Analysis
-
max time kernel
8s -
max time network
12s -
platform
windows7_x64 -
resource
win7v20210408 -
submitted
26/04/2021, 11:11
Static task
static1
Behavioral task
behavioral1
Sample
E0F6D15001D810320BBE9614C9365CA6.exe
Resource
win7v20210408
Behavioral task
behavioral2
Sample
E0F6D15001D810320BBE9614C9365CA6.exe
Resource
win10v20210410
General
-
Target
E0F6D15001D810320BBE9614C9365CA6.exe
-
Size
373KB
-
MD5
e0f6d15001d810320bbe9614c9365ca6
-
SHA1
f589ae105a5b33e6fcca8afc7f8688652f7c5392
-
SHA256
f009a71cf1050cc8c50a9b1accf3e28f174e75eda5f5ebb4764d90baa443aa9c
-
SHA512
326e3f70cea545a3d0a1cc98d8feb9656ad0bfd39c8d36716a7fd7a4e65feeca57bea71d26e7c3e122af45b0ee95e5a87206f46a9942c5115b74fe2f94db985b
Malware Config
Extracted
fickerstealer
sodaandcoke.top:80
Signatures
-
fickerstealer
Ficker is an infostealer written in Rust and ASM.
-
Reads local data of messenger clients 2 TTPs
Infostealers often target stored data of messaging applications, which can include saved credentials and account information.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 6 api.ipify.org -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 1652 set thread context of 1228 1652 E0F6D15001D810320BBE9614C9365CA6.exe 26 -
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 E0F6D15001D810320BBE9614C9365CA6.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString E0F6D15001D810320BBE9614C9365CA6.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 1228 E0F6D15001D810320BBE9614C9365CA6.exe -
Suspicious use of WriteProcessMemory 14 IoCs
description pid Process procid_target PID 1652 wrote to memory of 1228 1652 E0F6D15001D810320BBE9614C9365CA6.exe 26 PID 1652 wrote to memory of 1228 1652 E0F6D15001D810320BBE9614C9365CA6.exe 26 PID 1652 wrote to memory of 1228 1652 E0F6D15001D810320BBE9614C9365CA6.exe 26 PID 1652 wrote to memory of 1228 1652 E0F6D15001D810320BBE9614C9365CA6.exe 26 PID 1652 wrote to memory of 1228 1652 E0F6D15001D810320BBE9614C9365CA6.exe 26 PID 1652 wrote to memory of 1228 1652 E0F6D15001D810320BBE9614C9365CA6.exe 26 PID 1652 wrote to memory of 1228 1652 E0F6D15001D810320BBE9614C9365CA6.exe 26 PID 1652 wrote to memory of 1228 1652 E0F6D15001D810320BBE9614C9365CA6.exe 26 PID 1652 wrote to memory of 1228 1652 E0F6D15001D810320BBE9614C9365CA6.exe 26 PID 1652 wrote to memory of 1228 1652 E0F6D15001D810320BBE9614C9365CA6.exe 26 PID 1652 wrote to memory of 1228 1652 E0F6D15001D810320BBE9614C9365CA6.exe 26 PID 1652 wrote to memory of 1228 1652 E0F6D15001D810320BBE9614C9365CA6.exe 26 PID 1652 wrote to memory of 1228 1652 E0F6D15001D810320BBE9614C9365CA6.exe 26 PID 1652 wrote to memory of 1228 1652 E0F6D15001D810320BBE9614C9365CA6.exe 26
Processes
-
C:\Users\Admin\AppData\Local\Temp\E0F6D15001D810320BBE9614C9365CA6.exe"C:\Users\Admin\AppData\Local\Temp\E0F6D15001D810320BBE9614C9365CA6.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1652 -
C:\Users\Admin\AppData\Local\Temp\E0F6D15001D810320BBE9614C9365CA6.exe"C:\Users\Admin\AppData\Local\Temp\E0F6D15001D810320BBE9614C9365CA6.exe"2⤵
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
PID:1228
-