mystic | 77ce8339d76e6d78120e8bbb0f7e28e99e3ec48f4fbebb70f09dff77adf627cc

Analysis

max time kernel
120s
max time network
128s
platform
windows7_x64
resource
win7-20231025-en
resource tags

arch:x64arch:x86image:win7-20231025-enlocale:en-usos:windows7-x64system
submitted
16-11-2023 09:27

Target

NEAS.3dc73b3e9df3ba250dc8a12005607ea0.exe
Size

276KB
MD5

3dc73b3e9df3ba250dc8a12005607ea0
SHA1

bb98558db7d93d6bdbfd7adb26928eaeccd3b93a
SHA256

77ce8339d76e6d78120e8bbb0f7e28e99e3ec48f4fbebb70f09dff77adf627cc
SHA512

eb32d09187587ba0078d16e1e873e0d8ec84eadea27e0bf08a53c42e68e734712b158948477b026c44f855100b0cf352ad718e918cb44a2dbd568142afeb64e7
SSDEEP

6144:BflJ901WWKtT4uM6nv2NKrrREDQAs1YT88JGJcFlYve1ltjKH:Bflg1qVj7OT8aGc4m1jK

Score

10^/10

mystic stealer

Detect Mystic stealer payload 6 IoCs

resource	yara_rule
behavioral1/memory/2844-4-0x0000000000400000-0x0000000000433000-memory.dmp	mystic_family
behavioral1/memory/2844-8-0x0000000000400000-0x0000000000433000-memory.dmp	mystic_family
behavioral1/memory/2844-6-0x0000000000400000-0x0000000000433000-memory.dmp	mystic_family
behavioral1/memory/2844-11-0x0000000000400000-0x0000000000433000-memory.dmp	mystic_family
behavioral1/memory/2844-13-0x0000000000400000-0x0000000000433000-memory.dmp	mystic_family
behavioral1/memory/2844-15-0x0000000000400000-0x0000000000433000-memory.dmp	mystic_family

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1792 set thread context of 2844	1792	NEAS.3dc73b3e9df3ba250dc8a12005607ea0.exe	29

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2648	2844	WerFault.exe	29

Suspicious use of WriteProcessMemory 21 IoCs

description	pid	Process	procid_target
PID 1792 wrote to memory of 2844	1792	NEAS.3dc73b3e9df3ba250dc8a12005607ea0.exe	29
PID 1792 wrote to memory of 2844	1792	NEAS.3dc73b3e9df3ba250dc8a12005607ea0.exe	29
PID 1792 wrote to memory of 2844	1792	NEAS.3dc73b3e9df3ba250dc8a12005607ea0.exe	29
PID 1792 wrote to memory of 2844	1792	NEAS.3dc73b3e9df3ba250dc8a12005607ea0.exe	29
PID 1792 wrote to memory of 2844	1792	NEAS.3dc73b3e9df3ba250dc8a12005607ea0.exe	29
PID 1792 wrote to memory of 2844	1792	NEAS.3dc73b3e9df3ba250dc8a12005607ea0.exe	29
PID 1792 wrote to memory of 2844	1792	NEAS.3dc73b3e9df3ba250dc8a12005607ea0.exe	29
PID 1792 wrote to memory of 2844	1792	NEAS.3dc73b3e9df3ba250dc8a12005607ea0.exe	29
PID 1792 wrote to memory of 2844	1792	NEAS.3dc73b3e9df3ba250dc8a12005607ea0.exe	29
PID 1792 wrote to memory of 2844	1792	NEAS.3dc73b3e9df3ba250dc8a12005607ea0.exe	29
PID 1792 wrote to memory of 2844	1792	NEAS.3dc73b3e9df3ba250dc8a12005607ea0.exe	29
PID 1792 wrote to memory of 2844	1792	NEAS.3dc73b3e9df3ba250dc8a12005607ea0.exe	29
PID 1792 wrote to memory of 2844	1792	NEAS.3dc73b3e9df3ba250dc8a12005607ea0.exe	29
PID 1792 wrote to memory of 2844	1792	NEAS.3dc73b3e9df3ba250dc8a12005607ea0.exe	29
PID 2844 wrote to memory of 2648	2844	AppLaunch.exe	30
PID 2844 wrote to memory of 2648	2844	AppLaunch.exe	30
PID 2844 wrote to memory of 2648	2844	AppLaunch.exe	30
PID 2844 wrote to memory of 2648	2844	AppLaunch.exe	30
PID 2844 wrote to memory of 2648	2844	AppLaunch.exe	30
PID 2844 wrote to memory of 2648	2844	AppLaunch.exe	30
PID 2844 wrote to memory of 2648	2844	AppLaunch.exe	30

memory/2844-1-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2844-0-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2844-2-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2844-4-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2844-8-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2844-6-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2844-10-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmp

Filesize
4KB

Download
memory/2844-11-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2844-13-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2844-15-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download