Analysis
-
max time kernel
122s -
max time network
134s -
platform
windows7_x64 -
resource
win7-20231020-en -
resource tags
-
submitted
17-11-2023 02:00
General
-
Target
NEAS.6fe5fe7610cac632ef29e4bcbe6217a0.exe
-
Size
283KB
-
MD5
6fe5fe7610cac632ef29e4bcbe6217a0
-
SHA1
dccc14c35df158166ca024cb6fc9a7915e6329e7
-
SHA256
798e55f1a558caf705450f55ed2a5769676bf06a1f9c2e5b3b634fc71e9f4563
-
SHA512
6d92ec9bf831c806a0ca8b2bdb26e72b6f04a7bd521b065e341bbac19eecf4188b29c9ff8c96d0fa562f1efdb35eadec394eb57d42cca627d35043b0d48b9fbe
-
SSDEEP
6144:RCbb4qXmUb3Ou7IJ0T2fOUPNXF9Aq9CxaWY14ynGW57Ud3:sbP3OAI2T2WUpAqMxaWY1VFUd3
Score
10/10
Malware Config
Signatures
-
Detect Mystic stealer payload 6 IoCs
-
Mystic
Mystic is an infostealer written in C++.
-
Suspicious use of SetThreadContext 1 IoCs
-
Program crash 1 IoCs
-
Suspicious use of WriteProcessMemory 21 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\NEAS.6fe5fe7610cac632ef29e4bcbe6217a0.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.6fe5fe7610cac632ef29e4bcbe6217a0.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2272 -s 1963⤵
- Program crash
-
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
204KB
-
Filesize
204KB
-
Filesize
204KB
-
Filesize
204KB
-
Filesize
204KB
-
Filesize
4KB
-
Filesize
204KB
-
Filesize
204KB
-
Filesize
204KB
-
Filesize
204KB