Overview
overview
10Static
static
eufive_202...1).exe
windows7_x64
1eufive_202...1).exe
windows10_x64
1eufive_202...1).exe
windows7_x64
10eufive_202...1).exe
windows10_x64
10eufive_202...41.exe
windows7_x64
10eufive_202...41.exe
windows10_x64
10mixazed_20...1).exe
windows7_x64
8mixazed_20...1).exe
windows10_x64
8mixazed_20...1).exe
windows7_x64
8mixazed_20...1).exe
windows10_x64
8mixazed_20...1).exe
windows7_x64
8mixazed_20...1).exe
windows10_x64
8mixsix_202...1).exe
windows7_x64
8mixsix_202...1).exe
windows10_x64
8usfive_202...1).exe
windows7_x64
10usfive_202...1).exe
windows10_x64
10Analysis
-
max time kernel
122s -
max time network
126s -
platform
windows7_x64 -
resource
win7v20210410 -
submitted
27-07-2021 21:27
Static task
static1
Behavioral task
behavioral1
Sample
eufive_20210727-123655(1).exe
Resource
win7v20210410
Behavioral task
behavioral2
Sample
eufive_20210727-123655(1).exe
Resource
win10v20210408
Behavioral task
behavioral3
Sample
eufive_20210727-125230(1).exe
Resource
win7v20210410
Behavioral task
behavioral4
Sample
eufive_20210727-125230(1).exe
Resource
win10v20210408
Behavioral task
behavioral5
Sample
eufive_20210727-174641.exe
Resource
win7v20210410
Behavioral task
behavioral6
Sample
eufive_20210727-174641.exe
Resource
win10v20210410
Behavioral task
behavioral7
Sample
mixazed_20210727-123659(1).exe
Resource
win7v20210408
Behavioral task
behavioral8
Sample
mixazed_20210727-123659(1).exe
Resource
win10v20210410
Behavioral task
behavioral9
Sample
mixazed_20210727-132631(1).exe
Resource
win7v20210408
Behavioral task
behavioral10
Sample
mixazed_20210727-132631(1).exe
Resource
win10v20210410
Behavioral task
behavioral11
Sample
mixazed_20210727-134206(1).exe
Resource
win7v20210408
Behavioral task
behavioral12
Sample
mixazed_20210727-134206(1).exe
Resource
win10v20210410
Behavioral task
behavioral13
Sample
mixsix_20210727-190432(1).exe
Resource
win7v20210410
Behavioral task
behavioral14
Sample
mixsix_20210727-190432(1).exe
Resource
win10v20210408
Behavioral task
behavioral15
Sample
usfive_20210727-123716(1).exe
Resource
win7v20210410
General
-
Target
mixsix_20210727-190432(1).exe
-
Size
1.2MB
-
MD5
a534cfd4be201d21fadbf222466b4bca
-
SHA1
ff937711252ca8b2394cb8baa29573de74b6c337
-
SHA256
c62ad002abbd09658ffd493be169df816d4432bdcbb4f34e054cbf8615c26308
-
SHA512
4f6ca1ab46ffa09d4c45af46670de439b06e534e179b65b6c3a9f5be444784db8845f2646302efd900bc7c5dab638da9f0078cf0f13912260d832ceb0c8c1e2d
Malware Config
Signatures
-
Downloads MZ/PE file
-
Deletes itself 1 IoCs
pid Process 1312 cmd.exe -
Loads dropped DLL 7 IoCs
pid Process 1624 mixsix_20210727-190432(1).exe 1624 mixsix_20210727-190432(1).exe 1624 mixsix_20210727-190432(1).exe 1624 mixsix_20210727-190432(1).exe 1624 mixsix_20210727-190432(1).exe 1624 mixsix_20210727-190432(1).exe 1624 mixsix_20210727-190432(1).exe -
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 1040 set thread context of 1624 1040 mixsix_20210727-190432(1).exe 29 -
Delays execution with timeout.exe 1 IoCs
pid Process 1544 timeout.exe -
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DAC9024F54D8F6DF94935FB1732638CA6AD77C13 mixsix_20210727-190432(1).exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DAC9024F54D8F6DF94935FB1732638CA6AD77C13\Blob = 040000000100000010000000410352dc0ff7501b16f0028eba6f45c50f00000001000000140000005bcaa1c2780f0bcb5a90770451d96f38963f012d0b000000010000001e000000440053005400200052006f006f0074002000430041002000580033000000090000000100000016000000301406082b0601050507030406082b06010505070301140000000100000014000000c4a7b1a47b2c71fadbe14b9075ffc415608589101d00000001000000100000004558d512eecb27464920897de7b66053030000000100000014000000dac9024f54d8f6df94935fb1732638ca6ad77c131900000001000000100000006cf252fec3e8f20996de5d4dd9aef42420000000010000004e0300003082034a30820232a003020102021044afb080d6a327ba893039862ef8406b300d06092a864886f70d0101050500303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f74204341205833301e170d3030303933303231313231395a170d3231303933303134303131355a303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f7420434120583330820122300d06092a864886f70d01010105000382010f003082010a0282010100dfafe99750088357b4cc6265f69082ecc7d32c6b30ca5becd9c37dc740c118148be0e83376492ae33f214993ac4e0eaf3e48cb65eefcd3210f65d22ad9328f8ce5f777b0127bb595c089a3a9baed732e7a0c063283a27e8a1430cd11a0e12a38b9790a31fd50bd8065dfb7516383c8e28861ea4b6181ec526bb9a2e24b1a289f48a39e0cda098e3e172e1edd20df5bc62a8aab2ebd70adc50b1a25907472c57b6aab34d63089ffe568137b540bc8d6aeec5a9c921e3d64b38cc6dfbfc94170ec1672d526ec38553943d0fcfd185c40f197ebd59a9b8d1dbada25b9c6d8dfc115023aabda6ef13e2ef55c089c3cd68369e4109b192ab62957e3e53d9b9ff0025d0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106301d0603551d0e04160414c4a7b1a47b2c71fadbe14b9075ffc41560858910300d06092a864886f70d01010505000382010100a31a2c9b17005ca91eee2866373abf83c73f4bc309a095205de3d95944d23e0d3ebd8a4ba0741fce10829c741a1d7e981addcb134bb32044e491e9ccfc7da5db6ae5fee6fde04eddb7003ab57049aff2e5eb02f1d1028b19cb943a5e48c4181e58195f1e025af00cf1b1ada9dc59868b6ee991f586cafab96633aa595bcee2a7167347cb2bcc99b03748cfe3564bf5cf0f0c723287c6f044bb53726d43f526489a5267b758abfe67767178db0da256141339243185a2a8025a3047e1dd5007bc02099000eb6463609b16bc88c912e6d27d918bf93d328d65b4e97cb15776eac5b62839bf15651cc8f677966a0a8d770bd8910b048e07db29b60aee9d82353510 mixsix_20210727-190432(1).exe -
Suspicious use of WriteProcessMemory 17 IoCs
description pid Process procid_target PID 1040 wrote to memory of 1624 1040 mixsix_20210727-190432(1).exe 29 PID 1040 wrote to memory of 1624 1040 mixsix_20210727-190432(1).exe 29 PID 1040 wrote to memory of 1624 1040 mixsix_20210727-190432(1).exe 29 PID 1040 wrote to memory of 1624 1040 mixsix_20210727-190432(1).exe 29 PID 1040 wrote to memory of 1624 1040 mixsix_20210727-190432(1).exe 29 PID 1040 wrote to memory of 1624 1040 mixsix_20210727-190432(1).exe 29 PID 1040 wrote to memory of 1624 1040 mixsix_20210727-190432(1).exe 29 PID 1040 wrote to memory of 1624 1040 mixsix_20210727-190432(1).exe 29 PID 1040 wrote to memory of 1624 1040 mixsix_20210727-190432(1).exe 29 PID 1624 wrote to memory of 1312 1624 mixsix_20210727-190432(1).exe 31 PID 1624 wrote to memory of 1312 1624 mixsix_20210727-190432(1).exe 31 PID 1624 wrote to memory of 1312 1624 mixsix_20210727-190432(1).exe 31 PID 1624 wrote to memory of 1312 1624 mixsix_20210727-190432(1).exe 31 PID 1312 wrote to memory of 1544 1312 cmd.exe 33 PID 1312 wrote to memory of 1544 1312 cmd.exe 33 PID 1312 wrote to memory of 1544 1312 cmd.exe 33 PID 1312 wrote to memory of 1544 1312 cmd.exe 33
Processes
-
C:\Users\Admin\AppData\Local\Temp\mixsix_20210727-190432(1).exe"C:\Users\Admin\AppData\Local\Temp\mixsix_20210727-190432(1).exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1040 -
C:\Users\Admin\AppData\Local\Temp\mixsix_20210727-190432(1).exe"C:\Users\Admin\AppData\Local\Temp\mixsix_20210727-190432(1).exe"2⤵
- Loads dropped DLL
- Modifies system certificate store
- Suspicious use of WriteProcessMemory
PID:1624 -
C:\Windows\SysWOW64\cmd.execmd.exe /C timeout /T 10 /NOBREAK > Nul & Del /f /q "C:\Users\Admin\AppData\Local\Temp\mixsix_20210727-190432(1).exe"3⤵
- Deletes itself
- Suspicious use of WriteProcessMemory
PID:1312 -
C:\Windows\SysWOW64\timeout.exetimeout /T 10 /NOBREAK4⤵
- Delays execution with timeout.exe
PID:1544
-
-
-