fickerstealer | d4310e308bf2485379ae0e77aebea5c7e102059679c46cc6e0f2839204595573

General

Target

d4310e308bf2485379ae0e77aebea5c7e102059679c46cc6e0f2839204595573.exe
Size

339KB
MD5

de7ff305608959256b33926403b6d934
SHA1

cdd7a11a5f8bcd7b90af6f8f3b3c0cb566e06bd8
SHA256

d4310e308bf2485379ae0e77aebea5c7e102059679c46cc6e0f2839204595573
SHA512

70d3c5d8928bc1a5580b189344d6b457f05a0cd1c84a8fa9e271b4c7a14869078c45475bf6c5e826a50ba16d8016c2ca5b565d95ed239ef083dbae0690270bbc

Score

10^/10

fickerstealer infostealer upx

Malware Config

Extracted

Family

fickerstealer

C2

93.114.128.19:80

Signatures

Fickerstealer
Ficker is an infostealer written in Rust and ASM.
infostealer fickerstealer

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral1/memory/1000-59-0x0000000000400000-0x00000000047D5000-memory.dmp	upx

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow	ioc
3	api.ipify.org

Suspicious use of SetThreadContext 1 IoCs

Processes:

d4310e308bf2485379ae0e77aebea5c7e102059679c46cc6e0f2839204595573.exe

description	pid	Process	procid_target
PID 1000 set thread context of 2044	1000	d4310e308bf2485379ae0e77aebea5c7e102059679c46cc6e0f2839204595573.exe	27

Suspicious use of WriteProcessMemory 14 IoCs

Processes:

d4310e308bf2485379ae0e77aebea5c7e102059679c46cc6e0f2839204595573.exe

description	pid	Process	procid_target
PID 1000 wrote to memory of 2044	1000	d4310e308bf2485379ae0e77aebea5c7e102059679c46cc6e0f2839204595573.exe	27
PID 1000 wrote to memory of 2044	1000	d4310e308bf2485379ae0e77aebea5c7e102059679c46cc6e0f2839204595573.exe	27
PID 1000 wrote to memory of 2044	1000	d4310e308bf2485379ae0e77aebea5c7e102059679c46cc6e0f2839204595573.exe	27
PID 1000 wrote to memory of 2044	1000	d4310e308bf2485379ae0e77aebea5c7e102059679c46cc6e0f2839204595573.exe	27
PID 1000 wrote to memory of 2044	1000	d4310e308bf2485379ae0e77aebea5c7e102059679c46cc6e0f2839204595573.exe	27
PID 1000 wrote to memory of 2044	1000	d4310e308bf2485379ae0e77aebea5c7e102059679c46cc6e0f2839204595573.exe	27
PID 1000 wrote to memory of 2044	1000	d4310e308bf2485379ae0e77aebea5c7e102059679c46cc6e0f2839204595573.exe	27
PID 1000 wrote to memory of 2044	1000	d4310e308bf2485379ae0e77aebea5c7e102059679c46cc6e0f2839204595573.exe	27
PID 1000 wrote to memory of 2044	1000	d4310e308bf2485379ae0e77aebea5c7e102059679c46cc6e0f2839204595573.exe	27
PID 1000 wrote to memory of 2044	1000	d4310e308bf2485379ae0e77aebea5c7e102059679c46cc6e0f2839204595573.exe	27
PID 1000 wrote to memory of 2044	1000	d4310e308bf2485379ae0e77aebea5c7e102059679c46cc6e0f2839204595573.exe	27
PID 1000 wrote to memory of 2044	1000	d4310e308bf2485379ae0e77aebea5c7e102059679c46cc6e0f2839204595573.exe	27
PID 1000 wrote to memory of 2044	1000	d4310e308bf2485379ae0e77aebea5c7e102059679c46cc6e0f2839204595573.exe	27
PID 1000 wrote to memory of 2044	1000	d4310e308bf2485379ae0e77aebea5c7e102059679c46cc6e0f2839204595573.exe	27

C:\Users\Admin\AppData\Local\Temp\d4310e308bf2485379ae0e77aebea5c7e102059679c46cc6e0f2839204595573.exe
"C:\Users\Admin\AppData\Local\Temp\d4310e308bf2485379ae0e77aebea5c7e102059679c46cc6e0f2839204595573.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1000
- C:\Users\Admin\AppData\Local\Temp\d4310e308bf2485379ae0e77aebea5c7e102059679c46cc6e0f2839204595573.exe
  "C:\Users\Admin\AppData\Local\Temp\d4310e308bf2485379ae0e77aebea5c7e102059679c46cc6e0f2839204595573.exe"
  2⤵
  PID:2044

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1000-59-0x0000000000400000-0x00000000047D5000-memory.dmp

Filesize
67.8MB

Download
memory/1000-60-0x00000000047E0000-0x0000000004806000-memory.dmp

Filesize
152KB

Download
memory/1000-62-0x0000000004810000-0x0000000004855000-memory.dmp

Filesize
276KB

Download
memory/1000-64-0x00000000060E0000-0x000000000A4B5000-memory.dmp

Filesize
67.8MB

Download
memory/2044-54-0x0000000000400000-0x0000000000449000-memory.dmp

Filesize
292KB

Download
memory/2044-55-0x0000000000401480-mapping.dmp

Download
memory/2044-57-0x0000000000400000-0x0000000000449000-memory.dmp

Filesize
292KB

Download
memory/2044-58-0x0000000075F21000-0x0000000075F23000-memory.dmp

Filesize
8KB

Download
memory/2044-61-0x0000000000400000-0x0000000000449000-memory.dmp

Filesize
292KB

Download
memory/2044-63-0x0000000000400000-0x0000000000449000-memory.dmp

Filesize
292KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads