fickerstealer | e2c2f2f09847155f7e55b79bc8aa95843aff3686c695277afb655df5905ef8b6

Resubmissions

21-04-2021 15:20

210421-785dwczfms 10

21-04-2021 15:10

210421-kq112jc8an 10

Analysis

max time kernel
43s
max time network
149s
platform
windows10_x64
resource
win10v20210410
submitted
21-04-2021 15:10

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

kelly.n.dll
Size

335KB
MD5

22427dfa4b50e3111559a198dd95377c
SHA1

0cc247e4fc18a56b350dbedede1f0f433e18da41
SHA256

e2c2f2f09847155f7e55b79bc8aa95843aff3686c695277afb655df5905ef8b6
SHA512

d3552f766c9101acf87581231627d77e53dcfcbc32fd440d539b72e9cf5421ab817f95a94c20176670b1edf1b2c5df8c92ea7c03c7306fe84a3eacf3e1bf7188

Score

10^/10

fickerstealer hancitor 2104_mmvm downloader infostealer spyware stealer

Malware Config

Extracted

Family

hancitor

Botnet

2104_mmvm

http://lectionalt.com/8/forum.php

http://palimenciont.ru/8/forum.php

http://sidainopecelf.ru/8/forum.php

Extracted

Family

fickerstealer

sweyblidian.com:80

Signatures

Hancitor
Hancitor is downloader used to deliver other malware families.
downloader hancitor
fickerstealer
Ficker is an infostealer written in Rust and ASM.
infostealer fickerstealer
Blocklisted process makes network request 3 IoCs

Processes:

rundll32.exe

flow pid process

16 1636 rundll32.exe
18 1636 rundll32.exe
20 1636 rundll32.exe
Downloads MZ/PE file
Reads local data of messenger clients 2 TTPs
Infostealers often target stored data of messaging applications, which can include saved credentials and account information.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

15 api.ipify.org
Suspicious use of SetThreadContext 1 IoCs

Processes:

rundll32.exe

description pid process target process

PID 1636 set thread context of 1328 1636 rundll32.exe svchost.exe

flow	pid	process
16	1636	rundll32.exe
18	1636	rundll32.exe
20	1636	rundll32.exe

flow	ioc
15	api.ipify.org

description	pid	process	target process
PID 1636 set thread context of 1328	1636	rundll32.exe	svchost.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

svchost.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	svchost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	svchost.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

rundll32.exesvchost.exe

pid process

1636 rundll32.exe
1636 rundll32.exe
1328 svchost.exe
1328 svchost.exe

pid	process
1636	rundll32.exe
1636	rundll32.exe
1328	svchost.exe
1328	svchost.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

rundll32.exerundll32.exe

description	pid	process	target process
PID 1852 wrote to memory of 1636	1852	rundll32.exe	rundll32.exe
PID 1852 wrote to memory of 1636	1852	rundll32.exe	rundll32.exe
PID 1852 wrote to memory of 1636	1852	rundll32.exe	rundll32.exe
PID 1636 wrote to memory of 1164	1636	rundll32.exe	cmd.exe
PID 1636 wrote to memory of 1164	1636	rundll32.exe	cmd.exe
PID 1636 wrote to memory of 1164	1636	rundll32.exe	cmd.exe
PID 1636 wrote to memory of 1328	1636	rundll32.exe	svchost.exe
PID 1636 wrote to memory of 1328	1636	rundll32.exe	svchost.exe
PID 1636 wrote to memory of 1328	1636	rundll32.exe	svchost.exe
PID 1636 wrote to memory of 1328	1636	rundll32.exe	svchost.exe
PID 1636 wrote to memory of 1328	1636	rundll32.exe	svchost.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\kelly.n.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1852

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\kelly.n.dll,#1
2⤵
- Blocklisted process makes network request
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1636

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c echo for
3⤵
PID:1164

C:\Windows\SysWOW64\svchost.exe
C:\Windows\System32\svchost.exe
3⤵
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
PID:1328

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1164-115-0x0000000000000000-mapping.dmp

Download
memory/1328-119-0x0000000000401480-mapping.dmp

Download
memory/1328-118-0x0000000000400000-0x0000000000448000-memory.dmp

Filesize
288KB

Download
memory/1328-122-0x0000000000400000-0x0000000000448000-memory.dmp

Filesize
288KB

Download
memory/1636-114-0x0000000000000000-mapping.dmp

Download
memory/1636-116-0x0000000073E40000-0x0000000073E4A000-memory.dmp

Filesize
40KB

Download
memory/1636-117-0x0000000000500000-0x000000000064A000-memory.dmp

Filesize
1.3MB

Download