mystic | 798e55f1a558caf705450f55ed2a5769676bf06a1f9c2e5b3b634fc71e9f4563

Analysis

max time kernel
167s
max time network
181s
platform
windows10-2004_x64
resource
win10v2004-20231020-en
resource tags

arch:x64arch:x86image:win10v2004-20231020-enlocale:en-usos:windows10-2004-x64system
submitted
17-11-2023 02:00

Target

NEAS.6fe5fe7610cac632ef29e4bcbe6217a0.exe
Size

283KB
MD5

6fe5fe7610cac632ef29e4bcbe6217a0
SHA1

dccc14c35df158166ca024cb6fc9a7915e6329e7
SHA256

798e55f1a558caf705450f55ed2a5769676bf06a1f9c2e5b3b634fc71e9f4563
SHA512

6d92ec9bf831c806a0ca8b2bdb26e72b6f04a7bd521b065e341bbac19eecf4188b29c9ff8c96d0fa562f1efdb35eadec394eb57d42cca627d35043b0d48b9fbe
SSDEEP

6144:RCbb4qXmUb3Ou7IJ0T2fOUPNXF9Aq9CxaWY14ynGW57Ud3:sbP3OAI2T2WUpAqMxaWY1VFUd3

Score

10^/10

mystic stealer

Detect Mystic stealer payload 5 IoCs

resource	yara_rule
behavioral2/memory/1948-0-0x0000000000400000-0x0000000000433000-memory.dmp	mystic_family
behavioral2/memory/1948-1-0x0000000000400000-0x0000000000433000-memory.dmp	mystic_family
behavioral2/memory/1948-2-0x0000000000400000-0x0000000000433000-memory.dmp	mystic_family
behavioral2/memory/1948-3-0x0000000000400000-0x0000000000433000-memory.dmp	mystic_family
behavioral2/memory/1948-4-0x0000000000400000-0x0000000000433000-memory.dmp	mystic_family

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1064 set thread context of 1948	1064	NEAS.6fe5fe7610cac632ef29e4bcbe6217a0.exe	96

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 1064 wrote to memory of 1948	1064	NEAS.6fe5fe7610cac632ef29e4bcbe6217a0.exe	96
PID 1064 wrote to memory of 1948	1064	NEAS.6fe5fe7610cac632ef29e4bcbe6217a0.exe	96
PID 1064 wrote to memory of 1948	1064	NEAS.6fe5fe7610cac632ef29e4bcbe6217a0.exe	96
PID 1064 wrote to memory of 1948	1064	NEAS.6fe5fe7610cac632ef29e4bcbe6217a0.exe	96
PID 1064 wrote to memory of 1948	1064	NEAS.6fe5fe7610cac632ef29e4bcbe6217a0.exe	96
PID 1064 wrote to memory of 1948	1064	NEAS.6fe5fe7610cac632ef29e4bcbe6217a0.exe	96
PID 1064 wrote to memory of 1948	1064	NEAS.6fe5fe7610cac632ef29e4bcbe6217a0.exe	96
PID 1064 wrote to memory of 1948	1064	NEAS.6fe5fe7610cac632ef29e4bcbe6217a0.exe	96
PID 1064 wrote to memory of 1948	1064	NEAS.6fe5fe7610cac632ef29e4bcbe6217a0.exe	96
PID 1064 wrote to memory of 1948	1064	NEAS.6fe5fe7610cac632ef29e4bcbe6217a0.exe	96

C:\Users\Admin\AppData\Local\Temp\NEAS.6fe5fe7610cac632ef29e4bcbe6217a0.exe
"C:\Users\Admin\AppData\Local\Temp\NEAS.6fe5fe7610cac632ef29e4bcbe6217a0.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1064
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
  2⤵
  PID:1948

memory/1948-0-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1948-1-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1948-2-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1948-3-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1948-4-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download