mystic | fdcc26fdbb6394831dc74f5ea73922acc34db5957eccdab438bc42c740257d0c

Analysis

max time kernel
125s
max time network
134s
platform
windows10-2004_x64
resource
win10v2004-20231023-en
resource tags

arch:x64arch:x86image:win10v2004-20231023-enlocale:en-usos:windows10-2004-x64system
submitted
15/11/2023, 04:31

Target

NEAS.d45b7c7f767592e9ee546037080875c0.exe
Size

276KB
MD5

d45b7c7f767592e9ee546037080875c0
SHA1

2ff77be6474c1efd7029c4892ba42b3cd4ed7daa
SHA256

fdcc26fdbb6394831dc74f5ea73922acc34db5957eccdab438bc42c740257d0c
SHA512

b5d75b11441a04e085eeb5da073ddbb729b5da23eac55c009ce5586a717f13b16921bdf9c0665ce8e62a0466c484bc6ac26c2559ec661b93f3f8b2d267d0b776
SSDEEP

6144:CKWeIhzyZNGu6RXDDjTJ61u+gF7iPN3EC7W8gzKH:CKWewyGDjBkri8MK

Score

10^/10

mystic stealer

Detect Mystic stealer payload 6 IoCs

resource	yara_rule
behavioral2/memory/4796-0-0x0000000000400000-0x0000000000433000-memory.dmp	mystic_family
behavioral2/memory/4796-2-0x0000000000400000-0x0000000000433000-memory.dmp	mystic_family
behavioral2/memory/4796-1-0x0000000000400000-0x0000000000433000-memory.dmp	mystic_family
behavioral2/memory/4796-3-0x0000000000400000-0x0000000000433000-memory.dmp	mystic_family
behavioral2/memory/4796-4-0x0000000000400000-0x0000000000433000-memory.dmp	mystic_family
behavioral2/memory/4796-5-0x0000000000400000-0x0000000000433000-memory.dmp	mystic_family

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4748 set thread context of 4796	4748	NEAS.d45b7c7f767592e9ee546037080875c0.exe	91

Suspicious use of WriteProcessMemory 16 IoCs

description	pid	Process	procid_target
PID 4748 wrote to memory of 4324	4748	NEAS.d45b7c7f767592e9ee546037080875c0.exe	89
PID 4748 wrote to memory of 4324	4748	NEAS.d45b7c7f767592e9ee546037080875c0.exe	89
PID 4748 wrote to memory of 4324	4748	NEAS.d45b7c7f767592e9ee546037080875c0.exe	89
PID 4748 wrote to memory of 112	4748	NEAS.d45b7c7f767592e9ee546037080875c0.exe	90
PID 4748 wrote to memory of 112	4748	NEAS.d45b7c7f767592e9ee546037080875c0.exe	90
PID 4748 wrote to memory of 112	4748	NEAS.d45b7c7f767592e9ee546037080875c0.exe	90
PID 4748 wrote to memory of 4796	4748	NEAS.d45b7c7f767592e9ee546037080875c0.exe	91
PID 4748 wrote to memory of 4796	4748	NEAS.d45b7c7f767592e9ee546037080875c0.exe	91
PID 4748 wrote to memory of 4796	4748	NEAS.d45b7c7f767592e9ee546037080875c0.exe	91
PID 4748 wrote to memory of 4796	4748	NEAS.d45b7c7f767592e9ee546037080875c0.exe	91
PID 4748 wrote to memory of 4796	4748	NEAS.d45b7c7f767592e9ee546037080875c0.exe	91
PID 4748 wrote to memory of 4796	4748	NEAS.d45b7c7f767592e9ee546037080875c0.exe	91
PID 4748 wrote to memory of 4796	4748	NEAS.d45b7c7f767592e9ee546037080875c0.exe	91
PID 4748 wrote to memory of 4796	4748	NEAS.d45b7c7f767592e9ee546037080875c0.exe	91
PID 4748 wrote to memory of 4796	4748	NEAS.d45b7c7f767592e9ee546037080875c0.exe	91
PID 4748 wrote to memory of 4796	4748	NEAS.d45b7c7f767592e9ee546037080875c0.exe	91

C:\Users\Admin\AppData\Local\Temp\NEAS.d45b7c7f767592e9ee546037080875c0.exe
"C:\Users\Admin\AppData\Local\Temp\NEAS.d45b7c7f767592e9ee546037080875c0.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4748
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
  2⤵
  PID:4324
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
  2⤵
  PID:112
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
  2⤵
  PID:4796

memory/4796-0-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4796-2-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4796-1-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4796-3-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4796-4-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4796-5-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download