mystic | 77ce8339d76e6d78120e8bbb0f7e28e99e3ec48f4fbebb70f09dff77adf627cc

Analysis

max time kernel
74s
max time network
130s
platform
windows10-2004_x64
resource
win10v2004-20231023-en
resource tags

arch:x64arch:x86image:win10v2004-20231023-enlocale:en-usos:windows10-2004-x64system
submitted
16-11-2023 09:27

Target

NEAS.3dc73b3e9df3ba250dc8a12005607ea0.exe
Size

276KB
MD5

3dc73b3e9df3ba250dc8a12005607ea0
SHA1

bb98558db7d93d6bdbfd7adb26928eaeccd3b93a
SHA256

77ce8339d76e6d78120e8bbb0f7e28e99e3ec48f4fbebb70f09dff77adf627cc
SHA512

eb32d09187587ba0078d16e1e873e0d8ec84eadea27e0bf08a53c42e68e734712b158948477b026c44f855100b0cf352ad718e918cb44a2dbd568142afeb64e7
SSDEEP

6144:BflJ901WWKtT4uM6nv2NKrrREDQAs1YT88JGJcFlYve1ltjKH:Bflg1qVj7OT8aGc4m1jK

Score

10^/10

mystic stealer

Detect Mystic stealer payload 5 IoCs

resource	yara_rule
behavioral2/memory/2556-0-0x0000000000400000-0x0000000000433000-memory.dmp	mystic_family
behavioral2/memory/2556-1-0x0000000000400000-0x0000000000433000-memory.dmp	mystic_family
behavioral2/memory/2556-2-0x0000000000400000-0x0000000000433000-memory.dmp	mystic_family
behavioral2/memory/2556-3-0x0000000000400000-0x0000000000433000-memory.dmp	mystic_family
behavioral2/memory/2556-4-0x0000000000400000-0x0000000000433000-memory.dmp	mystic_family

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4132 set thread context of 2556	4132	NEAS.3dc73b3e9df3ba250dc8a12005607ea0.exe	89

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 4132 wrote to memory of 2556	4132	NEAS.3dc73b3e9df3ba250dc8a12005607ea0.exe	89
PID 4132 wrote to memory of 2556	4132	NEAS.3dc73b3e9df3ba250dc8a12005607ea0.exe	89
PID 4132 wrote to memory of 2556	4132	NEAS.3dc73b3e9df3ba250dc8a12005607ea0.exe	89
PID 4132 wrote to memory of 2556	4132	NEAS.3dc73b3e9df3ba250dc8a12005607ea0.exe	89
PID 4132 wrote to memory of 2556	4132	NEAS.3dc73b3e9df3ba250dc8a12005607ea0.exe	89
PID 4132 wrote to memory of 2556	4132	NEAS.3dc73b3e9df3ba250dc8a12005607ea0.exe	89
PID 4132 wrote to memory of 2556	4132	NEAS.3dc73b3e9df3ba250dc8a12005607ea0.exe	89
PID 4132 wrote to memory of 2556	4132	NEAS.3dc73b3e9df3ba250dc8a12005607ea0.exe	89
PID 4132 wrote to memory of 2556	4132	NEAS.3dc73b3e9df3ba250dc8a12005607ea0.exe	89
PID 4132 wrote to memory of 2556	4132	NEAS.3dc73b3e9df3ba250dc8a12005607ea0.exe	89

C:\Users\Admin\AppData\Local\Temp\NEAS.3dc73b3e9df3ba250dc8a12005607ea0.exe
"C:\Users\Admin\AppData\Local\Temp\NEAS.3dc73b3e9df3ba250dc8a12005607ea0.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4132
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
  2⤵
  PID:2556

memory/2556-0-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2556-1-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2556-2-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2556-3-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2556-4-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download