mystic | 98f31642817c636be68781c065db4296145592c77b5905f71a06e3d99220b16a

Analysis

max time kernel
133s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20231023-en
resource tags

arch:x64arch:x86image:win10v2004-20231023-enlocale:en-usos:windows10-2004-x64system
submitted
17-11-2023 03:36

Target

NEAS.b1954dc142646d289382e03f708fad60.exe
Size

376KB
MD5

b1954dc142646d289382e03f708fad60
SHA1

bf2cddb626f7cc37044914736a414733009ca826
SHA256

98f31642817c636be68781c065db4296145592c77b5905f71a06e3d99220b16a
SHA512

f04b996ba231e884c6ecf3a554204b998b42a6fa41f4a0c0d0c440f238557f531a1a9c706a153a5599c38fb8442d6ba1d1ea9f240dad2c70686cb176b67a5917
SSDEEP

6144:/EykMFF2Wb2U4nDjcAO57HOXeMjAbYZexJdh2pCpymynVUcSkC:Rk+F2wccr9Mjl5ZmEqb

Score

10^/10

mystic stealer

Detect Mystic stealer payload 6 IoCs

resource	yara_rule
behavioral2/memory/3884-0-0x0000000000400000-0x0000000000433000-memory.dmp	mystic_family
behavioral2/memory/3884-1-0x0000000000400000-0x0000000000433000-memory.dmp	mystic_family
behavioral2/memory/3884-2-0x0000000000400000-0x0000000000433000-memory.dmp	mystic_family
behavioral2/memory/3884-3-0x0000000000400000-0x0000000000433000-memory.dmp	mystic_family
behavioral2/memory/3884-4-0x0000000000400000-0x0000000000433000-memory.dmp	mystic_family
behavioral2/memory/3884-5-0x0000000000400000-0x0000000000433000-memory.dmp	mystic_family

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1072 set thread context of 3884	1072	NEAS.b1954dc142646d289382e03f708fad60.exe	94

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 1072 wrote to memory of 3884	1072	NEAS.b1954dc142646d289382e03f708fad60.exe	94
PID 1072 wrote to memory of 3884	1072	NEAS.b1954dc142646d289382e03f708fad60.exe	94
PID 1072 wrote to memory of 3884	1072	NEAS.b1954dc142646d289382e03f708fad60.exe	94
PID 1072 wrote to memory of 3884	1072	NEAS.b1954dc142646d289382e03f708fad60.exe	94
PID 1072 wrote to memory of 3884	1072	NEAS.b1954dc142646d289382e03f708fad60.exe	94
PID 1072 wrote to memory of 3884	1072	NEAS.b1954dc142646d289382e03f708fad60.exe	94
PID 1072 wrote to memory of 3884	1072	NEAS.b1954dc142646d289382e03f708fad60.exe	94
PID 1072 wrote to memory of 3884	1072	NEAS.b1954dc142646d289382e03f708fad60.exe	94
PID 1072 wrote to memory of 3884	1072	NEAS.b1954dc142646d289382e03f708fad60.exe	94
PID 1072 wrote to memory of 3884	1072	NEAS.b1954dc142646d289382e03f708fad60.exe	94

C:\Users\Admin\AppData\Local\Temp\NEAS.b1954dc142646d289382e03f708fad60.exe
"C:\Users\Admin\AppData\Local\Temp\NEAS.b1954dc142646d289382e03f708fad60.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1072
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
  2⤵
  PID:3884

memory/3884-0-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3884-1-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3884-2-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3884-3-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3884-4-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3884-5-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download