fickerstealer | 02a07e2a25d19de8006fced52daaf0a5d179a46468755609b3a2254095342faf

General

Target

02a07e2a25d19de8006fced52daaf0a5d179a46468755609b3a2254095342faf.exe
Size

286KB
MD5

b80869baf5276044cf97ed3170871e65
SHA1

31438e0c5b6d93ecc48a7c8c8bcae8d0b883da00
SHA256

02a07e2a25d19de8006fced52daaf0a5d179a46468755609b3a2254095342faf
SHA512

4c71f791a6640700e822d60fcc9d3b224c2ced41cd762aec97177916e7f77481910918ab5637f2e59592d28babd4b64ed7ed91e0945b7395b8965185bc48cf12

Score

10^/10

fickerstealer infostealer

Malware Config

Extracted

Family

fickerstealer

C2

lukkeze.space:80

Signatures

Fickerstealer
Ficker is an infostealer written in Rust and ASM.
infostealer fickerstealer

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow	ioc
4	api.ipify.org

Suspicious use of SetThreadContext 1 IoCs

Processes:

02a07e2a25d19de8006fced52daaf0a5d179a46468755609b3a2254095342faf.exe

description	pid	Process	procid_target
PID 1700 set thread context of 1780	1700	02a07e2a25d19de8006fced52daaf0a5d179a46468755609b3a2254095342faf.exe	28

Suspicious use of WriteProcessMemory 14 IoCs

Processes:

02a07e2a25d19de8006fced52daaf0a5d179a46468755609b3a2254095342faf.exe

description	pid	Process	procid_target
PID 1700 wrote to memory of 1780	1700	02a07e2a25d19de8006fced52daaf0a5d179a46468755609b3a2254095342faf.exe	28
PID 1700 wrote to memory of 1780	1700	02a07e2a25d19de8006fced52daaf0a5d179a46468755609b3a2254095342faf.exe	28
PID 1700 wrote to memory of 1780	1700	02a07e2a25d19de8006fced52daaf0a5d179a46468755609b3a2254095342faf.exe	28
PID 1700 wrote to memory of 1780	1700	02a07e2a25d19de8006fced52daaf0a5d179a46468755609b3a2254095342faf.exe	28
PID 1700 wrote to memory of 1780	1700	02a07e2a25d19de8006fced52daaf0a5d179a46468755609b3a2254095342faf.exe	28
PID 1700 wrote to memory of 1780	1700	02a07e2a25d19de8006fced52daaf0a5d179a46468755609b3a2254095342faf.exe	28
PID 1700 wrote to memory of 1780	1700	02a07e2a25d19de8006fced52daaf0a5d179a46468755609b3a2254095342faf.exe	28
PID 1700 wrote to memory of 1780	1700	02a07e2a25d19de8006fced52daaf0a5d179a46468755609b3a2254095342faf.exe	28
PID 1700 wrote to memory of 1780	1700	02a07e2a25d19de8006fced52daaf0a5d179a46468755609b3a2254095342faf.exe	28
PID 1700 wrote to memory of 1780	1700	02a07e2a25d19de8006fced52daaf0a5d179a46468755609b3a2254095342faf.exe	28
PID 1700 wrote to memory of 1780	1700	02a07e2a25d19de8006fced52daaf0a5d179a46468755609b3a2254095342faf.exe	28
PID 1700 wrote to memory of 1780	1700	02a07e2a25d19de8006fced52daaf0a5d179a46468755609b3a2254095342faf.exe	28
PID 1700 wrote to memory of 1780	1700	02a07e2a25d19de8006fced52daaf0a5d179a46468755609b3a2254095342faf.exe	28
PID 1700 wrote to memory of 1780	1700	02a07e2a25d19de8006fced52daaf0a5d179a46468755609b3a2254095342faf.exe	28

C:\Users\Admin\AppData\Local\Temp\02a07e2a25d19de8006fced52daaf0a5d179a46468755609b3a2254095342faf.exe
"C:\Users\Admin\AppData\Local\Temp\02a07e2a25d19de8006fced52daaf0a5d179a46468755609b3a2254095342faf.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1700
- C:\Users\Admin\AppData\Local\Temp\02a07e2a25d19de8006fced52daaf0a5d179a46468755609b3a2254095342faf.exe
  "C:\Users\Admin\AppData\Local\Temp\02a07e2a25d19de8006fced52daaf0a5d179a46468755609b3a2254095342faf.exe"
  2⤵
  PID:1780

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1700-57-0x00000000002EB000-0x0000000000312000-memory.dmp

Filesize
156KB

Download
memory/1700-58-0x0000000000280000-0x00000000002C4000-memory.dmp

Filesize
272KB

Download
memory/1780-54-0x0000000000400000-0x0000000000448000-memory.dmp

Filesize
288KB

Download
memory/1780-55-0x0000000000401480-mapping.dmp

Download
memory/1780-59-0x0000000000400000-0x0000000000448000-memory.dmp

Filesize
288KB

Download
memory/1780-60-0x0000000076171000-0x0000000076173000-memory.dmp

Filesize
8KB

Download
memory/1780-61-0x0000000000400000-0x0000000000448000-memory.dmp

Filesize
288KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads