Analysis
-
max time kernel
166s -
max time network
177s -
platform
windows10-2004_x64 -
resource
win10v2004-20220414-en -
submitted
30-06-2022 23:23
General
-
Target
19b0486caa9d36d7a358a25fffc5c549e95ad922ec7068667744ffcd206b2539.exe
-
Size
3.2MB
-
MD5
00f73ae5d08c848ed4df5ca8e4a40133
-
SHA1
7c9fe77827aefc421887a02450133becc1049ef5
-
SHA256
19b0486caa9d36d7a358a25fffc5c549e95ad922ec7068667744ffcd206b2539
-
SHA512
2c5118a8648b94e551b2e9d63621f495b7dfac93bf2d5088c4813a7d73d5376c07c74cb350d1b99bfa41ea2c1ac8e3f7188569418aca6f03d8b7ea7c66b236be
Score
10/10
Malware Config
Extracted
Family
fickerstealer
C2
45.67.231.4:80
Signatures
-
Fickerstealer
Ficker is an infostealer written in Rust and ASM.
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
-
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
-
Themida packer 5 IoCs
Detects Themida, an advanced Windows software protection system.
-
Checks whether UAC is enabled 1 TTPs 1 IoCs
-
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\19b0486caa9d36d7a358a25fffc5c549e95ad922ec7068667744ffcd206b2539.exe"C:\Users\Admin\AppData\Local\Temp\19b0486caa9d36d7a358a25fffc5c549e95ad922ec7068667744ffcd206b2539.exe"1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
7.7MB
-
Filesize
1.6MB
-
Filesize
7.7MB
-
Filesize
7.7MB
-
Filesize
7.7MB
-
Filesize
7.7MB
-
Filesize
1.6MB