Analysis
-
max time kernel
68s -
max time network
76s -
platform
windows10_x64 -
resource
win10v20210408 -
submitted
26-09-2021 11:49
Static task
static1
Behavioral task
behavioral1
Sample
mixsix_20210923-211536.exe
Resource
win7-en-20210920
Behavioral task
behavioral2
Sample
mixsix_20210923-211536.exe
Resource
win10v20210408
General
-
Target
mixsix_20210923-211536.exe
-
Size
417KB
-
MD5
a937ce43a1cbe405544f255153f9bda6
-
SHA1
14358ce9df442d6eed62ca39b448fedea0e7f47a
-
SHA256
dacaa38c51cbe462d5a0a5a45b78806243e3e73019749327cad03ec95ecc03b9
-
SHA512
c9f8ba72fa6b93e1daa3c3d052ef99aa9e10973620b73e5b37242c1017e50ef24488e58d7c6359ca84a9f794faa6b7bb4a73a345aaa5820795c0477161c4d3bf
Malware Config
Extracted
fickerstealer
game2030.site:80
Signatures
-
Fickerstealer
Ficker is an infostealer written in Rust and ASM.
-
suricata: ET MALWARE Win32/Ficker Stealer Activity M3
suricata: ET MALWARE Win32/Ficker Stealer Activity M3
-
Executes dropped EXE 2 IoCs
Processes:
1632664281986.exe1632664282299.exepid process 756 1632664281986.exe 3176 1632664282299.exe -
Reads local data of messenger clients 2 TTPs
Infostealers often target stored data of messaging applications, which can include saved credentials and account information.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 4 api.ipify.org -
Suspicious use of SetThreadContext 1 IoCs
Processes:
mixsix_20210923-211536.exedescription pid process target process PID 636 set thread context of 816 636 mixsix_20210923-211536.exe mixsix_20210923-211536.exe -
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
mixsix_20210923-211536.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 mixsix_20210923-211536.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString mixsix_20210923-211536.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
mixsix_20210923-211536.exepid process 816 mixsix_20210923-211536.exe 816 mixsix_20210923-211536.exe -
Suspicious use of WriteProcessMemory 25 IoCs
Processes:
mixsix_20210923-211536.exemixsix_20210923-211536.exedescription pid process target process PID 636 wrote to memory of 816 636 mixsix_20210923-211536.exe mixsix_20210923-211536.exe PID 636 wrote to memory of 816 636 mixsix_20210923-211536.exe mixsix_20210923-211536.exe PID 636 wrote to memory of 816 636 mixsix_20210923-211536.exe mixsix_20210923-211536.exe PID 636 wrote to memory of 816 636 mixsix_20210923-211536.exe mixsix_20210923-211536.exe PID 636 wrote to memory of 816 636 mixsix_20210923-211536.exe mixsix_20210923-211536.exe PID 636 wrote to memory of 816 636 mixsix_20210923-211536.exe mixsix_20210923-211536.exe PID 636 wrote to memory of 816 636 mixsix_20210923-211536.exe mixsix_20210923-211536.exe PID 636 wrote to memory of 816 636 mixsix_20210923-211536.exe mixsix_20210923-211536.exe PID 636 wrote to memory of 816 636 mixsix_20210923-211536.exe mixsix_20210923-211536.exe PID 636 wrote to memory of 816 636 mixsix_20210923-211536.exe mixsix_20210923-211536.exe PID 636 wrote to memory of 816 636 mixsix_20210923-211536.exe mixsix_20210923-211536.exe PID 636 wrote to memory of 816 636 mixsix_20210923-211536.exe mixsix_20210923-211536.exe PID 636 wrote to memory of 816 636 mixsix_20210923-211536.exe mixsix_20210923-211536.exe PID 636 wrote to memory of 816 636 mixsix_20210923-211536.exe mixsix_20210923-211536.exe PID 636 wrote to memory of 816 636 mixsix_20210923-211536.exe mixsix_20210923-211536.exe PID 636 wrote to memory of 816 636 mixsix_20210923-211536.exe mixsix_20210923-211536.exe PID 636 wrote to memory of 816 636 mixsix_20210923-211536.exe mixsix_20210923-211536.exe PID 636 wrote to memory of 816 636 mixsix_20210923-211536.exe mixsix_20210923-211536.exe PID 636 wrote to memory of 816 636 mixsix_20210923-211536.exe mixsix_20210923-211536.exe PID 816 wrote to memory of 756 816 mixsix_20210923-211536.exe 1632664281986.exe PID 816 wrote to memory of 756 816 mixsix_20210923-211536.exe 1632664281986.exe PID 816 wrote to memory of 756 816 mixsix_20210923-211536.exe 1632664281986.exe PID 816 wrote to memory of 3176 816 mixsix_20210923-211536.exe 1632664282299.exe PID 816 wrote to memory of 3176 816 mixsix_20210923-211536.exe 1632664282299.exe PID 816 wrote to memory of 3176 816 mixsix_20210923-211536.exe 1632664282299.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\mixsix_20210923-211536.exe"C:\Users\Admin\AppData\Local\Temp\mixsix_20210923-211536.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\mixsix_20210923-211536.exe"C:\Users\Admin\AppData\Local\Temp\mixsix_20210923-211536.exe"2⤵
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\1632664281986.exe"C:\Users\Admin\AppData\Local\Temp\1632664281986.exe"3⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\1632664282299.exe"C:\Users\Admin\AppData\Local\Temp\1632664282299.exe"3⤵
- Executes dropped EXE
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\1632664281986.exeMD5
5c2239fc23f6fbf9255c028fd5a31c2d
SHA1838606011ef69960fe2a0092c8eaf8ce34ee908d
SHA25649913ed81ebc44a229799d68f33dcb018f56bec67bbf552166c52d0ddaa9a386
SHA512bf8c583254d1223fdd747cd51b9bbe26bbc2c39ed49c467f985944ba7530a6a0a4fe4d66f168c0f2ec3a45fd6a87f6fba70238345261a1baeae6b6981efa5de6
-
C:\Users\Admin\AppData\Local\Temp\1632664281986.exeMD5
5c2239fc23f6fbf9255c028fd5a31c2d
SHA1838606011ef69960fe2a0092c8eaf8ce34ee908d
SHA25649913ed81ebc44a229799d68f33dcb018f56bec67bbf552166c52d0ddaa9a386
SHA512bf8c583254d1223fdd747cd51b9bbe26bbc2c39ed49c467f985944ba7530a6a0a4fe4d66f168c0f2ec3a45fd6a87f6fba70238345261a1baeae6b6981efa5de6
-
C:\Users\Admin\AppData\Local\Temp\1632664282299.exeMD5
f51ba78075a26eb83caca0d95bbe22c6
SHA102a40c1e3bf49040f959f1ee3e6f532453740fb8
SHA2568dc5ad841d1d047a8bd3b57727da647dd8e1548a3be6178f341438b97c0f28b9
SHA512c757126cb32ca7a8321668562b28c50b9428e3ea215ba0c4e3e04fa79c3c18689534245b5d151bedb082166bcb574cb5698185a48cc5f9be7bce227d4a6c37cf
-
C:\Users\Admin\AppData\Local\Temp\1632664282299.exeMD5
f51ba78075a26eb83caca0d95bbe22c6
SHA102a40c1e3bf49040f959f1ee3e6f532453740fb8
SHA2568dc5ad841d1d047a8bd3b57727da647dd8e1548a3be6178f341438b97c0f28b9
SHA512c757126cb32ca7a8321668562b28c50b9428e3ea215ba0c4e3e04fa79c3c18689534245b5d151bedb082166bcb574cb5698185a48cc5f9be7bce227d4a6c37cf
-
memory/636-114-0x0000000002220000-0x0000000002267000-memory.dmpFilesize
284KB
-
memory/756-118-0x0000000000000000-mapping.dmp
-
memory/816-115-0x0000000000400000-0x000000000044F000-memory.dmpFilesize
316KB
-
memory/816-116-0x0000000000401480-mapping.dmp
-
memory/816-117-0x0000000000400000-0x000000000044F000-memory.dmpFilesize
316KB
-
memory/3176-121-0x0000000000000000-mapping.dmp