mystic | 98f31642817c636be68781c065db4296145592c77b5905f71a06e3d99220b16a

Analysis

max time kernel
117s
max time network
124s
platform
windows7_x64
resource
win7-20231020-en
resource tags

arch:x64arch:x86image:win7-20231020-enlocale:en-usos:windows7-x64system
submitted
17-11-2023 03:36

Target

NEAS.b1954dc142646d289382e03f708fad60.exe
Size

376KB
MD5

b1954dc142646d289382e03f708fad60
SHA1

bf2cddb626f7cc37044914736a414733009ca826
SHA256

98f31642817c636be68781c065db4296145592c77b5905f71a06e3d99220b16a
SHA512

f04b996ba231e884c6ecf3a554204b998b42a6fa41f4a0c0d0c440f238557f531a1a9c706a153a5599c38fb8442d6ba1d1ea9f240dad2c70686cb176b67a5917
SSDEEP

6144:/EykMFF2Wb2U4nDjcAO57HOXeMjAbYZexJdh2pCpymynVUcSkC:Rk+F2wccr9Mjl5ZmEqb

Score

10^/10

mystic stealer

Detect Mystic stealer payload 6 IoCs

resource	yara_rule
behavioral1/memory/2188-5-0x0000000000400000-0x0000000000433000-memory.dmp	mystic_family
behavioral1/memory/2188-4-0x0000000000400000-0x0000000000433000-memory.dmp	mystic_family
behavioral1/memory/2188-3-0x0000000000400000-0x0000000000433000-memory.dmp	mystic_family
behavioral1/memory/2188-7-0x0000000000400000-0x0000000000433000-memory.dmp	mystic_family
behavioral1/memory/2188-9-0x0000000000400000-0x0000000000433000-memory.dmp	mystic_family
behavioral1/memory/2188-11-0x0000000000400000-0x0000000000433000-memory.dmp	mystic_family

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1736 set thread context of 2188	1736	NEAS.b1954dc142646d289382e03f708fad60.exe	29

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2260	2188	WerFault.exe	29

Suspicious use of WriteProcessMemory 21 IoCs

description	pid	Process	procid_target
PID 1736 wrote to memory of 2188	1736	NEAS.b1954dc142646d289382e03f708fad60.exe	29
PID 1736 wrote to memory of 2188	1736	NEAS.b1954dc142646d289382e03f708fad60.exe	29
PID 1736 wrote to memory of 2188	1736	NEAS.b1954dc142646d289382e03f708fad60.exe	29
PID 1736 wrote to memory of 2188	1736	NEAS.b1954dc142646d289382e03f708fad60.exe	29
PID 1736 wrote to memory of 2188	1736	NEAS.b1954dc142646d289382e03f708fad60.exe	29
PID 1736 wrote to memory of 2188	1736	NEAS.b1954dc142646d289382e03f708fad60.exe	29
PID 1736 wrote to memory of 2188	1736	NEAS.b1954dc142646d289382e03f708fad60.exe	29
PID 1736 wrote to memory of 2188	1736	NEAS.b1954dc142646d289382e03f708fad60.exe	29
PID 1736 wrote to memory of 2188	1736	NEAS.b1954dc142646d289382e03f708fad60.exe	29
PID 1736 wrote to memory of 2188	1736	NEAS.b1954dc142646d289382e03f708fad60.exe	29
PID 1736 wrote to memory of 2188	1736	NEAS.b1954dc142646d289382e03f708fad60.exe	29
PID 1736 wrote to memory of 2188	1736	NEAS.b1954dc142646d289382e03f708fad60.exe	29
PID 1736 wrote to memory of 2188	1736	NEAS.b1954dc142646d289382e03f708fad60.exe	29
PID 1736 wrote to memory of 2188	1736	NEAS.b1954dc142646d289382e03f708fad60.exe	29
PID 2188 wrote to memory of 2260	2188	AppLaunch.exe	30
PID 2188 wrote to memory of 2260	2188	AppLaunch.exe	30
PID 2188 wrote to memory of 2260	2188	AppLaunch.exe	30
PID 2188 wrote to memory of 2260	2188	AppLaunch.exe	30
PID 2188 wrote to memory of 2260	2188	AppLaunch.exe	30
PID 2188 wrote to memory of 2260	2188	AppLaunch.exe	30
PID 2188 wrote to memory of 2260	2188	AppLaunch.exe	30

memory/2188-0-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2188-1-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2188-5-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2188-4-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2188-3-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2188-7-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2188-6-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmp

Filesize
4KB

Download
memory/2188-2-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2188-9-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2188-11-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download