fickerstealer | 6865ac77cfa3647f8751bdcd4c3b306f41a48b8dba35f6f01c98439c7da9261c

General

Target

3fb6dc0a224d2f078b3d612418164610b6d75a443feaf3d86c05ed450d0dfb6e.exe
Size

318KB
MD5

8852c3aa866b43ac160985259a936909
SHA1

07224a27906830ccfc639fc40f22b70c42f474f5
SHA256

3fb6dc0a224d2f078b3d612418164610b6d75a443feaf3d86c05ed450d0dfb6e
SHA512

6680d0c67dd1f01464bb75e55cd13bdab9f6ec25e8651713b18b0a480ac518d702d4dd056fbf04c2906599a509692b1d9e4ec2d5d299d7301d82ad8f8d9d1ef9
SSDEEP

6144:Q7LVMEVRcd8F0CEWFCOgysfF1OOjOMPi2SZhqZ2NBxu27hRRJb:O5MEVRK+0C3COPQhjOMPiBAZsBxD7/Rh

Score

10^/10

fickerstealer infostealer spyware stealer

Malware Config

Extracted

Family

fickerstealer

C2

fickitc.link:8080

Signatures

Fickerstealer
Ficker is an infostealer written in Rust and ASM.
infostealer fickerstealer
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow	ioc
4	api.ipify.org

Suspicious use of SetThreadContext 1 IoCs

Processes:

3fb6dc0a224d2f078b3d612418164610b6d75a443feaf3d86c05ed450d0dfb6e.exe

description	pid	Process	procid_target
PID 1728 set thread context of 1340	1728	3fb6dc0a224d2f078b3d612418164610b6d75a443feaf3d86c05ed450d0dfb6e.exe	27

Program crash 1 IoCs

Processes:

WerFault.exe

pid	pid_target	Process	procid_target
792	1340	WerFault.exe	27

Suspicious use of WriteProcessMemory 18 IoCs

Processes:

3fb6dc0a224d2f078b3d612418164610b6d75a443feaf3d86c05ed450d0dfb6e.exe3fb6dc0a224d2f078b3d612418164610b6d75a443feaf3d86c05ed450d0dfb6e.exe

description	pid	Process	procid_target
PID 1728 wrote to memory of 1340	1728	3fb6dc0a224d2f078b3d612418164610b6d75a443feaf3d86c05ed450d0dfb6e.exe	27
PID 1728 wrote to memory of 1340	1728	3fb6dc0a224d2f078b3d612418164610b6d75a443feaf3d86c05ed450d0dfb6e.exe	27
PID 1728 wrote to memory of 1340	1728	3fb6dc0a224d2f078b3d612418164610b6d75a443feaf3d86c05ed450d0dfb6e.exe	27
PID 1728 wrote to memory of 1340	1728	3fb6dc0a224d2f078b3d612418164610b6d75a443feaf3d86c05ed450d0dfb6e.exe	27
PID 1728 wrote to memory of 1340	1728	3fb6dc0a224d2f078b3d612418164610b6d75a443feaf3d86c05ed450d0dfb6e.exe	27
PID 1728 wrote to memory of 1340	1728	3fb6dc0a224d2f078b3d612418164610b6d75a443feaf3d86c05ed450d0dfb6e.exe	27
PID 1728 wrote to memory of 1340	1728	3fb6dc0a224d2f078b3d612418164610b6d75a443feaf3d86c05ed450d0dfb6e.exe	27
PID 1728 wrote to memory of 1340	1728	3fb6dc0a224d2f078b3d612418164610b6d75a443feaf3d86c05ed450d0dfb6e.exe	27
PID 1728 wrote to memory of 1340	1728	3fb6dc0a224d2f078b3d612418164610b6d75a443feaf3d86c05ed450d0dfb6e.exe	27
PID 1728 wrote to memory of 1340	1728	3fb6dc0a224d2f078b3d612418164610b6d75a443feaf3d86c05ed450d0dfb6e.exe	27
PID 1728 wrote to memory of 1340	1728	3fb6dc0a224d2f078b3d612418164610b6d75a443feaf3d86c05ed450d0dfb6e.exe	27
PID 1728 wrote to memory of 1340	1728	3fb6dc0a224d2f078b3d612418164610b6d75a443feaf3d86c05ed450d0dfb6e.exe	27
PID 1728 wrote to memory of 1340	1728	3fb6dc0a224d2f078b3d612418164610b6d75a443feaf3d86c05ed450d0dfb6e.exe	27
PID 1728 wrote to memory of 1340	1728	3fb6dc0a224d2f078b3d612418164610b6d75a443feaf3d86c05ed450d0dfb6e.exe	27
PID 1340 wrote to memory of 792	1340	3fb6dc0a224d2f078b3d612418164610b6d75a443feaf3d86c05ed450d0dfb6e.exe	30
PID 1340 wrote to memory of 792	1340	3fb6dc0a224d2f078b3d612418164610b6d75a443feaf3d86c05ed450d0dfb6e.exe	30
PID 1340 wrote to memory of 792	1340	3fb6dc0a224d2f078b3d612418164610b6d75a443feaf3d86c05ed450d0dfb6e.exe	30
PID 1340 wrote to memory of 792	1340	3fb6dc0a224d2f078b3d612418164610b6d75a443feaf3d86c05ed450d0dfb6e.exe	30

C:\Users\Admin\AppData\Local\Temp\3fb6dc0a224d2f078b3d612418164610b6d75a443feaf3d86c05ed450d0dfb6e.exe
"C:\Users\Admin\AppData\Local\Temp\3fb6dc0a224d2f078b3d612418164610b6d75a443feaf3d86c05ed450d0dfb6e.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1728
- C:\Users\Admin\AppData\Local\Temp\3fb6dc0a224d2f078b3d612418164610b6d75a443feaf3d86c05ed450d0dfb6e.exe
  "C:\Users\Admin\AppData\Local\Temp\3fb6dc0a224d2f078b3d612418164610b6d75a443feaf3d86c05ed450d0dfb6e.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1340
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1340 -s 804
    3⤵
    - Program crash
    PID:792

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

2

T1081

Discovery

Lateral Movement

Collection

Data from Local System

2

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/792-62-0x0000000000000000-mapping.dmp

Download
memory/1340-54-0x0000000000400000-0x0000000000468000-memory.dmp

Filesize
416KB

Download
memory/1340-55-0x00000000004014C0-mapping.dmp

Download
memory/1340-59-0x0000000000400000-0x0000000000468000-memory.dmp

Filesize
416KB

Download
memory/1340-60-0x0000000075CF1000-0x0000000075CF3000-memory.dmp

Filesize
8KB

Download
memory/1340-61-0x0000000000400000-0x0000000000468000-memory.dmp

Filesize
416KB

Download
memory/1728-56-0x00000000002EA000-0x0000000000321000-memory.dmp

Filesize
220KB

Download
memory/1728-58-0x0000000000620000-0x0000000000683000-memory.dmp

Filesize
396KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads