fickerstealer | 892398dc3c56b8196af8650e5ec878f39735717cc31bf859fffc4f40da8372dd

Analysis

max time kernel
184s
max time network
228s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
13-11-2022 22:50

Target

95db6418da0c11842b06ec98495f327dca6428ce7575798d2c3a36eecac508a2.exe
Size

371KB
MD5

265969856a9b0eebf03295101c2a75ba
SHA1

f57aae5d8a6634d2cb3fb9255209e067e849228b
SHA256

95db6418da0c11842b06ec98495f327dca6428ce7575798d2c3a36eecac508a2
SHA512

16973e15dc7b7f41121bb2474aef6755a89db3fe11d0ecf62784ecb47e8ec30f9495c338965befff634a115b3628b961a432e61005a58fd827188d6d42dead55
SSDEEP

6144:QsDlrgiL9cgPMhndCxsSsok5jNsIeA7PaflD8TleZk/YPstmKctTPjRMwU4b:Qsxki+8MNNlNB+9D2eGk48b

Score

10^/10

Family

fickerstealer

fickita.info:8080

Fickerstealer
Ficker is an infostealer written in Rust and ASM.
infostealer fickerstealer

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
20	api.ipify.org

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4888 set thread context of 4740	4888	95db6418da0c11842b06ec98495f327dca6428ce7575798d2c3a36eecac508a2.exe	79

Suspicious use of WriteProcessMemory 13 IoCs

description	pid	Process	procid_target
PID 4888 wrote to memory of 4740	4888	95db6418da0c11842b06ec98495f327dca6428ce7575798d2c3a36eecac508a2.exe	79
PID 4888 wrote to memory of 4740	4888	95db6418da0c11842b06ec98495f327dca6428ce7575798d2c3a36eecac508a2.exe	79
PID 4888 wrote to memory of 4740	4888	95db6418da0c11842b06ec98495f327dca6428ce7575798d2c3a36eecac508a2.exe	79
PID 4888 wrote to memory of 4740	4888	95db6418da0c11842b06ec98495f327dca6428ce7575798d2c3a36eecac508a2.exe	79
PID 4888 wrote to memory of 4740	4888	95db6418da0c11842b06ec98495f327dca6428ce7575798d2c3a36eecac508a2.exe	79
PID 4888 wrote to memory of 4740	4888	95db6418da0c11842b06ec98495f327dca6428ce7575798d2c3a36eecac508a2.exe	79
PID 4888 wrote to memory of 4740	4888	95db6418da0c11842b06ec98495f327dca6428ce7575798d2c3a36eecac508a2.exe	79
PID 4888 wrote to memory of 4740	4888	95db6418da0c11842b06ec98495f327dca6428ce7575798d2c3a36eecac508a2.exe	79
PID 4888 wrote to memory of 4740	4888	95db6418da0c11842b06ec98495f327dca6428ce7575798d2c3a36eecac508a2.exe	79
PID 4888 wrote to memory of 4740	4888	95db6418da0c11842b06ec98495f327dca6428ce7575798d2c3a36eecac508a2.exe	79
PID 4888 wrote to memory of 4740	4888	95db6418da0c11842b06ec98495f327dca6428ce7575798d2c3a36eecac508a2.exe	79
PID 4888 wrote to memory of 4740	4888	95db6418da0c11842b06ec98495f327dca6428ce7575798d2c3a36eecac508a2.exe	79
PID 4888 wrote to memory of 4740	4888	95db6418da0c11842b06ec98495f327dca6428ce7575798d2c3a36eecac508a2.exe	79

C:\Users\Admin\AppData\Local\Temp\95db6418da0c11842b06ec98495f327dca6428ce7575798d2c3a36eecac508a2.exe
"C:\Users\Admin\AppData\Local\Temp\95db6418da0c11842b06ec98495f327dca6428ce7575798d2c3a36eecac508a2.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4888
- C:\Users\Admin\AppData\Local\Temp\95db6418da0c11842b06ec98495f327dca6428ce7575798d2c3a36eecac508a2.exe
  "C:\Users\Admin\AppData\Local\Temp\95db6418da0c11842b06ec98495f327dca6428ce7575798d2c3a36eecac508a2.exe"
  2⤵
  PID:4740

memory/4740-135-0x0000000000400000-0x0000000000467000-memory.dmp

Filesize
412KB

Download
memory/4740-138-0x0000000000400000-0x0000000000467000-memory.dmp

Filesize
412KB

Download
memory/4740-139-0x0000000000400000-0x0000000000467000-memory.dmp

Filesize
412KB

Download
memory/4740-140-0x0000000000400000-0x0000000000467000-memory.dmp

Filesize
412KB

Download
memory/4888-132-0x0000000000618000-0x000000000064F000-memory.dmp

Filesize
220KB

Download
memory/4888-133-0x00000000021E0000-0x0000000002242000-memory.dmp

Filesize
392KB

Download
memory/4888-137-0x0000000000618000-0x000000000064F000-memory.dmp

Filesize
220KB

Download