Analysis
-
max time kernel
100s -
max time network
104s -
platform
windows7_x64 -
resource
win7-en-20210920 -
submitted
26-09-2021 11:50
Static task
static1
Behavioral task
behavioral1
Sample
mixsix_20210924-083109.exe
Resource
win7-en-20210920
Behavioral task
behavioral2
Sample
mixsix_20210924-083109.exe
Resource
win10-en-20210920
General
-
Target
mixsix_20210924-083109.exe
-
Size
523KB
-
MD5
9b0e18017ea35c11d4e477028d8b862a
-
SHA1
3ae7f49984dc702af623d39af51a071fba37fd6b
-
SHA256
023e18099649da79f4edf0067b155f78effb978f2d4d9d9ff8d5cebcdd656cc1
-
SHA512
f94efa893f4cb55883a7a9fdb163fefaee5bf7fa8adcccd13ae6da4746564b73b5abc4994a089f0f3d14b0f44475ead7159b0dd42cbb69065429f1500e496763
Malware Config
Extracted
fickerstealer
game2030.site:80
Signatures
-
Fickerstealer
Ficker is an infostealer written in Rust and ASM.
-
Executes dropped EXE 2 IoCs
Processes:
1632657137050.exe1632657137081.exepid process 1152 1632657137050.exe 1408 1632657137081.exe -
Loads dropped DLL 2 IoCs
Processes:
mixsix_20210924-083109.exepid process 1056 mixsix_20210924-083109.exe 1056 mixsix_20210924-083109.exe -
Reads local data of messenger clients 2 TTPs
Infostealers often target stored data of messaging applications, which can include saved credentials and account information.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 3 api.ipify.org -
Suspicious use of SetThreadContext 1 IoCs
Processes:
mixsix_20210924-083109.exedescription pid process target process PID 1120 set thread context of 1056 1120 mixsix_20210924-083109.exe mixsix_20210924-083109.exe -
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
mixsix_20210924-083109.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 mixsix_20210924-083109.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString mixsix_20210924-083109.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
mixsix_20210924-083109.exepid process 1056 mixsix_20210924-083109.exe -
Suspicious use of WriteProcessMemory 28 IoCs
Processes:
mixsix_20210924-083109.exemixsix_20210924-083109.exedescription pid process target process PID 1120 wrote to memory of 1056 1120 mixsix_20210924-083109.exe mixsix_20210924-083109.exe PID 1120 wrote to memory of 1056 1120 mixsix_20210924-083109.exe mixsix_20210924-083109.exe PID 1120 wrote to memory of 1056 1120 mixsix_20210924-083109.exe mixsix_20210924-083109.exe PID 1120 wrote to memory of 1056 1120 mixsix_20210924-083109.exe mixsix_20210924-083109.exe PID 1120 wrote to memory of 1056 1120 mixsix_20210924-083109.exe mixsix_20210924-083109.exe PID 1120 wrote to memory of 1056 1120 mixsix_20210924-083109.exe mixsix_20210924-083109.exe PID 1120 wrote to memory of 1056 1120 mixsix_20210924-083109.exe mixsix_20210924-083109.exe PID 1120 wrote to memory of 1056 1120 mixsix_20210924-083109.exe mixsix_20210924-083109.exe PID 1120 wrote to memory of 1056 1120 mixsix_20210924-083109.exe mixsix_20210924-083109.exe PID 1120 wrote to memory of 1056 1120 mixsix_20210924-083109.exe mixsix_20210924-083109.exe PID 1120 wrote to memory of 1056 1120 mixsix_20210924-083109.exe mixsix_20210924-083109.exe PID 1120 wrote to memory of 1056 1120 mixsix_20210924-083109.exe mixsix_20210924-083109.exe PID 1120 wrote to memory of 1056 1120 mixsix_20210924-083109.exe mixsix_20210924-083109.exe PID 1120 wrote to memory of 1056 1120 mixsix_20210924-083109.exe mixsix_20210924-083109.exe PID 1120 wrote to memory of 1056 1120 mixsix_20210924-083109.exe mixsix_20210924-083109.exe PID 1120 wrote to memory of 1056 1120 mixsix_20210924-083109.exe mixsix_20210924-083109.exe PID 1120 wrote to memory of 1056 1120 mixsix_20210924-083109.exe mixsix_20210924-083109.exe PID 1120 wrote to memory of 1056 1120 mixsix_20210924-083109.exe mixsix_20210924-083109.exe PID 1120 wrote to memory of 1056 1120 mixsix_20210924-083109.exe mixsix_20210924-083109.exe PID 1120 wrote to memory of 1056 1120 mixsix_20210924-083109.exe mixsix_20210924-083109.exe PID 1056 wrote to memory of 1152 1056 mixsix_20210924-083109.exe 1632657137050.exe PID 1056 wrote to memory of 1152 1056 mixsix_20210924-083109.exe 1632657137050.exe PID 1056 wrote to memory of 1152 1056 mixsix_20210924-083109.exe 1632657137050.exe PID 1056 wrote to memory of 1152 1056 mixsix_20210924-083109.exe 1632657137050.exe PID 1056 wrote to memory of 1408 1056 mixsix_20210924-083109.exe 1632657137081.exe PID 1056 wrote to memory of 1408 1056 mixsix_20210924-083109.exe 1632657137081.exe PID 1056 wrote to memory of 1408 1056 mixsix_20210924-083109.exe 1632657137081.exe PID 1056 wrote to memory of 1408 1056 mixsix_20210924-083109.exe 1632657137081.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\mixsix_20210924-083109.exe"C:\Users\Admin\AppData\Local\Temp\mixsix_20210924-083109.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\mixsix_20210924-083109.exe"C:\Users\Admin\AppData\Local\Temp\mixsix_20210924-083109.exe"2⤵
- Loads dropped DLL
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\1632657137050.exe"C:\Users\Admin\AppData\Local\Temp\1632657137050.exe"3⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\1632657137081.exe"C:\Users\Admin\AppData\Local\Temp\1632657137081.exe"3⤵
- Executes dropped EXE
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\1632657137050.exeMD5
5c2239fc23f6fbf9255c028fd5a31c2d
SHA1838606011ef69960fe2a0092c8eaf8ce34ee908d
SHA25649913ed81ebc44a229799d68f33dcb018f56bec67bbf552166c52d0ddaa9a386
SHA512bf8c583254d1223fdd747cd51b9bbe26bbc2c39ed49c467f985944ba7530a6a0a4fe4d66f168c0f2ec3a45fd6a87f6fba70238345261a1baeae6b6981efa5de6
-
C:\Users\Admin\AppData\Local\Temp\1632657137081.exeMD5
f51ba78075a26eb83caca0d95bbe22c6
SHA102a40c1e3bf49040f959f1ee3e6f532453740fb8
SHA2568dc5ad841d1d047a8bd3b57727da647dd8e1548a3be6178f341438b97c0f28b9
SHA512c757126cb32ca7a8321668562b28c50b9428e3ea215ba0c4e3e04fa79c3c18689534245b5d151bedb082166bcb574cb5698185a48cc5f9be7bce227d4a6c37cf
-
\Users\Admin\AppData\Local\Temp\1632657137050.exeMD5
5c2239fc23f6fbf9255c028fd5a31c2d
SHA1838606011ef69960fe2a0092c8eaf8ce34ee908d
SHA25649913ed81ebc44a229799d68f33dcb018f56bec67bbf552166c52d0ddaa9a386
SHA512bf8c583254d1223fdd747cd51b9bbe26bbc2c39ed49c467f985944ba7530a6a0a4fe4d66f168c0f2ec3a45fd6a87f6fba70238345261a1baeae6b6981efa5de6
-
\Users\Admin\AppData\Local\Temp\1632657137081.exeMD5
f51ba78075a26eb83caca0d95bbe22c6
SHA102a40c1e3bf49040f959f1ee3e6f532453740fb8
SHA2568dc5ad841d1d047a8bd3b57727da647dd8e1548a3be6178f341438b97c0f28b9
SHA512c757126cb32ca7a8321668562b28c50b9428e3ea215ba0c4e3e04fa79c3c18689534245b5d151bedb082166bcb574cb5698185a48cc5f9be7bce227d4a6c37cf
-
memory/1056-55-0x0000000000401480-mapping.dmp
-
memory/1056-54-0x0000000000400000-0x000000000044F000-memory.dmpFilesize
316KB
-
memory/1056-56-0x0000000000400000-0x000000000044F000-memory.dmpFilesize
316KB
-
memory/1056-57-0x0000000076201000-0x0000000076203000-memory.dmpFilesize
8KB
-
memory/1120-53-0x0000000000220000-0x0000000000267000-memory.dmpFilesize
284KB
-
memory/1152-59-0x0000000000000000-mapping.dmp
-
memory/1408-62-0x0000000000000000-mapping.dmp