Analysis
-
max time kernel
122s -
max time network
124s -
platform
windows7_x64 -
resource
win7v20210410 -
submitted
26/04/2021, 02:01
Static task
static1
Behavioral task
behavioral1
Sample
A35D2504DBA401C8E94437C954BE3DDD.exe
Resource
win7v20210410
Behavioral task
behavioral2
Sample
A35D2504DBA401C8E94437C954BE3DDD.exe
Resource
win10v20210410
General
-
Target
A35D2504DBA401C8E94437C954BE3DDD.exe
-
Size
376KB
-
MD5
a35d2504dba401c8e94437c954be3ddd
-
SHA1
4471c9d722c885713b5ff9e7c8fb6a6e5445f335
-
SHA256
401496db5cb4df2d72b8586fee87a4ff4b1745e8658e58a8fab87d4e7f346666
-
SHA512
4de1c8717d49292bd8c3d22627ad15d55c0c37784beb2d32d8c03db4c57c8e4db3e8206937abb0aa98b5055c5b7b8a723c5c15b2ca3e66b51eaae9ac2029dfda
Malware Config
Extracted
fickerstealer
sodaandcoke.top:80
Signatures
-
fickerstealer
Ficker is an infostealer written in Rust and ASM.
-
Reads local data of messenger clients 2 TTPs
Infostealers often target stored data of messaging applications, which can include saved credentials and account information.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 6 api.ipify.org -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 1888 set thread context of 1984 1888 A35D2504DBA401C8E94437C954BE3DDD.exe 26 -
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 A35D2504DBA401C8E94437C954BE3DDD.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString A35D2504DBA401C8E94437C954BE3DDD.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 1984 A35D2504DBA401C8E94437C954BE3DDD.exe -
Suspicious use of WriteProcessMemory 14 IoCs
description pid Process procid_target PID 1888 wrote to memory of 1984 1888 A35D2504DBA401C8E94437C954BE3DDD.exe 26 PID 1888 wrote to memory of 1984 1888 A35D2504DBA401C8E94437C954BE3DDD.exe 26 PID 1888 wrote to memory of 1984 1888 A35D2504DBA401C8E94437C954BE3DDD.exe 26 PID 1888 wrote to memory of 1984 1888 A35D2504DBA401C8E94437C954BE3DDD.exe 26 PID 1888 wrote to memory of 1984 1888 A35D2504DBA401C8E94437C954BE3DDD.exe 26 PID 1888 wrote to memory of 1984 1888 A35D2504DBA401C8E94437C954BE3DDD.exe 26 PID 1888 wrote to memory of 1984 1888 A35D2504DBA401C8E94437C954BE3DDD.exe 26 PID 1888 wrote to memory of 1984 1888 A35D2504DBA401C8E94437C954BE3DDD.exe 26 PID 1888 wrote to memory of 1984 1888 A35D2504DBA401C8E94437C954BE3DDD.exe 26 PID 1888 wrote to memory of 1984 1888 A35D2504DBA401C8E94437C954BE3DDD.exe 26 PID 1888 wrote to memory of 1984 1888 A35D2504DBA401C8E94437C954BE3DDD.exe 26 PID 1888 wrote to memory of 1984 1888 A35D2504DBA401C8E94437C954BE3DDD.exe 26 PID 1888 wrote to memory of 1984 1888 A35D2504DBA401C8E94437C954BE3DDD.exe 26 PID 1888 wrote to memory of 1984 1888 A35D2504DBA401C8E94437C954BE3DDD.exe 26
Processes
-
C:\Users\Admin\AppData\Local\Temp\A35D2504DBA401C8E94437C954BE3DDD.exe"C:\Users\Admin\AppData\Local\Temp\A35D2504DBA401C8E94437C954BE3DDD.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1888 -
C:\Users\Admin\AppData\Local\Temp\A35D2504DBA401C8E94437C954BE3DDD.exe"C:\Users\Admin\AppData\Local\Temp\A35D2504DBA401C8E94437C954BE3DDD.exe"2⤵
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
PID:1984
-