Overview

overview

10

Static

static

3

SecuriteIn...67.exe

windows7-x64

1

SecuriteIn...67.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    137s
  • max time network
    161s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231023-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231023-enlocale:en-usos:windows10-2004-x64system
  • submitted
    21-11-2023 15:19

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    SecuriteInfo.com.Variant.Lazy.405958.21084.18767.exe

  • Size

    728KB

  • MD5

    54f5a88e40b41b5d088d6dda06295b4e

  • SHA1

    ac93c88fd247fa7e5b9fadf1a89da8340722f1ec

  • SHA256

    937c24c7bc8f644e736aeff6cbd1215b0092f22b786ae9bff4c04df71f7b637a

  • SHA512

    7b1fd7f02825cd1ea02ae8eba17faafea88e987e281c5995c123be4aa9e7a375841341b27443749aac8a1edd56ce7814e0eac73c3204a502b42bbaeb25dd9cdc

  • SSDEEP

    12288:+0B83HMvElpIYHQUtGGWs888888888888W88888888888qz36f9b6daPOytpSn:PqHCElpIYHQUtGGWdU9b6d0t

Score
10/10
mysticspywarestealer

Malware Config

Extracted

Family

mystic

C2

http://5.42.64.20/loghub/master

Signatures

  • Detect Mystic stealer payload 4 IoCs
  • Mystic

    Mystic is an infostealer written in C++.

    stealermystic
  • Loads dropped DLL 1 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
    spyware

Processes

  • C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Variant.Lazy.405958.21084.18767.exe
    "C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Variant.Lazy.405958.21084.18767.exe"
    1⤵
    • Loads dropped DLL
    PID:636

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

2
T1552

Credentials In Files

2
T1552.001

Discovery

Lateral Movement

Collection

Data from Local System

2
T1005

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\0hu3FjDTJGgT5h5e.dll
    Filesize

    778KB

    MD5

    ca426ad13949eb03954cf6af14ed9ccb

    SHA1

    f5f46048711a3b10fdd243d450f38c70b2bda65d

    SHA256

    383f6a8aac6ecde29d4cbde8e31be84a528892cc7295985f1c877fdfbe9e2a2f

    SHA512

    42494f56d3cd9048b7f912e907bbedf1db140d45834e1f5f79957d6453ea0468f97fe7de6e0e5f4d494cb5eff9a7c5b9005e9a506f82a1d7dcd18f5c3790dee1

    Download Submit
  • memory/636-0-0x0000000000400000-0x0000000000433000-memory.dmp
    Filesize

    204KB

    Download
  • memory/636-37-0x0000000000400000-0x0000000000433000-memory.dmp
    Filesize

    204KB

    Download
  • memory/636-38-0x0000000000400000-0x0000000000433000-memory.dmp
    Filesize

    204KB

    Download
  • memory/636-39-0x0000000000400000-0x0000000000433000-memory.dmp
    Filesize

    204KB

    Download