Analysis

  • max time kernel
    110s
  • max time network
    153s
  • platform
    windows10_x64
  • resource
    win10v20210408
  • submitted
    22-07-2021 13:43

General

  • Target

    0722_5065418752.xls

  • Size

    343KB

  • MD5

    b11b59f8b566048f4d57962eea548076

  • SHA1

    ce410e9091d92cacca15afb770311e069e9efa44

  • SHA256

    166e48faaaae49f2d925c49d0febf96f0c9c8acd7457c1b542a60227b9068e4c

  • SHA512

    7943bfadf3b9c2d1fe836cfdcf66e0f23a849a5ba35d28d6257abb3f8342315087932d2e32d10a932e3d54bcbe5d5faf3398d195e135dad52eda7811961de3e4

Malware Config

Extracted

Family

hancitor

Botnet

2207_xwpi67

C2

http://tholeferli.com/8/forum.php

http://aidgodown.ru/8/forum.php

http://relifleappin.ru/8/forum.php

Extracted

Family

fickerstealer

C2

pospvisis.com:80

Signatures

  • Fickerstealer

    Ficker is an infostealer written in Rust and ASM.

  • Hancitor

    Hancitor is downloader used to deliver other malware families.

  • Process spawned unexpected child process 1 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • Blocklisted process makes network request 3 IoCs
  • Downloads MZ/PE file
  • Loads dropped DLL 2 IoCs
  • Reads local data of messenger clients 2 TTPs

    Infostealers often target stored data of messaging applications, which can include saved credentials and account information.

  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext 1 IoCs
  • Checks processor information in registry 2 TTPs 5 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • NTFS ADS 1 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of SetWindowsHookEx 12 IoCs
  • Suspicious use of WriteProcessMemory 10 IoCs

Processes

  • C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
    "C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\0722_5065418752.xls"
    1⤵
    • Checks processor information in registry
    • Enumerates system info in registry
    • NTFS ADS
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:4044
    • C:\Windows\System32\rundll32.exe
      "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Local\Temp\omsh.dll,SHIIJGLGNAB
      2⤵
      • Process spawned unexpected child process
      • Suspicious use of WriteProcessMemory
      PID:1944
      • C:\Windows\SysWOW64\rundll32.exe
        "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Local\Temp\omsh.dll,SHIIJGLGNAB
        3⤵
        • Blocklisted process makes network request
        • Loads dropped DLL
        • Suspicious use of SetThreadContext
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of WriteProcessMemory
        PID:2504
        • C:\Windows\SysWOW64\svchost.exe
          C:\Windows\System32\svchost.exe
          4⤵
          • Checks processor information in registry
          • Suspicious behavior: EnumeratesProcesses
          PID:3180

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/2504-297-0x00000000029E0000-0x00000000029E1000-memory.dmp

    Filesize

    4KB

  • memory/2504-296-0x0000000004791000-0x00000000047A9000-memory.dmp

    Filesize

    96KB

  • memory/2504-295-0x0000000004790000-0x000000000479A000-memory.dmp

    Filesize

    40KB

  • memory/2504-294-0x0000000004790000-0x0000000004856000-memory.dmp

    Filesize

    792KB

  • memory/3180-298-0x0000000000400000-0x0000000000448000-memory.dmp

    Filesize

    288KB

  • memory/3180-302-0x0000000000400000-0x0000000000448000-memory.dmp

    Filesize

    288KB

  • memory/4044-118-0x00007FFB5C580000-0x00007FFB5C590000-memory.dmp

    Filesize

    64KB

  • memory/4044-123-0x00007FFB7AAF0000-0x00007FFB7C9E5000-memory.dmp

    Filesize

    31.0MB

  • memory/4044-117-0x00007FFB5C580000-0x00007FFB5C590000-memory.dmp

    Filesize

    64KB

  • memory/4044-116-0x00007FFB5C580000-0x00007FFB5C590000-memory.dmp

    Filesize

    64KB

  • memory/4044-115-0x00007FFB5C580000-0x00007FFB5C590000-memory.dmp

    Filesize

    64KB

  • memory/4044-121-0x00007FFB5C580000-0x00007FFB5C590000-memory.dmp

    Filesize

    64KB

  • memory/4044-114-0x00007FF75E9A0000-0x00007FF761F56000-memory.dmp

    Filesize

    53.7MB

  • memory/4044-122-0x00007FFB7C9F0000-0x00007FFB7DADE000-memory.dmp

    Filesize

    16.9MB

  • memory/4044-336-0x00007FFB5C580000-0x00007FFB5C590000-memory.dmp

    Filesize

    64KB

  • memory/4044-337-0x00007FFB5C580000-0x00007FFB5C590000-memory.dmp

    Filesize

    64KB

  • memory/4044-338-0x00007FFB5C580000-0x00007FFB5C590000-memory.dmp

    Filesize

    64KB

  • memory/4044-339-0x00007FFB5C580000-0x00007FFB5C590000-memory.dmp

    Filesize

    64KB