fickerstealer | e2c2f2f09847155f7e55b79bc8aa95843aff3686c695277afb655df5905ef8b6

Resubmissions

21-04-2021 15:20

210421-785dwczfms 10

21-04-2021 15:10

210421-kq112jc8an 10

Analysis

max time kernel
57s
max time network
125s
platform
windows7_x64
resource
win7v20210408
submitted
21-04-2021 15:10

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

kelly.n.dll
Size

335KB
MD5

22427dfa4b50e3111559a198dd95377c
SHA1

0cc247e4fc18a56b350dbedede1f0f433e18da41
SHA256

e2c2f2f09847155f7e55b79bc8aa95843aff3686c695277afb655df5905ef8b6
SHA512

d3552f766c9101acf87581231627d77e53dcfcbc32fd440d539b72e9cf5421ab817f95a94c20176670b1edf1b2c5df8c92ea7c03c7306fe84a3eacf3e1bf7188

Score

10^/10

fickerstealer hancitor 2104_mmvm downloader infostealer

Malware Config

Extracted

Family

hancitor

Botnet

2104_mmvm

http://lectionalt.com/8/forum.php

http://palimenciont.ru/8/forum.php

http://sidainopecelf.ru/8/forum.php

Extracted

Family

fickerstealer

sweyblidian.com:80

Signatures

Hancitor
Hancitor is downloader used to deliver other malware families.
downloader hancitor
fickerstealer
Ficker is an infostealer written in Rust and ASM.
infostealer fickerstealer
Blocklisted process makes network request 3 IoCs

Processes:

rundll32.exe

flow pid process

6 1828 rundll32.exe
8 1828 rundll32.exe
10 1828 rundll32.exe
Downloads MZ/PE file
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

5 api.ipify.org
Suspicious use of SetThreadContext 1 IoCs

Processes:

rundll32.exe

description pid process target process

PID 1828 set thread context of 792 1828 rundll32.exe svchost.exe
Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

rundll32.exe

pid process

1828 rundll32.exe

flow	pid	process
6	1828	rundll32.exe
8	1828	rundll32.exe
10	1828	rundll32.exe

flow	ioc
5	api.ipify.org

description	pid	process	target process
PID 1828 set thread context of 792	1828	rundll32.exe	svchost.exe

pid	process
1828	rundll32.exe

Suspicious use of WriteProcessMemory 17 IoCs

Processes:

rundll32.exerundll32.exe

description	pid	process	target process
PID 484 wrote to memory of 1828	484	rundll32.exe	rundll32.exe
PID 484 wrote to memory of 1828	484	rundll32.exe	rundll32.exe
PID 484 wrote to memory of 1828	484	rundll32.exe	rundll32.exe
PID 484 wrote to memory of 1828	484	rundll32.exe	rundll32.exe
PID 484 wrote to memory of 1828	484	rundll32.exe	rundll32.exe
PID 484 wrote to memory of 1828	484	rundll32.exe	rundll32.exe
PID 484 wrote to memory of 1828	484	rundll32.exe	rundll32.exe
PID 1828 wrote to memory of 1504	1828	rundll32.exe	cmd.exe
PID 1828 wrote to memory of 1504	1828	rundll32.exe	cmd.exe
PID 1828 wrote to memory of 1504	1828	rundll32.exe	cmd.exe
PID 1828 wrote to memory of 1504	1828	rundll32.exe	cmd.exe
PID 1828 wrote to memory of 792	1828	rundll32.exe	svchost.exe
PID 1828 wrote to memory of 792	1828	rundll32.exe	svchost.exe
PID 1828 wrote to memory of 792	1828	rundll32.exe	svchost.exe
PID 1828 wrote to memory of 792	1828	rundll32.exe	svchost.exe
PID 1828 wrote to memory of 792	1828	rundll32.exe	svchost.exe
PID 1828 wrote to memory of 792	1828	rundll32.exe	svchost.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\kelly.n.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:484

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\kelly.n.dll,#1
2⤵
- Blocklisted process makes network request
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1828

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c echo for
3⤵
PID:1504

C:\Windows\SysWOW64\svchost.exe
C:\Windows\System32\svchost.exe
3⤵
PID:792

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/792-65-0x0000000000401480-mapping.dmp

Download
memory/792-64-0x0000000000400000-0x0000000000448000-memory.dmp

Filesize
288KB

Download
memory/792-67-0x0000000000400000-0x0000000000448000-memory.dmp

Filesize
288KB

Download
memory/1504-61-0x0000000000000000-mapping.dmp

Download
memory/1828-59-0x0000000000000000-mapping.dmp

Download
memory/1828-60-0x0000000075AD1000-0x0000000075AD3000-memory.dmp

Filesize
8KB

Download
memory/1828-62-0x0000000074690000-0x000000007469A000-memory.dmp

Filesize
40KB

Download
memory/1828-63-0x00000000000B0000-0x00000000000B1000-memory.dmp

Filesize
4KB

Download