Analysis
-
max time kernel
13s -
max time network
110s -
platform
windows10_x64 -
resource
win10v20210410 -
submitted
26/04/2021, 11:11
Static task
static1
Behavioral task
behavioral1
Sample
E0F6D15001D810320BBE9614C9365CA6.exe
Resource
win7v20210408
Behavioral task
behavioral2
Sample
E0F6D15001D810320BBE9614C9365CA6.exe
Resource
win10v20210410
General
-
Target
E0F6D15001D810320BBE9614C9365CA6.exe
-
Size
373KB
-
MD5
e0f6d15001d810320bbe9614c9365ca6
-
SHA1
f589ae105a5b33e6fcca8afc7f8688652f7c5392
-
SHA256
f009a71cf1050cc8c50a9b1accf3e28f174e75eda5f5ebb4764d90baa443aa9c
-
SHA512
326e3f70cea545a3d0a1cc98d8feb9656ad0bfd39c8d36716a7fd7a4e65feeca57bea71d26e7c3e122af45b0ee95e5a87206f46a9942c5115b74fe2f94db985b
Malware Config
Extracted
fickerstealer
sodaandcoke.top:80
Signatures
-
fickerstealer
Ficker is an infostealer written in Rust and ASM.
-
Reads local data of messenger clients 2 TTPs
Infostealers often target stored data of messaging applications, which can include saved credentials and account information.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 7 api.ipify.org -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 4044 set thread context of 1468 4044 E0F6D15001D810320BBE9614C9365CA6.exe 75 -
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString E0F6D15001D810320BBE9614C9365CA6.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 E0F6D15001D810320BBE9614C9365CA6.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 1468 E0F6D15001D810320BBE9614C9365CA6.exe 1468 E0F6D15001D810320BBE9614C9365CA6.exe -
Suspicious use of WriteProcessMemory 13 IoCs
description pid Process procid_target PID 4044 wrote to memory of 1468 4044 E0F6D15001D810320BBE9614C9365CA6.exe 75 PID 4044 wrote to memory of 1468 4044 E0F6D15001D810320BBE9614C9365CA6.exe 75 PID 4044 wrote to memory of 1468 4044 E0F6D15001D810320BBE9614C9365CA6.exe 75 PID 4044 wrote to memory of 1468 4044 E0F6D15001D810320BBE9614C9365CA6.exe 75 PID 4044 wrote to memory of 1468 4044 E0F6D15001D810320BBE9614C9365CA6.exe 75 PID 4044 wrote to memory of 1468 4044 E0F6D15001D810320BBE9614C9365CA6.exe 75 PID 4044 wrote to memory of 1468 4044 E0F6D15001D810320BBE9614C9365CA6.exe 75 PID 4044 wrote to memory of 1468 4044 E0F6D15001D810320BBE9614C9365CA6.exe 75 PID 4044 wrote to memory of 1468 4044 E0F6D15001D810320BBE9614C9365CA6.exe 75 PID 4044 wrote to memory of 1468 4044 E0F6D15001D810320BBE9614C9365CA6.exe 75 PID 4044 wrote to memory of 1468 4044 E0F6D15001D810320BBE9614C9365CA6.exe 75 PID 4044 wrote to memory of 1468 4044 E0F6D15001D810320BBE9614C9365CA6.exe 75 PID 4044 wrote to memory of 1468 4044 E0F6D15001D810320BBE9614C9365CA6.exe 75
Processes
-
C:\Users\Admin\AppData\Local\Temp\E0F6D15001D810320BBE9614C9365CA6.exe"C:\Users\Admin\AppData\Local\Temp\E0F6D15001D810320BBE9614C9365CA6.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4044 -
C:\Users\Admin\AppData\Local\Temp\E0F6D15001D810320BBE9614C9365CA6.exe"C:\Users\Admin\AppData\Local\Temp\E0F6D15001D810320BBE9614C9365CA6.exe"2⤵
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
PID:1468
-