Analysis
-
max time kernel
66s -
max time network
38s -
platform
windows7_x64 -
resource
win7-en-20210920 -
submitted
26-09-2021 11:50
Static task
static1
Behavioral task
behavioral1
Sample
mixsix_20210924-233459.exe
Resource
win7-en-20210920
Behavioral task
behavioral2
Sample
mixsix_20210924-233459.exe
Resource
win10v20210408
General
-
Target
mixsix_20210924-233459.exe
-
Size
526KB
-
MD5
5f6fa8274dfa727362e6bfe5953bdc4a
-
SHA1
a9ab2ea1e972988f4d2d47a5b82138d2e16d0e8c
-
SHA256
9eb11a49b41fd31e9307d8d395dbd536e885378a107c57c61427adf93faae4df
-
SHA512
8e9c93df405bb22f21c9ed979dd86fcede363270a40ea19fb396c821040c6f443d9a48a9b474c33e5883a9f3a46d3569b7fd4688fde680d58b7e6207ec595a1d
Malware Config
Extracted
fickerstealer
game2030.site:80
Signatures
-
Fickerstealer
Ficker is an infostealer written in Rust and ASM.
-
suricata: ET MALWARE Win32/Ficker Stealer Activity M3
suricata: ET MALWARE Win32/Ficker Stealer Activity M3
-
Executes dropped EXE 2 IoCs
Processes:
1632657042128.exe1632657042175.exepid process 524 1632657042128.exe 772 1632657042175.exe -
Loads dropped DLL 2 IoCs
Processes:
mixsix_20210924-233459.exepid process 1428 mixsix_20210924-233459.exe 1428 mixsix_20210924-233459.exe -
Reads local data of messenger clients 2 TTPs
Infostealers often target stored data of messaging applications, which can include saved credentials and account information.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 3 api.ipify.org -
Suspicious use of SetThreadContext 1 IoCs
Processes:
mixsix_20210924-233459.exedescription pid process target process PID 1652 set thread context of 1428 1652 mixsix_20210924-233459.exe mixsix_20210924-233459.exe -
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
mixsix_20210924-233459.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 mixsix_20210924-233459.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString mixsix_20210924-233459.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
mixsix_20210924-233459.exepid process 1428 mixsix_20210924-233459.exe -
Suspicious use of WriteProcessMemory 28 IoCs
Processes:
mixsix_20210924-233459.exemixsix_20210924-233459.exedescription pid process target process PID 1652 wrote to memory of 1428 1652 mixsix_20210924-233459.exe mixsix_20210924-233459.exe PID 1652 wrote to memory of 1428 1652 mixsix_20210924-233459.exe mixsix_20210924-233459.exe PID 1652 wrote to memory of 1428 1652 mixsix_20210924-233459.exe mixsix_20210924-233459.exe PID 1652 wrote to memory of 1428 1652 mixsix_20210924-233459.exe mixsix_20210924-233459.exe PID 1652 wrote to memory of 1428 1652 mixsix_20210924-233459.exe mixsix_20210924-233459.exe PID 1652 wrote to memory of 1428 1652 mixsix_20210924-233459.exe mixsix_20210924-233459.exe PID 1652 wrote to memory of 1428 1652 mixsix_20210924-233459.exe mixsix_20210924-233459.exe PID 1652 wrote to memory of 1428 1652 mixsix_20210924-233459.exe mixsix_20210924-233459.exe PID 1652 wrote to memory of 1428 1652 mixsix_20210924-233459.exe mixsix_20210924-233459.exe PID 1652 wrote to memory of 1428 1652 mixsix_20210924-233459.exe mixsix_20210924-233459.exe PID 1652 wrote to memory of 1428 1652 mixsix_20210924-233459.exe mixsix_20210924-233459.exe PID 1652 wrote to memory of 1428 1652 mixsix_20210924-233459.exe mixsix_20210924-233459.exe PID 1652 wrote to memory of 1428 1652 mixsix_20210924-233459.exe mixsix_20210924-233459.exe PID 1652 wrote to memory of 1428 1652 mixsix_20210924-233459.exe mixsix_20210924-233459.exe PID 1652 wrote to memory of 1428 1652 mixsix_20210924-233459.exe mixsix_20210924-233459.exe PID 1652 wrote to memory of 1428 1652 mixsix_20210924-233459.exe mixsix_20210924-233459.exe PID 1652 wrote to memory of 1428 1652 mixsix_20210924-233459.exe mixsix_20210924-233459.exe PID 1652 wrote to memory of 1428 1652 mixsix_20210924-233459.exe mixsix_20210924-233459.exe PID 1652 wrote to memory of 1428 1652 mixsix_20210924-233459.exe mixsix_20210924-233459.exe PID 1652 wrote to memory of 1428 1652 mixsix_20210924-233459.exe mixsix_20210924-233459.exe PID 1428 wrote to memory of 524 1428 mixsix_20210924-233459.exe 1632657042128.exe PID 1428 wrote to memory of 524 1428 mixsix_20210924-233459.exe 1632657042128.exe PID 1428 wrote to memory of 524 1428 mixsix_20210924-233459.exe 1632657042128.exe PID 1428 wrote to memory of 524 1428 mixsix_20210924-233459.exe 1632657042128.exe PID 1428 wrote to memory of 772 1428 mixsix_20210924-233459.exe 1632657042175.exe PID 1428 wrote to memory of 772 1428 mixsix_20210924-233459.exe 1632657042175.exe PID 1428 wrote to memory of 772 1428 mixsix_20210924-233459.exe 1632657042175.exe PID 1428 wrote to memory of 772 1428 mixsix_20210924-233459.exe 1632657042175.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\mixsix_20210924-233459.exe"C:\Users\Admin\AppData\Local\Temp\mixsix_20210924-233459.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\mixsix_20210924-233459.exe"C:\Users\Admin\AppData\Local\Temp\mixsix_20210924-233459.exe"2⤵
- Loads dropped DLL
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\1632657042128.exe"C:\Users\Admin\AppData\Local\Temp\1632657042128.exe"3⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\1632657042175.exe"C:\Users\Admin\AppData\Local\Temp\1632657042175.exe"3⤵
- Executes dropped EXE
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\1632657042128.exeMD5
5c2239fc23f6fbf9255c028fd5a31c2d
SHA1838606011ef69960fe2a0092c8eaf8ce34ee908d
SHA25649913ed81ebc44a229799d68f33dcb018f56bec67bbf552166c52d0ddaa9a386
SHA512bf8c583254d1223fdd747cd51b9bbe26bbc2c39ed49c467f985944ba7530a6a0a4fe4d66f168c0f2ec3a45fd6a87f6fba70238345261a1baeae6b6981efa5de6
-
C:\Users\Admin\AppData\Local\Temp\1632657042175.exeMD5
f51ba78075a26eb83caca0d95bbe22c6
SHA102a40c1e3bf49040f959f1ee3e6f532453740fb8
SHA2568dc5ad841d1d047a8bd3b57727da647dd8e1548a3be6178f341438b97c0f28b9
SHA512c757126cb32ca7a8321668562b28c50b9428e3ea215ba0c4e3e04fa79c3c18689534245b5d151bedb082166bcb574cb5698185a48cc5f9be7bce227d4a6c37cf
-
\Users\Admin\AppData\Local\Temp\1632657042128.exeMD5
5c2239fc23f6fbf9255c028fd5a31c2d
SHA1838606011ef69960fe2a0092c8eaf8ce34ee908d
SHA25649913ed81ebc44a229799d68f33dcb018f56bec67bbf552166c52d0ddaa9a386
SHA512bf8c583254d1223fdd747cd51b9bbe26bbc2c39ed49c467f985944ba7530a6a0a4fe4d66f168c0f2ec3a45fd6a87f6fba70238345261a1baeae6b6981efa5de6
-
\Users\Admin\AppData\Local\Temp\1632657042175.exeMD5
f51ba78075a26eb83caca0d95bbe22c6
SHA102a40c1e3bf49040f959f1ee3e6f532453740fb8
SHA2568dc5ad841d1d047a8bd3b57727da647dd8e1548a3be6178f341438b97c0f28b9
SHA512c757126cb32ca7a8321668562b28c50b9428e3ea215ba0c4e3e04fa79c3c18689534245b5d151bedb082166bcb574cb5698185a48cc5f9be7bce227d4a6c37cf
-
memory/524-59-0x0000000000000000-mapping.dmp
-
memory/772-62-0x0000000000000000-mapping.dmp
-
memory/1428-53-0x0000000000400000-0x000000000044F000-memory.dmpFilesize
316KB
-
memory/1428-54-0x0000000000401480-mapping.dmp
-
memory/1428-56-0x0000000074C71000-0x0000000074C73000-memory.dmpFilesize
8KB
-
memory/1428-57-0x0000000000400000-0x000000000044F000-memory.dmpFilesize
316KB
-
memory/1652-55-0x0000000000320000-0x0000000000367000-memory.dmpFilesize
284KB