mystic | e5144b44582feaade16daf9358b2ac4425168c60c3c28c3bba34b5ede694855e

Analysis

max time kernel
121s
max time network
138s
platform
windows7_x64
resource
win7-20231020-en
resource tags

arch:x64arch:x86image:win7-20231020-enlocale:en-usos:windows7-x64system
submitted
18-11-2023 07:08

Target

NEAS.b2e919a07e50d36e772d63feb905a130.exe
Size

319KB
MD5

b2e919a07e50d36e772d63feb905a130
SHA1

981a38f534f399bb71afc5ab86952a3ba85fffd6
SHA256

e5144b44582feaade16daf9358b2ac4425168c60c3c28c3bba34b5ede694855e
SHA512

18039854bc2bf10b9d6e58de5acee38c32aedf07bb683a96c5a1fe3d706625b147afe202b10f79061e324d89d94c30c02f5293783790a2b297d3fe90243e2949
SSDEEP

6144:x9PgXtnEpBXYKEjf5FaZwHjptYGsv7fxbXa8/DSPr/4L:x9PgXtnGY5FaULYhrSPr/i

Score

10^/10

mystic stealer

Detect Mystic stealer payload 6 IoCs

resource	yara_rule
behavioral1/memory/2192-3-0x0000000000400000-0x0000000000433000-memory.dmp	mystic_family
behavioral1/memory/2192-5-0x0000000000400000-0x0000000000433000-memory.dmp	mystic_family
behavioral1/memory/2192-4-0x0000000000400000-0x0000000000433000-memory.dmp	mystic_family
behavioral1/memory/2192-7-0x0000000000400000-0x0000000000433000-memory.dmp	mystic_family
behavioral1/memory/2192-9-0x0000000000400000-0x0000000000433000-memory.dmp	mystic_family
behavioral1/memory/2192-11-0x0000000000400000-0x0000000000433000-memory.dmp	mystic_family

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2520 set thread context of 2192	2520	NEAS.b2e919a07e50d36e772d63feb905a130.exe	28

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2828	2192	WerFault.exe	28

Suspicious use of WriteProcessMemory 21 IoCs

description	pid	Process	procid_target
PID 2520 wrote to memory of 2192	2520	NEAS.b2e919a07e50d36e772d63feb905a130.exe	28
PID 2520 wrote to memory of 2192	2520	NEAS.b2e919a07e50d36e772d63feb905a130.exe	28
PID 2520 wrote to memory of 2192	2520	NEAS.b2e919a07e50d36e772d63feb905a130.exe	28
PID 2520 wrote to memory of 2192	2520	NEAS.b2e919a07e50d36e772d63feb905a130.exe	28
PID 2520 wrote to memory of 2192	2520	NEAS.b2e919a07e50d36e772d63feb905a130.exe	28
PID 2520 wrote to memory of 2192	2520	NEAS.b2e919a07e50d36e772d63feb905a130.exe	28
PID 2520 wrote to memory of 2192	2520	NEAS.b2e919a07e50d36e772d63feb905a130.exe	28
PID 2520 wrote to memory of 2192	2520	NEAS.b2e919a07e50d36e772d63feb905a130.exe	28
PID 2520 wrote to memory of 2192	2520	NEAS.b2e919a07e50d36e772d63feb905a130.exe	28
PID 2520 wrote to memory of 2192	2520	NEAS.b2e919a07e50d36e772d63feb905a130.exe	28
PID 2520 wrote to memory of 2192	2520	NEAS.b2e919a07e50d36e772d63feb905a130.exe	28
PID 2520 wrote to memory of 2192	2520	NEAS.b2e919a07e50d36e772d63feb905a130.exe	28
PID 2520 wrote to memory of 2192	2520	NEAS.b2e919a07e50d36e772d63feb905a130.exe	28
PID 2520 wrote to memory of 2192	2520	NEAS.b2e919a07e50d36e772d63feb905a130.exe	28
PID 2192 wrote to memory of 2828	2192	AppLaunch.exe	29
PID 2192 wrote to memory of 2828	2192	AppLaunch.exe	29
PID 2192 wrote to memory of 2828	2192	AppLaunch.exe	29
PID 2192 wrote to memory of 2828	2192	AppLaunch.exe	29
PID 2192 wrote to memory of 2828	2192	AppLaunch.exe	29
PID 2192 wrote to memory of 2828	2192	AppLaunch.exe	29
PID 2192 wrote to memory of 2828	2192	AppLaunch.exe	29

memory/2192-2-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2192-3-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2192-1-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2192-0-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2192-6-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmp

Filesize
4KB

Download
memory/2192-5-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2192-4-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2192-7-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2192-9-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2192-11-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download