\Local\Temp\NEAS.5f08e677917e7790c80dd75f2def4790.exe
"C:\Users\Admin\AppData\Local\Temp\NEAS.5f08e677917e7790c80dd75f2def4790.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1852
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
  2⤵
  PID:3088

memory/3088-0-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3088-1-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3088-2-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3088-3-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3088-4-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download