mystic | 16861f7993bf2cab2d0248f22b6930810307b3618f33d888d9a0ca4b531962f1

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
28-10-2024 02:10

Target

16861f7993bf2cab2d0248f22b6930810307b3618f33d888d9a0ca4b531962f1.exe
Size

1.1MB
MD5

277229d35af1f921f9cb1846e1431266
SHA1

317fd9424ee4b5b422939462a55c952fe9149882
SHA256

16861f7993bf2cab2d0248f22b6930810307b3618f33d888d9a0ca4b531962f1
SHA512

826d6fefa6502695092ee182c47b16f4376f26b9b36687887b81fbe04b4ff6238891ea5c7a34762d20279dccb8752884d120d304bb47339e17dfe4c152fa556e
SSDEEP

24576:f8BS0NBiaZ7KPo1toFuHuWaWNJv+TMYGWDaR:f8M0ND7Kg12FQutWNJv+TMYGWDaR

Score

10^/10

mystic stealer

Detect Mystic stealer payload 5 IoCs

resource	yara_rule
behavioral1/memory/2060-21-0x0000000000400000-0x0000000000433000-memory.dmp	mystic_family
behavioral1/memory/2060-18-0x0000000000400000-0x0000000000433000-memory.dmp	mystic_family
behavioral1/memory/2060-15-0x0000000000400000-0x0000000000433000-memory.dmp	mystic_family
behavioral1/memory/2060-13-0x0000000000400000-0x0000000000433000-memory.dmp	mystic_family
behavioral1/memory/2060-11-0x0000000000400000-0x0000000000433000-memory.dmp	mystic_family

Executes dropped EXE 1 IoCs

pid	Process
2060	䑺扅㡸䝶捑

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2236 set thread context of 2060	2236	16861f7993bf2cab2d0248f22b6930810307b3618f33d888d9a0ca4b531962f1.exe	32

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2236 wrote to memory of 2060	2236	16861f7993bf2cab2d0248f22b6930810307b3618f33d888d9a0ca4b531962f1.exe	32
PID 2236 wrote to memory of 2060	2236	16861f7993bf2cab2d0248f22b6930810307b3618f33d888d9a0ca4b531962f1.exe	32
PID 2236 wrote to memory of 2060	2236	16861f7993bf2cab2d0248f22b6930810307b3618f33d888d9a0ca4b531962f1.exe	32
PID 2236 wrote to memory of 2060	2236	16861f7993bf2cab2d0248f22b6930810307b3618f33d888d9a0ca4b531962f1.exe	32
PID 2236 wrote to memory of 2060	2236	16861f7993bf2cab2d0248f22b6930810307b3618f33d888d9a0ca4b531962f1.exe	32
PID 2236 wrote to memory of 2060	2236	16861f7993bf2cab2d0248f22b6930810307b3618f33d888d9a0ca4b531962f1.exe	32
PID 2236 wrote to memory of 2060	2236	16861f7993bf2cab2d0248f22b6930810307b3618f33d888d9a0ca4b531962f1.exe	32
PID 2236 wrote to memory of 2060	2236	16861f7993bf2cab2d0248f22b6930810307b3618f33d888d9a0ca4b531962f1.exe	32
PID 2236 wrote to memory of 2060	2236	16861f7993bf2cab2d0248f22b6930810307b3618f33d888d9a0ca4b531962f1.exe	32
PID 2236 wrote to memory of 2060	2236	16861f7993bf2cab2d0248f22b6930810307b3618f33d888d9a0ca4b531962f1.exe	32
PID 2236 wrote to memory of 2060	2236	16861f7993bf2cab2d0248f22b6930810307b3618f33d888d9a0ca4b531962f1.exe	32

C:\Users\Admin\AppData\Local\Temp\16861f7993bf2cab2d0248f22b6930810307b3618f33d888d9a0ca4b531962f1.exe
"C:\Users\Admin\AppData\Local\Temp\16861f7993bf2cab2d0248f22b6930810307b3618f33d888d9a0ca4b531962f1.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2236
- C:\Users\Admin\AppData\Local\Temp\䑺扅㡸䝶捑
  "C:\Users\Admin\AppData\Local\Temp\䑺扅㡸䝶捑"
  2⤵
  - Executes dropped EXE
  PID:2060

C:\Users\Admin\AppData\Local\Temp\䑺扅㡸䝶捑

Filesize
38KB

MD5
3992f464696b0eeff236aef93b1fdbd5

SHA1
8dddabaea6b342efc4f5b244420a0af055ae691e

SHA256
0d1a8457014f2eb2563a91d1509dba38f6c418fedf5f241d8579d15a93e40e14

SHA512
27a63b43dc50faf4d9b06e10daa15e83dfb3f3be1bd3af83ea6990bd8ae6d3a6a7fc2f928822db972aaf1305970f4587d768d68cd7e1124bc8f710c1d3ee19a6

Download Submit
memory/2060-22-0x0000000000401000-0x0000000000424000-memory.dmp

Filesize
140KB

Download
memory/2060-21-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2060-18-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2060-17-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2060-15-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2060-13-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2060-11-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2060-9-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2060-7-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2060-5-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2236-23-0x000000013FD70000-0x000000013FE29000-memory.dmp

Filesize
740KB

Download