mystic | fdcc26fdbb6394831dc74f5ea73922acc34db5957eccdab438bc42c740257d0c

Analysis

max time kernel
122s
max time network
127s
platform
windows7_x64
resource
win7-20231020-en
resource tags

arch:x64arch:x86image:win7-20231020-enlocale:en-usos:windows7-x64system
submitted
15-11-2023 04:31

Target

NEAS.d45b7c7f767592e9ee546037080875c0.exe
Size

276KB
MD5

d45b7c7f767592e9ee546037080875c0
SHA1

2ff77be6474c1efd7029c4892ba42b3cd4ed7daa
SHA256

fdcc26fdbb6394831dc74f5ea73922acc34db5957eccdab438bc42c740257d0c
SHA512

b5d75b11441a04e085eeb5da073ddbb729b5da23eac55c009ce5586a717f13b16921bdf9c0665ce8e62a0466c484bc6ac26c2559ec661b93f3f8b2d267d0b776
SSDEEP

6144:CKWeIhzyZNGu6RXDDjTJ61u+gF7iPN3EC7W8gzKH:CKWewyGDjBkri8MK

Score

10^/10

mystic stealer

Detect Mystic stealer payload 6 IoCs

resource	yara_rule
behavioral1/memory/3000-3-0x0000000000400000-0x0000000000433000-memory.dmp	mystic_family
behavioral1/memory/3000-4-0x0000000000400000-0x0000000000433000-memory.dmp	mystic_family
behavioral1/memory/3000-5-0x0000000000400000-0x0000000000433000-memory.dmp	mystic_family
behavioral1/memory/3000-7-0x0000000000400000-0x0000000000433000-memory.dmp	mystic_family
behavioral1/memory/3000-9-0x0000000000400000-0x0000000000433000-memory.dmp	mystic_family
behavioral1/memory/3000-11-0x0000000000400000-0x0000000000433000-memory.dmp	mystic_family

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1412 set thread context of 3000	1412	NEAS.d45b7c7f767592e9ee546037080875c0.exe	29

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2292	3000	WerFault.exe	29

Suspicious use of WriteProcessMemory 21 IoCs

description	pid	Process	procid_target
PID 1412 wrote to memory of 3000	1412	NEAS.d45b7c7f767592e9ee546037080875c0.exe	29
PID 1412 wrote to memory of 3000	1412	NEAS.d45b7c7f767592e9ee546037080875c0.exe	29
PID 1412 wrote to memory of 3000	1412	NEAS.d45b7c7f767592e9ee546037080875c0.exe	29
PID 1412 wrote to memory of 3000	1412	NEAS.d45b7c7f767592e9ee546037080875c0.exe	29
PID 1412 wrote to memory of 3000	1412	NEAS.d45b7c7f767592e9ee546037080875c0.exe	29
PID 1412 wrote to memory of 3000	1412	NEAS.d45b7c7f767592e9ee546037080875c0.exe	29
PID 1412 wrote to memory of 3000	1412	NEAS.d45b7c7f767592e9ee546037080875c0.exe	29
PID 1412 wrote to memory of 3000	1412	NEAS.d45b7c7f767592e9ee546037080875c0.exe	29
PID 1412 wrote to memory of 3000	1412	NEAS.d45b7c7f767592e9ee546037080875c0.exe	29
PID 1412 wrote to memory of 3000	1412	NEAS.d45b7c7f767592e9ee546037080875c0.exe	29
PID 1412 wrote to memory of 3000	1412	NEAS.d45b7c7f767592e9ee546037080875c0.exe	29
PID 1412 wrote to memory of 3000	1412	NEAS.d45b7c7f767592e9ee546037080875c0.exe	29
PID 1412 wrote to memory of 3000	1412	NEAS.d45b7c7f767592e9ee546037080875c0.exe	29
PID 1412 wrote to memory of 3000	1412	NEAS.d45b7c7f767592e9ee546037080875c0.exe	29
PID 3000 wrote to memory of 2292	3000	AppLaunch.exe	30
PID 3000 wrote to memory of 2292	3000	AppLaunch.exe	30
PID 3000 wrote to memory of 2292	3000	AppLaunch.exe	30
PID 3000 wrote to memory of 2292	3000	AppLaunch.exe	30
PID 3000 wrote to memory of 2292	3000	AppLaunch.exe	30
PID 3000 wrote to memory of 2292	3000	AppLaunch.exe	30
PID 3000 wrote to memory of 2292	3000	AppLaunch.exe	30

memory/3000-3-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3000-4-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3000-2-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3000-1-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3000-0-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3000-6-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmp

Filesize
4KB

Download
memory/3000-5-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3000-7-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3000-9-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3000-11-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download