Analysis

  • max time kernel
    122s
  • max time network
    126s
  • platform
    windows7_x64
  • resource
    win7v20210410
  • submitted
    27-07-2021 21:27

General

  • Target

    mixsix_20210727-190432(1).exe

  • Size

    1.2MB

  • MD5

    a534cfd4be201d21fadbf222466b4bca

  • SHA1

    ff937711252ca8b2394cb8baa29573de74b6c337

  • SHA256

    c62ad002abbd09658ffd493be169df816d4432bdcbb4f34e054cbf8615c26308

  • SHA512

    4f6ca1ab46ffa09d4c45af46670de439b06e534e179b65b6c3a9f5be444784db8845f2646302efd900bc7c5dab638da9f0078cf0f13912260d832ceb0c8c1e2d

Malware Config

Signatures

  • Downloads MZ/PE file
  • Deletes itself 1 IoCs
  • Loads dropped DLL 7 IoCs
  • Reads user/profile data of local email clients 2 TTPs

    Email clients store some user data on disk where infostealers will often target it.

  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Suspicious use of SetThreadContext 1 IoCs
  • Delays execution with timeout.exe 1 IoCs
  • Modifies system certificate store 2 TTPs 2 IoCs
  • Suspicious use of WriteProcessMemory 17 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\mixsix_20210727-190432(1).exe
    "C:\Users\Admin\AppData\Local\Temp\mixsix_20210727-190432(1).exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:1040
    • C:\Users\Admin\AppData\Local\Temp\mixsix_20210727-190432(1).exe
      "C:\Users\Admin\AppData\Local\Temp\mixsix_20210727-190432(1).exe"
      2⤵
      • Loads dropped DLL
      • Modifies system certificate store
      • Suspicious use of WriteProcessMemory
      PID:1624
      • C:\Windows\SysWOW64\cmd.exe
        cmd.exe /C timeout /T 10 /NOBREAK > Nul & Del /f /q "C:\Users\Admin\AppData\Local\Temp\mixsix_20210727-190432(1).exe"
        3⤵
        • Deletes itself
        • Suspicious use of WriteProcessMemory
        PID:1312
        • C:\Windows\SysWOW64\timeout.exe
          timeout /T 10 /NOBREAK
          4⤵
          • Delays execution with timeout.exe
          PID:1544

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/1040-66-0x0000000000400000-0x0000000000920000-memory.dmp

    Filesize

    5.1MB

  • memory/1040-63-0x0000000002660000-0x0000000002718000-memory.dmp

    Filesize

    736KB

  • memory/1040-68-0x0000000000400000-0x0000000000920000-memory.dmp

    Filesize

    5.1MB

  • memory/1040-59-0x0000000002260000-0x000000000236B000-memory.dmp

    Filesize

    1.0MB

  • memory/1040-61-0x0000000002570000-0x0000000002658000-memory.dmp

    Filesize

    928KB

  • memory/1040-71-0x0000000000250000-0x00000000002C8000-memory.dmp

    Filesize

    480KB

  • memory/1040-62-0x0000000000400000-0x0000000000920000-memory.dmp

    Filesize

    5.1MB

  • memory/1040-67-0x0000000002830000-0x00000000028B8000-memory.dmp

    Filesize

    544KB

  • memory/1040-64-0x0000000000400000-0x0000000000920000-memory.dmp

    Filesize

    5.1MB

  • memory/1040-60-0x0000000000400000-0x0000000000920000-memory.dmp

    Filesize

    5.1MB

  • memory/1040-65-0x0000000002720000-0x00000000027B7000-memory.dmp

    Filesize

    604KB

  • memory/1624-75-0x0000000000400000-0x00000000008DF000-memory.dmp

    Filesize

    4.9MB

  • memory/1624-74-0x00000000002A0000-0x0000000000333000-memory.dmp

    Filesize

    588KB

  • memory/1624-73-0x0000000074F31000-0x0000000074F33000-memory.dmp

    Filesize

    8KB

  • memory/1624-72-0x0000000000400000-0x00000000008DF000-memory.dmp

    Filesize

    4.9MB

  • memory/1624-69-0x0000000000400000-0x00000000008DF000-memory.dmp

    Filesize

    4.9MB