mystic | 13393f2bbd13d29c6e7531fb85bf951eefa0d0edbcbeda68514e647ba64224d6

Analysis

max time kernel
122s
max time network
126s
platform
windows7_x64
resource
win7-20231023-en
resource tags

arch:x64arch:x86image:win7-20231023-enlocale:en-usos:windows7-x64system
submitted
15/11/2023, 04:08

Target

NEAS.ace288f8be2ca3b173ec818e58a8d440.exe
Size

283KB
MD5

ace288f8be2ca3b173ec818e58a8d440
SHA1

369e4b13793139af6a61a9cecabbb36d38d8f882
SHA256

13393f2bbd13d29c6e7531fb85bf951eefa0d0edbcbeda68514e647ba64224d6
SHA512

eea9ee7a2ce3dbd9f07c0b2f774b50aef7168da683c5665e5d987115dd5bc1f7dc0adb2e1bf13dad0f1d9c6a6bfa868e0502d6146f258cec2c639f645813fb9f
SSDEEP

6144:wc/LoLW6Gh7xj8Y6jcAFurFSpowAfGb0NWHLcbnlOqjrMn7Ud3:3/L6jMrwphAfGbqsgBOqe7Ud3

Score

10^/10

mystic stealer

Detect Mystic stealer payload 6 IoCs

resource	yara_rule
behavioral1/memory/2384-5-0x0000000000400000-0x0000000000433000-memory.dmp	mystic_family
behavioral1/memory/2384-4-0x0000000000400000-0x0000000000433000-memory.dmp	mystic_family
behavioral1/memory/2384-3-0x0000000000400000-0x0000000000433000-memory.dmp	mystic_family
behavioral1/memory/2384-7-0x0000000000400000-0x0000000000433000-memory.dmp	mystic_family
behavioral1/memory/2384-9-0x0000000000400000-0x0000000000433000-memory.dmp	mystic_family
behavioral1/memory/2384-11-0x0000000000400000-0x0000000000433000-memory.dmp	mystic_family

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2220 set thread context of 2384	2220	NEAS.ace288f8be2ca3b173ec818e58a8d440.exe	29

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1728	2384	WerFault.exe	29

Suspicious use of WriteProcessMemory 21 IoCs

description	pid	Process	procid_target
PID 2220 wrote to memory of 2384	2220	NEAS.ace288f8be2ca3b173ec818e58a8d440.exe	29
PID 2220 wrote to memory of 2384	2220	NEAS.ace288f8be2ca3b173ec818e58a8d440.exe	29
PID 2220 wrote to memory of 2384	2220	NEAS.ace288f8be2ca3b173ec818e58a8d440.exe	29
PID 2220 wrote to memory of 2384	2220	NEAS.ace288f8be2ca3b173ec818e58a8d440.exe	29
PID 2220 wrote to memory of 2384	2220	NEAS.ace288f8be2ca3b173ec818e58a8d440.exe	29
PID 2220 wrote to memory of 2384	2220	NEAS.ace288f8be2ca3b173ec818e58a8d440.exe	29
PID 2220 wrote to memory of 2384	2220	NEAS.ace288f8be2ca3b173ec818e58a8d440.exe	29
PID 2220 wrote to memory of 2384	2220	NEAS.ace288f8be2ca3b173ec818e58a8d440.exe	29
PID 2220 wrote to memory of 2384	2220	NEAS.ace288f8be2ca3b173ec818e58a8d440.exe	29
PID 2220 wrote to memory of 2384	2220	NEAS.ace288f8be2ca3b173ec818e58a8d440.exe	29
PID 2220 wrote to memory of 2384	2220	NEAS.ace288f8be2ca3b173ec818e58a8d440.exe	29
PID 2220 wrote to memory of 2384	2220	NEAS.ace288f8be2ca3b173ec818e58a8d440.exe	29
PID 2220 wrote to memory of 2384	2220	NEAS.ace288f8be2ca3b173ec818e58a8d440.exe	29
PID 2220 wrote to memory of 2384	2220	NEAS.ace288f8be2ca3b173ec818e58a8d440.exe	29
PID 2384 wrote to memory of 1728	2384	AppLaunch.exe	30
PID 2384 wrote to memory of 1728	2384	AppLaunch.exe	30
PID 2384 wrote to memory of 1728	2384	AppLaunch.exe	30
PID 2384 wrote to memory of 1728	2384	AppLaunch.exe	30
PID 2384 wrote to memory of 1728	2384	AppLaunch.exe	30
PID 2384 wrote to memory of 1728	2384	AppLaunch.exe	30
PID 2384 wrote to memory of 1728	2384	AppLaunch.exe	30

memory/2384-1-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2384-0-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2384-2-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2384-5-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2384-6-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmp

Filesize
4KB

Download
memory/2384-4-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2384-3-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2384-7-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2384-9-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2384-11-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download