Analysis

  • max time kernel
    143s
  • max time network
    190s
  • platform
    windows7_x64
  • resource
    win7v20210410
  • submitted
    22-07-2021 13:43

General

  • Target

    0722_5065418752.xls

  • Size

    343KB

  • MD5

    b11b59f8b566048f4d57962eea548076

  • SHA1

    ce410e9091d92cacca15afb770311e069e9efa44

  • SHA256

    166e48faaaae49f2d925c49d0febf96f0c9c8acd7457c1b542a60227b9068e4c

  • SHA512

    7943bfadf3b9c2d1fe836cfdcf66e0f23a849a5ba35d28d6257abb3f8342315087932d2e32d10a932e3d54bcbe5d5faf3398d195e135dad52eda7811961de3e4

Malware Config

Extracted

Family

hancitor

Botnet

2207_xwpi67

C2

http://tholeferli.com/8/forum.php

http://aidgodown.ru/8/forum.php

http://relifleappin.ru/8/forum.php

Extracted

Family

fickerstealer

C2

pospvisis.com:80

Signatures

  • Fickerstealer

    Ficker is an infostealer written in Rust and ASM.

  • Hancitor

    Hancitor is downloader used to deliver other malware families.

  • Process spawned unexpected child process 1 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • Blocklisted process makes network request 4 IoCs
  • Downloads MZ/PE file
  • Loads dropped DLL 4 IoCs
  • Reads local data of messenger clients 2 TTPs

    Infostealers often target stored data of messaging applications, which can include saved credentials and account information.

  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext 1 IoCs
  • Office loads VBA resources, possible macro or embedded object present
  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 1 IoCs
  • Modifies Internet Explorer settings 1 TTPs 9 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of SetWindowsHookEx 3 IoCs
  • Suspicious use of WriteProcessMemory 13 IoCs

Processes

  • C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE
    "C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE" /dde C:\Users\Admin\AppData\Local\Temp\0722_5065418752.xls
    1⤵
    • Enumerates system info in registry
    • Modifies Internet Explorer settings
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:2016
    • C:\Windows\SysWOW64\rundll32.exe
      "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Local\Temp\omsh.dll,SHIIJGLGNAB
      2⤵
      • Process spawned unexpected child process
      • Blocklisted process makes network request
      • Loads dropped DLL
      • Suspicious use of SetThreadContext
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:720
      • C:\Windows\SysWOW64\svchost.exe
        C:\Windows\System32\svchost.exe
        3⤵
        • Checks processor information in registry
        • Suspicious behavior: EnumeratesProcesses
        PID:932

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/720-63-0x0000000076A81000-0x0000000076A83000-memory.dmp

    Filesize

    8KB

  • memory/720-69-0x0000000001DF0000-0x0000000001EB6000-memory.dmp

    Filesize

    792KB

  • memory/720-70-0x0000000001DF0000-0x0000000001DFA000-memory.dmp

    Filesize

    40KB

  • memory/720-71-0x0000000000100000-0x0000000000101000-memory.dmp

    Filesize

    4KB

  • memory/932-72-0x0000000000400000-0x0000000000448000-memory.dmp

    Filesize

    288KB

  • memory/932-75-0x0000000000400000-0x0000000000448000-memory.dmp

    Filesize

    288KB

  • memory/2016-59-0x000000002F731000-0x000000002F734000-memory.dmp

    Filesize

    12KB

  • memory/2016-61-0x000000005FFF0000-0x0000000060000000-memory.dmp

    Filesize

    64KB

  • memory/2016-60-0x0000000071C71000-0x0000000071C73000-memory.dmp

    Filesize

    8KB

  • memory/2016-76-0x000000005FFF0000-0x0000000060000000-memory.dmp

    Filesize

    64KB