Analysis
-
max time kernel
146s -
max time network
91s -
platform
windows10_x64 -
resource
win10v20210408 -
submitted
26-09-2021 11:47
Static task
static1
Behavioral task
behavioral1
Sample
mixsix_20210919-093205.exe
Resource
win7-en-20210920
Behavioral task
behavioral2
Sample
mixsix_20210919-093205.exe
Resource
win10v20210408
General
-
Target
mixsix_20210919-093205.exe
-
Size
477KB
-
MD5
5a201b72a6586afe40b60948afab9d22
-
SHA1
2cca256b60e74f7e002a6c2422598e5eb7ab4fbd
-
SHA256
3700fd2107cc453097ff092f1d2be1678cba183034b950ffb74c38a2abc6b260
-
SHA512
24446cede744c59a19c5ca4998a80f67c6e95cb4ffdee0e118136022f1252e770e158dcfbf9f1fce9d1735e1597d31ea7d28ef6b24ef2ef8589d8010aa007418
Malware Config
Extracted
fickerstealer
game2030.site:80
Signatures
-
Fickerstealer
Ficker is an infostealer written in Rust and ASM.
-
Executes dropped EXE 2 IoCs
Processes:
1632664477247.exe1632664477337.exepid process 1160 1632664477247.exe 1368 1632664477337.exe -
Reads local data of messenger clients 2 TTPs
Infostealers often target stored data of messaging applications, which can include saved credentials and account information.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 6 api.ipify.org -
Suspicious use of SetThreadContext 1 IoCs
Processes:
mixsix_20210919-093205.exedescription pid process target process PID 800 set thread context of 1000 800 mixsix_20210919-093205.exe mixsix_20210919-093205.exe -
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
mixsix_20210919-093205.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 mixsix_20210919-093205.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString mixsix_20210919-093205.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
mixsix_20210919-093205.exepid process 1000 mixsix_20210919-093205.exe 1000 mixsix_20210919-093205.exe -
Suspicious use of WriteProcessMemory 25 IoCs
Processes:
mixsix_20210919-093205.exemixsix_20210919-093205.exedescription pid process target process PID 800 wrote to memory of 1000 800 mixsix_20210919-093205.exe mixsix_20210919-093205.exe PID 800 wrote to memory of 1000 800 mixsix_20210919-093205.exe mixsix_20210919-093205.exe PID 800 wrote to memory of 1000 800 mixsix_20210919-093205.exe mixsix_20210919-093205.exe PID 800 wrote to memory of 1000 800 mixsix_20210919-093205.exe mixsix_20210919-093205.exe PID 800 wrote to memory of 1000 800 mixsix_20210919-093205.exe mixsix_20210919-093205.exe PID 800 wrote to memory of 1000 800 mixsix_20210919-093205.exe mixsix_20210919-093205.exe PID 800 wrote to memory of 1000 800 mixsix_20210919-093205.exe mixsix_20210919-093205.exe PID 800 wrote to memory of 1000 800 mixsix_20210919-093205.exe mixsix_20210919-093205.exe PID 800 wrote to memory of 1000 800 mixsix_20210919-093205.exe mixsix_20210919-093205.exe PID 800 wrote to memory of 1000 800 mixsix_20210919-093205.exe mixsix_20210919-093205.exe PID 800 wrote to memory of 1000 800 mixsix_20210919-093205.exe mixsix_20210919-093205.exe PID 800 wrote to memory of 1000 800 mixsix_20210919-093205.exe mixsix_20210919-093205.exe PID 800 wrote to memory of 1000 800 mixsix_20210919-093205.exe mixsix_20210919-093205.exe PID 800 wrote to memory of 1000 800 mixsix_20210919-093205.exe mixsix_20210919-093205.exe PID 800 wrote to memory of 1000 800 mixsix_20210919-093205.exe mixsix_20210919-093205.exe PID 800 wrote to memory of 1000 800 mixsix_20210919-093205.exe mixsix_20210919-093205.exe PID 800 wrote to memory of 1000 800 mixsix_20210919-093205.exe mixsix_20210919-093205.exe PID 800 wrote to memory of 1000 800 mixsix_20210919-093205.exe mixsix_20210919-093205.exe PID 800 wrote to memory of 1000 800 mixsix_20210919-093205.exe mixsix_20210919-093205.exe PID 1000 wrote to memory of 1160 1000 mixsix_20210919-093205.exe 1632664477247.exe PID 1000 wrote to memory of 1160 1000 mixsix_20210919-093205.exe 1632664477247.exe PID 1000 wrote to memory of 1160 1000 mixsix_20210919-093205.exe 1632664477247.exe PID 1000 wrote to memory of 1368 1000 mixsix_20210919-093205.exe 1632664477337.exe PID 1000 wrote to memory of 1368 1000 mixsix_20210919-093205.exe 1632664477337.exe PID 1000 wrote to memory of 1368 1000 mixsix_20210919-093205.exe 1632664477337.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\mixsix_20210919-093205.exe"C:\Users\Admin\AppData\Local\Temp\mixsix_20210919-093205.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\mixsix_20210919-093205.exe"C:\Users\Admin\AppData\Local\Temp\mixsix_20210919-093205.exe"2⤵
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\1632664477247.exe"C:\Users\Admin\AppData\Local\Temp\1632664477247.exe"3⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\1632664477337.exe"C:\Users\Admin\AppData\Local\Temp\1632664477337.exe"3⤵
- Executes dropped EXE
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\1632664477247.exeMD5
5c2239fc23f6fbf9255c028fd5a31c2d
SHA1838606011ef69960fe2a0092c8eaf8ce34ee908d
SHA25649913ed81ebc44a229799d68f33dcb018f56bec67bbf552166c52d0ddaa9a386
SHA512bf8c583254d1223fdd747cd51b9bbe26bbc2c39ed49c467f985944ba7530a6a0a4fe4d66f168c0f2ec3a45fd6a87f6fba70238345261a1baeae6b6981efa5de6
-
C:\Users\Admin\AppData\Local\Temp\1632664477247.exeMD5
5c2239fc23f6fbf9255c028fd5a31c2d
SHA1838606011ef69960fe2a0092c8eaf8ce34ee908d
SHA25649913ed81ebc44a229799d68f33dcb018f56bec67bbf552166c52d0ddaa9a386
SHA512bf8c583254d1223fdd747cd51b9bbe26bbc2c39ed49c467f985944ba7530a6a0a4fe4d66f168c0f2ec3a45fd6a87f6fba70238345261a1baeae6b6981efa5de6
-
C:\Users\Admin\AppData\Local\Temp\1632664477337.exeMD5
f51ba78075a26eb83caca0d95bbe22c6
SHA102a40c1e3bf49040f959f1ee3e6f532453740fb8
SHA2568dc5ad841d1d047a8bd3b57727da647dd8e1548a3be6178f341438b97c0f28b9
SHA512c757126cb32ca7a8321668562b28c50b9428e3ea215ba0c4e3e04fa79c3c18689534245b5d151bedb082166bcb574cb5698185a48cc5f9be7bce227d4a6c37cf
-
C:\Users\Admin\AppData\Local\Temp\1632664477337.exeMD5
f51ba78075a26eb83caca0d95bbe22c6
SHA102a40c1e3bf49040f959f1ee3e6f532453740fb8
SHA2568dc5ad841d1d047a8bd3b57727da647dd8e1548a3be6178f341438b97c0f28b9
SHA512c757126cb32ca7a8321668562b28c50b9428e3ea215ba0c4e3e04fa79c3c18689534245b5d151bedb082166bcb574cb5698185a48cc5f9be7bce227d4a6c37cf
-
memory/800-114-0x0000000000470000-0x00000000004B7000-memory.dmpFilesize
284KB
-
memory/1000-115-0x0000000000400000-0x000000000044F000-memory.dmpFilesize
316KB
-
memory/1000-116-0x0000000000401480-mapping.dmp
-
memory/1000-117-0x0000000000400000-0x000000000044F000-memory.dmpFilesize
316KB
-
memory/1160-118-0x0000000000000000-mapping.dmp
-
memory/1368-121-0x0000000000000000-mapping.dmp