Analysis

  • max time kernel
    74s
  • max time network
    152s
  • platform
    windows7_x64
  • resource
    win7v20210408
  • submitted
    22-07-2021 13:44

General

  • Target

    0722_4617368714.xls

  • Size

    343KB

  • MD5

    b9b909ba415fd197adabd75170b9c7f8

  • SHA1

    6ecf8ad51b9819fa60c7bf8926f3b0619d7add99

  • SHA256

    5fb78700e3391da56aba59107389499a0efb5fb2057e11398e1129b3a118a633

  • SHA512

    d666edc3afafc5d17e890cb9ddffbb1bea8e627eff896b93aefdf013e0f878db364dd9889629ef0c1f66b608ca0c6c4cf8811efa3ecbcb0e4a3d4a3c61e48116

Malware Config

Extracted

Family

hancitor

Botnet

2207_xwpi67

C2

http://tholeferli.com/8/forum.php

http://aidgodown.ru/8/forum.php

http://relifleappin.ru/8/forum.php

Extracted

Family

fickerstealer

C2

pospvisis.com:80

Signatures

  • Fickerstealer

    Ficker is an infostealer written in Rust and ASM.

  • Hancitor

    Hancitor is downloader used to deliver other malware families.

  • Process spawned unexpected child process 1 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • Blocklisted process makes network request 3 IoCs
  • Downloads MZ/PE file
  • Loads dropped DLL 4 IoCs
  • Reads local data of messenger clients 2 TTPs

    Infostealers often target stored data of messaging applications, which can include saved credentials and account information.

  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext 1 IoCs
  • Office loads VBA resources, possible macro or embedded object present
  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 1 IoCs
  • Modifies Internet Explorer settings 1 TTPs 9 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 3 IoCs
  • Suspicious use of SetWindowsHookEx 3 IoCs
  • Suspicious use of WriteProcessMemory 13 IoCs

Processes

  • C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE
    "C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE" /dde C:\Users\Admin\AppData\Local\Temp\0722_4617368714.xls
    1⤵
    • Enumerates system info in registry
    • Modifies Internet Explorer settings
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:792
    • C:\Windows\SysWOW64\rundll32.exe
      "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Local\Temp\omsh.dll,SHIIJGLGNAB
      2⤵
      • Process spawned unexpected child process
      • Blocklisted process makes network request
      • Loads dropped DLL
      • Suspicious use of SetThreadContext
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:1064
      • C:\Windows\SysWOW64\svchost.exe
        C:\Windows\System32\svchost.exe
        3⤵
        • Checks processor information in registry
        • Suspicious behavior: EnumeratesProcesses
        PID:1540

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/792-61-0x0000000070D71000-0x0000000070D73000-memory.dmp

    Filesize

    8KB

  • memory/792-62-0x000000005FFF0000-0x0000000060000000-memory.dmp

    Filesize

    64KB

  • memory/792-60-0x000000002FD21000-0x000000002FD24000-memory.dmp

    Filesize

    12KB

  • memory/1064-64-0x0000000075041000-0x0000000075043000-memory.dmp

    Filesize

    8KB

  • memory/1064-70-0x00000000003F0000-0x00000000004B6000-memory.dmp

    Filesize

    792KB

  • memory/1064-71-0x00000000003F0000-0x00000000003FA000-memory.dmp

    Filesize

    40KB

  • memory/1064-72-0x0000000000160000-0x0000000000161000-memory.dmp

    Filesize

    4KB

  • memory/1540-73-0x0000000000400000-0x0000000000448000-memory.dmp

    Filesize

    288KB

  • memory/1540-76-0x0000000000400000-0x0000000000448000-memory.dmp

    Filesize

    288KB