Analysis

  • max time kernel
    142s
  • max time network
    176s
  • platform
    windows7_x64
  • resource
    win7-en-20210920
  • submitted
    20-10-2021 08:39

General

  • Target

    mixsix_20211019-221317.exe

  • Size

    502KB

  • MD5

    52241b7a6707a79755e1386a26bce09c

  • SHA1

    bd2f102d6f10cde689835418f213db6b0713c2cd

  • SHA256

    0e01d2215e00c2a03a93b72a13476c588fbd383d4367e3d85265969e65dff388

  • SHA512

    b4f781a8344d9db9ba3ee6d54c9a2c614a3b0699c05f527b1cfd22775613c8f902eb95553b7f3a56b8a1b5b6b7715b0491159d8bcc9dc712129512551d65ea05

Malware Config

Extracted

Family

fickerstealer

C2

game2030.site:80

Extracted

Family

arkei

Botnet

Default

C2

http://gurums.online/ggate.php

Signatures

  • Arkei

    Arkei is an infostealer written in C++.

  • Fickerstealer

    Ficker is an infostealer written in Rust and ASM.

  • Arkei Stealer Payload 7 IoCs
  • Executes dropped EXE 3 IoCs
  • Loads dropped DLL 7 IoCs
  • Reads local data of messenger clients 2 TTPs

    Infostealers often target stored data of messaging applications, which can include saved credentials and account information.

  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext 1 IoCs
  • Program crash 1 IoCs
  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Modifies system certificate store 2 TTPs 6 IoCs
  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 36 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\mixsix_20211019-221317.exe
    "C:\Users\Admin\AppData\Local\Temp\mixsix_20211019-221317.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:1284
    • C:\Users\Admin\AppData\Local\Temp\mixsix_20211019-221317.exe
      "C:\Users\Admin\AppData\Local\Temp\mixsix_20211019-221317.exe"
      2⤵
      • Loads dropped DLL
      • Checks processor information in registry
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:940
      • C:\Users\Admin\AppData\Local\Temp\1634719242356.exe
        "C:\Users\Admin\AppData\Local\Temp\1634719242356.exe"
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Adds Run key to start application
        • Suspicious use of WriteProcessMemory
        PID:396
        • C:\Users\Admin\AppData\Roaming\HVYtube\hvytube.exe
          "C:\Users\Admin\AppData\Roaming\HVYtube\hvytube.exe"
          4⤵
          • Executes dropped EXE
          • Modifies system certificate store
          • Suspicious use of AdjustPrivilegeToken
          PID:1696
      • C:\Users\Admin\AppData\Local\Temp\1634719242434.exe
        "C:\Users\Admin\AppData\Local\Temp\1634719242434.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious use of WriteProcessMemory
        PID:1816
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 1816 -s 756
          4⤵
          • Loads dropped DLL
          • Program crash
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious behavior: GetForegroundWindowSpam
          • Suspicious use of AdjustPrivilegeToken
          PID:1312

Network

MITRE ATT&CK Matrix ATT&CK v6

Persistence

Registry Run Keys / Startup Folder

1
T1060

Defense Evasion

Modify Registry

2
T1112

Install Root Certificate

1
T1130

Credential Access

Credentials in Files

3
T1081

Discovery

Query Registry

2
T1012

System Information Discovery

1
T1082

Collection

Data from Local System

3
T1005

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\1634719242356.exe
    MD5

    07c4277b0278cafddb023934c154cc56

    SHA1

    8fc547689272aa2f26e5721264d4260caae499c0

    SHA256

    9d8a5319cffb73b9a8fd90118e60a6e3cf632c44bf754566c00cd02123efadd8

    SHA512

    21276a78dfe0316fa7212791110d42971d3a9c6981be2ab33ac078d40782c0c2584d9695c0280617884922f99cb9a13b6106b9d78f0e61cd84627e04c0c10678

  • C:\Users\Admin\AppData\Local\Temp\1634719242356.exe
    MD5

    07c4277b0278cafddb023934c154cc56

    SHA1

    8fc547689272aa2f26e5721264d4260caae499c0

    SHA256

    9d8a5319cffb73b9a8fd90118e60a6e3cf632c44bf754566c00cd02123efadd8

    SHA512

    21276a78dfe0316fa7212791110d42971d3a9c6981be2ab33ac078d40782c0c2584d9695c0280617884922f99cb9a13b6106b9d78f0e61cd84627e04c0c10678

  • C:\Users\Admin\AppData\Local\Temp\1634719242434.exe
    MD5

    4bb65548f890bed129c141c3c04fc8c4

    SHA1

    39257aa791e39dd40a79d1c33c35c30010a98e0d

    SHA256

    681dd3210d7550268f684628dd7946349ac3a97a6331c5567241a4caf4d7987c

    SHA512

    48cf64f34f25fb2bff641c54cc1a777c64f13890f0d4bb812758479ff876ae8a9d1edc6eb7da5ed0a1e5a22166bfe4366367d329bb65150d0430458447467587

  • C:\Users\Admin\AppData\Local\Temp\1634719242434.exe
    MD5

    4bb65548f890bed129c141c3c04fc8c4

    SHA1

    39257aa791e39dd40a79d1c33c35c30010a98e0d

    SHA256

    681dd3210d7550268f684628dd7946349ac3a97a6331c5567241a4caf4d7987c

    SHA512

    48cf64f34f25fb2bff641c54cc1a777c64f13890f0d4bb812758479ff876ae8a9d1edc6eb7da5ed0a1e5a22166bfe4366367d329bb65150d0430458447467587

  • C:\Users\Admin\AppData\Roaming\HVYtube\hvytube.exe
    MD5

    07c4277b0278cafddb023934c154cc56

    SHA1

    8fc547689272aa2f26e5721264d4260caae499c0

    SHA256

    9d8a5319cffb73b9a8fd90118e60a6e3cf632c44bf754566c00cd02123efadd8

    SHA512

    21276a78dfe0316fa7212791110d42971d3a9c6981be2ab33ac078d40782c0c2584d9695c0280617884922f99cb9a13b6106b9d78f0e61cd84627e04c0c10678

  • C:\Users\Admin\AppData\Roaming\HVYtube\hvytube.exe
    MD5

    07c4277b0278cafddb023934c154cc56

    SHA1

    8fc547689272aa2f26e5721264d4260caae499c0

    SHA256

    9d8a5319cffb73b9a8fd90118e60a6e3cf632c44bf754566c00cd02123efadd8

    SHA512

    21276a78dfe0316fa7212791110d42971d3a9c6981be2ab33ac078d40782c0c2584d9695c0280617884922f99cb9a13b6106b9d78f0e61cd84627e04c0c10678

  • \Users\Admin\AppData\Local\Temp\1634719242356.exe
    MD5

    07c4277b0278cafddb023934c154cc56

    SHA1

    8fc547689272aa2f26e5721264d4260caae499c0

    SHA256

    9d8a5319cffb73b9a8fd90118e60a6e3cf632c44bf754566c00cd02123efadd8

    SHA512

    21276a78dfe0316fa7212791110d42971d3a9c6981be2ab33ac078d40782c0c2584d9695c0280617884922f99cb9a13b6106b9d78f0e61cd84627e04c0c10678

  • \Users\Admin\AppData\Local\Temp\1634719242434.exe
    MD5

    4bb65548f890bed129c141c3c04fc8c4

    SHA1

    39257aa791e39dd40a79d1c33c35c30010a98e0d

    SHA256

    681dd3210d7550268f684628dd7946349ac3a97a6331c5567241a4caf4d7987c

    SHA512

    48cf64f34f25fb2bff641c54cc1a777c64f13890f0d4bb812758479ff876ae8a9d1edc6eb7da5ed0a1e5a22166bfe4366367d329bb65150d0430458447467587

  • \Users\Admin\AppData\Local\Temp\1634719242434.exe
    MD5

    4bb65548f890bed129c141c3c04fc8c4

    SHA1

    39257aa791e39dd40a79d1c33c35c30010a98e0d

    SHA256

    681dd3210d7550268f684628dd7946349ac3a97a6331c5567241a4caf4d7987c

    SHA512

    48cf64f34f25fb2bff641c54cc1a777c64f13890f0d4bb812758479ff876ae8a9d1edc6eb7da5ed0a1e5a22166bfe4366367d329bb65150d0430458447467587

  • \Users\Admin\AppData\Local\Temp\1634719242434.exe
    MD5

    4bb65548f890bed129c141c3c04fc8c4

    SHA1

    39257aa791e39dd40a79d1c33c35c30010a98e0d

    SHA256

    681dd3210d7550268f684628dd7946349ac3a97a6331c5567241a4caf4d7987c

    SHA512

    48cf64f34f25fb2bff641c54cc1a777c64f13890f0d4bb812758479ff876ae8a9d1edc6eb7da5ed0a1e5a22166bfe4366367d329bb65150d0430458447467587

  • \Users\Admin\AppData\Local\Temp\1634719242434.exe
    MD5

    4bb65548f890bed129c141c3c04fc8c4

    SHA1

    39257aa791e39dd40a79d1c33c35c30010a98e0d

    SHA256

    681dd3210d7550268f684628dd7946349ac3a97a6331c5567241a4caf4d7987c

    SHA512

    48cf64f34f25fb2bff641c54cc1a777c64f13890f0d4bb812758479ff876ae8a9d1edc6eb7da5ed0a1e5a22166bfe4366367d329bb65150d0430458447467587

  • \Users\Admin\AppData\Local\Temp\1634719242434.exe
    MD5

    4bb65548f890bed129c141c3c04fc8c4

    SHA1

    39257aa791e39dd40a79d1c33c35c30010a98e0d

    SHA256

    681dd3210d7550268f684628dd7946349ac3a97a6331c5567241a4caf4d7987c

    SHA512

    48cf64f34f25fb2bff641c54cc1a777c64f13890f0d4bb812758479ff876ae8a9d1edc6eb7da5ed0a1e5a22166bfe4366367d329bb65150d0430458447467587

  • \Users\Admin\AppData\Roaming\HVYtube\hvytube.exe
    MD5

    07c4277b0278cafddb023934c154cc56

    SHA1

    8fc547689272aa2f26e5721264d4260caae499c0

    SHA256

    9d8a5319cffb73b9a8fd90118e60a6e3cf632c44bf754566c00cd02123efadd8

    SHA512

    21276a78dfe0316fa7212791110d42971d3a9c6981be2ab33ac078d40782c0c2584d9695c0280617884922f99cb9a13b6106b9d78f0e61cd84627e04c0c10678

  • memory/396-60-0x0000000000000000-mapping.dmp
  • memory/396-68-0x0000000000C40000-0x0000000000C41000-memory.dmp
    Filesize

    4KB

  • memory/940-58-0x0000000000400000-0x000000000044F000-memory.dmp
    Filesize

    316KB

  • memory/940-56-0x00000000762D1000-0x00000000762D3000-memory.dmp
    Filesize

    8KB

  • memory/940-55-0x0000000000401480-mapping.dmp
  • memory/940-54-0x0000000000400000-0x000000000044F000-memory.dmp
    Filesize

    316KB

  • memory/1284-53-0x00000000030DD000-0x0000000003105000-memory.dmp
    Filesize

    160KB

  • memory/1284-57-0x0000000000250000-0x0000000000297000-memory.dmp
    Filesize

    284KB

  • memory/1312-70-0x0000000000000000-mapping.dmp
  • memory/1312-76-0x0000000000400000-0x000000000041B000-memory.dmp
    Filesize

    108KB

  • memory/1696-85-0x00000000004D0000-0x00000000004D6000-memory.dmp
    Filesize

    24KB

  • memory/1696-91-0x0000000002410000-0x0000000002411000-memory.dmp
    Filesize

    4KB

  • memory/1696-81-0x0000000000AD0000-0x0000000000AD1000-memory.dmp
    Filesize

    4KB

  • memory/1696-84-0x00000000004E0000-0x00000000004E1000-memory.dmp
    Filesize

    4KB

  • memory/1696-94-0x0000000005D40000-0x0000000005DE0000-memory.dmp
    Filesize

    640KB

  • memory/1696-86-0x0000000005370000-0x0000000005447000-memory.dmp
    Filesize

    860KB

  • memory/1696-87-0x0000000005980000-0x0000000005A3A000-memory.dmp
    Filesize

    744KB

  • memory/1696-88-0x0000000000A90000-0x0000000000A95000-memory.dmp
    Filesize

    20KB

  • memory/1696-89-0x0000000000AB0000-0x0000000000AB6000-memory.dmp
    Filesize

    24KB

  • memory/1696-90-0x0000000005B70000-0x0000000005BFF000-memory.dmp
    Filesize

    572KB

  • memory/1696-78-0x0000000000000000-mapping.dmp
  • memory/1696-92-0x00000000024A0000-0x00000000024A1000-memory.dmp
    Filesize

    4KB

  • memory/1696-93-0x0000000002490000-0x0000000002491000-memory.dmp
    Filesize

    4KB

  • memory/1816-64-0x0000000000000000-mapping.dmp