mystic | 9eeb6e327713d5987d5491c8c1ec2a5afce3238602add44775430fb46333d36b

Analysis

max time kernel
142s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20231023-en
resource tags

arch:x64arch:x86image:win10v2004-20231023-enlocale:en-usos:windows10-2004-x64system
submitted
17-11-2023 04:10

Target

NEAS.1e4f2815798f04f641a4246161a4ccd0.exe
Size

1.6MB
MD5

1e4f2815798f04f641a4246161a4ccd0
SHA1

74e945ce3206bd201bf4e1a1f58fca95bc849bba
SHA256

9eeb6e327713d5987d5491c8c1ec2a5afce3238602add44775430fb46333d36b
SHA512

f05d696d08957925bde221a15704dee3cee948d6e2e19af94adacf7867b8a32fc188242d918f562cbeaf59bc299d67f8f2a7fb483b8eff792fbeb399b98af33a
SSDEEP

24576:HH183mnLjwI6vbR6a9DhvhZ5s+DSYJnJ4fQyDOggh:HV4inkTR6a3v9bDZnufQyDOlh

Score

10^/10

mystic stealer

Detect Mystic stealer payload 5 IoCs

resource	yara_rule
behavioral2/memory/3620-0-0x0000000000400000-0x0000000000433000-memory.dmp	mystic_family
behavioral2/memory/3620-1-0x0000000000400000-0x0000000000433000-memory.dmp	mystic_family
behavioral2/memory/3620-2-0x0000000000400000-0x0000000000433000-memory.dmp	mystic_family
behavioral2/memory/3620-3-0x0000000000400000-0x0000000000433000-memory.dmp	mystic_family
behavioral2/memory/3620-4-0x0000000000400000-0x0000000000433000-memory.dmp	mystic_family

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1300 set thread context of 3620	1300	NEAS.1e4f2815798f04f641a4246161a4ccd0.exe	88

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4080	1300	WerFault.exe	84

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 1300 wrote to memory of 3620	1300	NEAS.1e4f2815798f04f641a4246161a4ccd0.exe	88
PID 1300 wrote to memory of 3620	1300	NEAS.1e4f2815798f04f641a4246161a4ccd0.exe	88
PID 1300 wrote to memory of 3620	1300	NEAS.1e4f2815798f04f641a4246161a4ccd0.exe	88
PID 1300 wrote to memory of 3620	1300	NEAS.1e4f2815798f04f641a4246161a4ccd0.exe	88
PID 1300 wrote to memory of 3620	1300	NEAS.1e4f2815798f04f641a4246161a4ccd0.exe	88
PID 1300 wrote to memory of 3620	1300	NEAS.1e4f2815798f04f641a4246161a4ccd0.exe	88
PID 1300 wrote to memory of 3620	1300	NEAS.1e4f2815798f04f641a4246161a4ccd0.exe	88
PID 1300 wrote to memory of 3620	1300	NEAS.1e4f2815798f04f641a4246161a4ccd0.exe	88
PID 1300 wrote to memory of 3620	1300	NEAS.1e4f2815798f04f641a4246161a4ccd0.exe	88
PID 1300 wrote to memory of 3620	1300	NEAS.1e4f2815798f04f641a4246161a4ccd0.exe	88

C:\Users\Admin\AppData\Local\Temp\NEAS.1e4f2815798f04f641a4246161a4ccd0.exe
"C:\Users\Admin\AppData\Local\Temp\NEAS.1e4f2815798f04f641a4246161a4ccd0.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1300
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
  2⤵
  PID:3620
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1300 -s 140
  2⤵
  - Program crash
  PID:4080

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1300 -ip 1300
1⤵
PID:1812

memory/3620-0-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3620-1-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3620-2-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3620-3-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3620-4-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download