Analysis
-
max time kernel
147s -
max time network
147s -
platform
windows10_x64 -
resource
win10-en-20210920 -
submitted
26-09-2021 11:47
Static task
static1
Behavioral task
behavioral1
Sample
mixsix_20210918-232939.exe
Resource
win7v20210408
Behavioral task
behavioral2
Sample
mixsix_20210918-232939.exe
Resource
win10-en-20210920
General
-
Target
mixsix_20210918-232939.exe
-
Size
478KB
-
MD5
93ea282916839faaa3eb613778881b81
-
SHA1
ddfeb2fb3bf140b1c8d7384fbdb8b2f652c7985a
-
SHA256
b0e6ddfd970372aaba019f96d025df8e3230e5fae54fc57ee7de3e69dfe20d1a
-
SHA512
bee171883c0fe9108b9a6f3ae22afb30806db9b195cbec1c6271774c8a748eaf6e5b44e4ccd2fa70061dab024dd351a04aa4aae8df38a7099fe1fd56a535152e
Malware Config
Extracted
fickerstealer
game2030.site:80
Signatures
-
Fickerstealer
Ficker is an infostealer written in Rust and ASM.
-
suricata: ET MALWARE Win32/Ficker Stealer Activity M3
suricata: ET MALWARE Win32/Ficker Stealer Activity M3
-
Executes dropped EXE 2 IoCs
Processes:
1632657233881.exe1632657234114.exepid process 2680 1632657233881.exe 2748 1632657234114.exe -
Reads local data of messenger clients 2 TTPs
Infostealers often target stored data of messaging applications, which can include saved credentials and account information.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 2 api.ipify.org -
Suspicious use of SetThreadContext 1 IoCs
Processes:
mixsix_20210918-232939.exedescription pid process target process PID 2300 set thread context of 2392 2300 mixsix_20210918-232939.exe mixsix_20210918-232939.exe -
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
mixsix_20210918-232939.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString mixsix_20210918-232939.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 mixsix_20210918-232939.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
mixsix_20210918-232939.exepid process 2392 mixsix_20210918-232939.exe 2392 mixsix_20210918-232939.exe -
Suspicious use of WriteProcessMemory 25 IoCs
Processes:
mixsix_20210918-232939.exemixsix_20210918-232939.exedescription pid process target process PID 2300 wrote to memory of 2392 2300 mixsix_20210918-232939.exe mixsix_20210918-232939.exe PID 2300 wrote to memory of 2392 2300 mixsix_20210918-232939.exe mixsix_20210918-232939.exe PID 2300 wrote to memory of 2392 2300 mixsix_20210918-232939.exe mixsix_20210918-232939.exe PID 2300 wrote to memory of 2392 2300 mixsix_20210918-232939.exe mixsix_20210918-232939.exe PID 2300 wrote to memory of 2392 2300 mixsix_20210918-232939.exe mixsix_20210918-232939.exe PID 2300 wrote to memory of 2392 2300 mixsix_20210918-232939.exe mixsix_20210918-232939.exe PID 2300 wrote to memory of 2392 2300 mixsix_20210918-232939.exe mixsix_20210918-232939.exe PID 2300 wrote to memory of 2392 2300 mixsix_20210918-232939.exe mixsix_20210918-232939.exe PID 2300 wrote to memory of 2392 2300 mixsix_20210918-232939.exe mixsix_20210918-232939.exe PID 2300 wrote to memory of 2392 2300 mixsix_20210918-232939.exe mixsix_20210918-232939.exe PID 2300 wrote to memory of 2392 2300 mixsix_20210918-232939.exe mixsix_20210918-232939.exe PID 2300 wrote to memory of 2392 2300 mixsix_20210918-232939.exe mixsix_20210918-232939.exe PID 2300 wrote to memory of 2392 2300 mixsix_20210918-232939.exe mixsix_20210918-232939.exe PID 2300 wrote to memory of 2392 2300 mixsix_20210918-232939.exe mixsix_20210918-232939.exe PID 2300 wrote to memory of 2392 2300 mixsix_20210918-232939.exe mixsix_20210918-232939.exe PID 2300 wrote to memory of 2392 2300 mixsix_20210918-232939.exe mixsix_20210918-232939.exe PID 2300 wrote to memory of 2392 2300 mixsix_20210918-232939.exe mixsix_20210918-232939.exe PID 2300 wrote to memory of 2392 2300 mixsix_20210918-232939.exe mixsix_20210918-232939.exe PID 2300 wrote to memory of 2392 2300 mixsix_20210918-232939.exe mixsix_20210918-232939.exe PID 2392 wrote to memory of 2680 2392 mixsix_20210918-232939.exe 1632657233881.exe PID 2392 wrote to memory of 2680 2392 mixsix_20210918-232939.exe 1632657233881.exe PID 2392 wrote to memory of 2680 2392 mixsix_20210918-232939.exe 1632657233881.exe PID 2392 wrote to memory of 2748 2392 mixsix_20210918-232939.exe 1632657234114.exe PID 2392 wrote to memory of 2748 2392 mixsix_20210918-232939.exe 1632657234114.exe PID 2392 wrote to memory of 2748 2392 mixsix_20210918-232939.exe 1632657234114.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\mixsix_20210918-232939.exe"C:\Users\Admin\AppData\Local\Temp\mixsix_20210918-232939.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\mixsix_20210918-232939.exe"C:\Users\Admin\AppData\Local\Temp\mixsix_20210918-232939.exe"2⤵
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\1632657233881.exe"C:\Users\Admin\AppData\Local\Temp\1632657233881.exe"3⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\1632657234114.exe"C:\Users\Admin\AppData\Local\Temp\1632657234114.exe"3⤵
- Executes dropped EXE
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\1632657233881.exeMD5
5c2239fc23f6fbf9255c028fd5a31c2d
SHA1838606011ef69960fe2a0092c8eaf8ce34ee908d
SHA25649913ed81ebc44a229799d68f33dcb018f56bec67bbf552166c52d0ddaa9a386
SHA512bf8c583254d1223fdd747cd51b9bbe26bbc2c39ed49c467f985944ba7530a6a0a4fe4d66f168c0f2ec3a45fd6a87f6fba70238345261a1baeae6b6981efa5de6
-
C:\Users\Admin\AppData\Local\Temp\1632657233881.exeMD5
5c2239fc23f6fbf9255c028fd5a31c2d
SHA1838606011ef69960fe2a0092c8eaf8ce34ee908d
SHA25649913ed81ebc44a229799d68f33dcb018f56bec67bbf552166c52d0ddaa9a386
SHA512bf8c583254d1223fdd747cd51b9bbe26bbc2c39ed49c467f985944ba7530a6a0a4fe4d66f168c0f2ec3a45fd6a87f6fba70238345261a1baeae6b6981efa5de6
-
C:\Users\Admin\AppData\Local\Temp\1632657234114.exeMD5
f51ba78075a26eb83caca0d95bbe22c6
SHA102a40c1e3bf49040f959f1ee3e6f532453740fb8
SHA2568dc5ad841d1d047a8bd3b57727da647dd8e1548a3be6178f341438b97c0f28b9
SHA512c757126cb32ca7a8321668562b28c50b9428e3ea215ba0c4e3e04fa79c3c18689534245b5d151bedb082166bcb574cb5698185a48cc5f9be7bce227d4a6c37cf
-
C:\Users\Admin\AppData\Local\Temp\1632657234114.exeMD5
f51ba78075a26eb83caca0d95bbe22c6
SHA102a40c1e3bf49040f959f1ee3e6f532453740fb8
SHA2568dc5ad841d1d047a8bd3b57727da647dd8e1548a3be6178f341438b97c0f28b9
SHA512c757126cb32ca7a8321668562b28c50b9428e3ea215ba0c4e3e04fa79c3c18689534245b5d151bedb082166bcb574cb5698185a48cc5f9be7bce227d4a6c37cf
-
memory/2300-117-0x0000000000470000-0x00000000005BA000-memory.dmpFilesize
1.3MB
-
memory/2392-115-0x0000000000400000-0x000000000044F000-memory.dmpFilesize
316KB
-
memory/2392-116-0x0000000000401480-mapping.dmp
-
memory/2392-118-0x0000000000400000-0x000000000044F000-memory.dmpFilesize
316KB
-
memory/2680-119-0x0000000000000000-mapping.dmp
-
memory/2748-122-0x0000000000000000-mapping.dmp