mystic | 0bc640d74dd64f324f73183d63dfbbebee9bf5108e43002eecd9be34e64a038e

Analysis

max time kernel
121s
max time network
143s
platform
windows7_x64
resource
win7-20231023-en
resource tags

arch:x64arch:x86image:win7-20231023-enlocale:en-usos:windows7-x64system
submitted
18-11-2023 03:46

Target

NEAS.c37c75cd0e8338d7ad58edfc6bbc08a0.exe
Size

276KB
MD5

c37c75cd0e8338d7ad58edfc6bbc08a0
SHA1

cfe0526e491bc04443a82cc6e7cdf2d281451a00
SHA256

0bc640d74dd64f324f73183d63dfbbebee9bf5108e43002eecd9be34e64a038e
SHA512

18ae7f30fc3a7b4ad5fefa9d832ff89593450bdfe5a92f26113a122563c7315e3b2d068d2a0e7b836a435cacae02757549157f10eb23a9388814310c305a6a58
SSDEEP

6144:bKWeIhzyZNGui/xDD0vlhGxZPeZ/ApmWDOosrQ8o/70IKH:bKWewyixUuxZPeYDOxrQ8o//K

Score

10^/10

mystic stealer

Detect Mystic stealer payload 6 IoCs

resource	yara_rule
behavioral1/memory/2072-4-0x0000000000400000-0x0000000000433000-memory.dmp	mystic_family
behavioral1/memory/2072-5-0x0000000000400000-0x0000000000433000-memory.dmp	mystic_family
behavioral1/memory/2072-3-0x0000000000400000-0x0000000000433000-memory.dmp	mystic_family
behavioral1/memory/2072-7-0x0000000000400000-0x0000000000433000-memory.dmp	mystic_family
behavioral1/memory/2072-9-0x0000000000400000-0x0000000000433000-memory.dmp	mystic_family
behavioral1/memory/2072-11-0x0000000000400000-0x0000000000433000-memory.dmp	mystic_family

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2412 set thread context of 2072	2412	NEAS.c37c75cd0e8338d7ad58edfc6bbc08a0.exe	29

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2676	2072	WerFault.exe	29

Suspicious use of WriteProcessMemory 21 IoCs

description	pid	Process	procid_target
PID 2412 wrote to memory of 2072	2412	NEAS.c37c75cd0e8338d7ad58edfc6bbc08a0.exe	29
PID 2412 wrote to memory of 2072	2412	NEAS.c37c75cd0e8338d7ad58edfc6bbc08a0.exe	29
PID 2412 wrote to memory of 2072	2412	NEAS.c37c75cd0e8338d7ad58edfc6bbc08a0.exe	29
PID 2412 wrote to memory of 2072	2412	NEAS.c37c75cd0e8338d7ad58edfc6bbc08a0.exe	29
PID 2412 wrote to memory of 2072	2412	NEAS.c37c75cd0e8338d7ad58edfc6bbc08a0.exe	29
PID 2412 wrote to memory of 2072	2412	NEAS.c37c75cd0e8338d7ad58edfc6bbc08a0.exe	29
PID 2412 wrote to memory of 2072	2412	NEAS.c37c75cd0e8338d7ad58edfc6bbc08a0.exe	29
PID 2412 wrote to memory of 2072	2412	NEAS.c37c75cd0e8338d7ad58edfc6bbc08a0.exe	29
PID 2412 wrote to memory of 2072	2412	NEAS.c37c75cd0e8338d7ad58edfc6bbc08a0.exe	29
PID 2412 wrote to memory of 2072	2412	NEAS.c37c75cd0e8338d7ad58edfc6bbc08a0.exe	29
PID 2412 wrote to memory of 2072	2412	NEAS.c37c75cd0e8338d7ad58edfc6bbc08a0.exe	29
PID 2412 wrote to memory of 2072	2412	NEAS.c37c75cd0e8338d7ad58edfc6bbc08a0.exe	29
PID 2412 wrote to memory of 2072	2412	NEAS.c37c75cd0e8338d7ad58edfc6bbc08a0.exe	29
PID 2412 wrote to memory of 2072	2412	NEAS.c37c75cd0e8338d7ad58edfc6bbc08a0.exe	29
PID 2072 wrote to memory of 2676	2072	AppLaunch.exe	30
PID 2072 wrote to memory of 2676	2072	AppLaunch.exe	30
PID 2072 wrote to memory of 2676	2072	AppLaunch.exe	30
PID 2072 wrote to memory of 2676	2072	AppLaunch.exe	30
PID 2072 wrote to memory of 2676	2072	AppLaunch.exe	30
PID 2072 wrote to memory of 2676	2072	AppLaunch.exe	30
PID 2072 wrote to memory of 2676	2072	AppLaunch.exe	30

memory/2072-0-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2072-1-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2072-4-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2072-5-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2072-3-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2072-2-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2072-7-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2072-6-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmp

Filesize
4KB

Download
memory/2072-9-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2072-11-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download