fickerstealer | d4310e308bf2485379ae0e77aebea5c7e102059679c46cc6e0f2839204595573

General

Target

d4310e308bf2485379ae0e77aebea5c7e102059679c46cc6e0f2839204595573.exe
Size

339KB
MD5

de7ff305608959256b33926403b6d934
SHA1

cdd7a11a5f8bcd7b90af6f8f3b3c0cb566e06bd8
SHA256

d4310e308bf2485379ae0e77aebea5c7e102059679c46cc6e0f2839204595573
SHA512

70d3c5d8928bc1a5580b189344d6b457f05a0cd1c84a8fa9e271b4c7a14869078c45475bf6c5e826a50ba16d8016c2ca5b565d95ed239ef083dbae0690270bbc

Score

10^/10

fickerstealer infostealer upx

Malware Config

Extracted

Family

fickerstealer

C2

93.114.128.19:80

Signatures

Fickerstealer
Ficker is an infostealer written in Rust and ASM.
infostealer fickerstealer

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral2/memory/2968-130-0x0000000000400000-0x00000000047D5000-memory.dmp	upx
behavioral2/memory/2968-138-0x0000000000400000-0x00000000047D5000-memory.dmp	upx

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow	ioc
4	api.ipify.org

Suspicious use of SetThreadContext 1 IoCs

Processes:

d4310e308bf2485379ae0e77aebea5c7e102059679c46cc6e0f2839204595573.exe

description	pid	Process	procid_target
PID 2968 set thread context of 2020	2968	d4310e308bf2485379ae0e77aebea5c7e102059679c46cc6e0f2839204595573.exe	82

Suspicious use of WriteProcessMemory 13 IoCs

Processes:

d4310e308bf2485379ae0e77aebea5c7e102059679c46cc6e0f2839204595573.exe

description	pid	Process	procid_target
PID 2968 wrote to memory of 2020	2968	d4310e308bf2485379ae0e77aebea5c7e102059679c46cc6e0f2839204595573.exe	82
PID 2968 wrote to memory of 2020	2968	d4310e308bf2485379ae0e77aebea5c7e102059679c46cc6e0f2839204595573.exe	82
PID 2968 wrote to memory of 2020	2968	d4310e308bf2485379ae0e77aebea5c7e102059679c46cc6e0f2839204595573.exe	82
PID 2968 wrote to memory of 2020	2968	d4310e308bf2485379ae0e77aebea5c7e102059679c46cc6e0f2839204595573.exe	82
PID 2968 wrote to memory of 2020	2968	d4310e308bf2485379ae0e77aebea5c7e102059679c46cc6e0f2839204595573.exe	82
PID 2968 wrote to memory of 2020	2968	d4310e308bf2485379ae0e77aebea5c7e102059679c46cc6e0f2839204595573.exe	82
PID 2968 wrote to memory of 2020	2968	d4310e308bf2485379ae0e77aebea5c7e102059679c46cc6e0f2839204595573.exe	82
PID 2968 wrote to memory of 2020	2968	d4310e308bf2485379ae0e77aebea5c7e102059679c46cc6e0f2839204595573.exe	82
PID 2968 wrote to memory of 2020	2968	d4310e308bf2485379ae0e77aebea5c7e102059679c46cc6e0f2839204595573.exe	82
PID 2968 wrote to memory of 2020	2968	d4310e308bf2485379ae0e77aebea5c7e102059679c46cc6e0f2839204595573.exe	82
PID 2968 wrote to memory of 2020	2968	d4310e308bf2485379ae0e77aebea5c7e102059679c46cc6e0f2839204595573.exe	82
PID 2968 wrote to memory of 2020	2968	d4310e308bf2485379ae0e77aebea5c7e102059679c46cc6e0f2839204595573.exe	82
PID 2968 wrote to memory of 2020	2968	d4310e308bf2485379ae0e77aebea5c7e102059679c46cc6e0f2839204595573.exe	82

C:\Users\Admin\AppData\Local\Temp\d4310e308bf2485379ae0e77aebea5c7e102059679c46cc6e0f2839204595573.exe
"C:\Users\Admin\AppData\Local\Temp\d4310e308bf2485379ae0e77aebea5c7e102059679c46cc6e0f2839204595573.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2968
- C:\Users\Admin\AppData\Local\Temp\d4310e308bf2485379ae0e77aebea5c7e102059679c46cc6e0f2839204595573.exe
  "C:\Users\Admin\AppData\Local\Temp\d4310e308bf2485379ae0e77aebea5c7e102059679c46cc6e0f2839204595573.exe"
  2⤵
  PID:2020

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2020-133-0x0000000000000000-mapping.dmp

Download
memory/2020-134-0x0000000000400000-0x0000000000449000-memory.dmp

Filesize
292KB

Download
memory/2020-136-0x0000000000400000-0x0000000000449000-memory.dmp

Filesize
292KB

Download
memory/2020-137-0x0000000000400000-0x0000000000449000-memory.dmp

Filesize
292KB

Download
memory/2020-139-0x0000000000400000-0x0000000000449000-memory.dmp

Filesize
292KB

Download
memory/2968-130-0x0000000000400000-0x00000000047D5000-memory.dmp

Filesize
67.8MB

Download
memory/2968-131-0x00000000001C0000-0x00000000001E6000-memory.dmp

Filesize
152KB

Download
memory/2968-132-0x00000000047E0000-0x0000000004825000-memory.dmp

Filesize
276KB

Download
memory/2968-138-0x0000000000400000-0x00000000047D5000-memory.dmp

Filesize
67.8MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads