fickerstealer | f6eb0779ed543037991f587d1616015a2869cd9a09b08bde3bf966a223587078

Analysis

max time kernel
147s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
14-11-2022 09:44

Target

456e86c827d3b4018aa9d78ad50ef6a301d512c92fc3e1dc8a6c9fa1ea6cfbfd.exe
Size

283KB
MD5

0481991867b39d87cb166b1895247b60
SHA1

202c7652a1783c0cd825eb8737d2211ada61d1da
SHA256

456e86c827d3b4018aa9d78ad50ef6a301d512c92fc3e1dc8a6c9fa1ea6cfbfd
SHA512

1dba8f332de9e82fc94d913ef2a50e5a9fccd542ec02e34f5226414d0f194d91f7e64475bd88ac2c9534bc523b653fd2a30c217cbc545a1c2c36ffe8d22f506e
SSDEEP

6144:I9cFVaLvOvuMtY6rJWV0QTr7uFvq/PYzsrnynEvB5tM:7FVaCvft/QajT2+

Score

10^/10

Family

fickerstealer

45.67.231.4:80

Fickerstealer
Ficker is an infostealer written in Rust and ASM.
infostealer fickerstealer

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
3	api.ipify.org

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3004 set thread context of 4960	3004	456e86c827d3b4018aa9d78ad50ef6a301d512c92fc3e1dc8a6c9fa1ea6cfbfd.exe	81

Suspicious use of WriteProcessMemory 13 IoCs

description	pid	Process	procid_target
PID 3004 wrote to memory of 4960	3004	456e86c827d3b4018aa9d78ad50ef6a301d512c92fc3e1dc8a6c9fa1ea6cfbfd.exe	81
PID 3004 wrote to memory of 4960	3004	456e86c827d3b4018aa9d78ad50ef6a301d512c92fc3e1dc8a6c9fa1ea6cfbfd.exe	81
PID 3004 wrote to memory of 4960	3004	456e86c827d3b4018aa9d78ad50ef6a301d512c92fc3e1dc8a6c9fa1ea6cfbfd.exe	81
PID 3004 wrote to memory of 4960	3004	456e86c827d3b4018aa9d78ad50ef6a301d512c92fc3e1dc8a6c9fa1ea6cfbfd.exe	81
PID 3004 wrote to memory of 4960	3004	456e86c827d3b4018aa9d78ad50ef6a301d512c92fc3e1dc8a6c9fa1ea6cfbfd.exe	81
PID 3004 wrote to memory of 4960	3004	456e86c827d3b4018aa9d78ad50ef6a301d512c92fc3e1dc8a6c9fa1ea6cfbfd.exe	81
PID 3004 wrote to memory of 4960	3004	456e86c827d3b4018aa9d78ad50ef6a301d512c92fc3e1dc8a6c9fa1ea6cfbfd.exe	81
PID 3004 wrote to memory of 4960	3004	456e86c827d3b4018aa9d78ad50ef6a301d512c92fc3e1dc8a6c9fa1ea6cfbfd.exe	81
PID 3004 wrote to memory of 4960	3004	456e86c827d3b4018aa9d78ad50ef6a301d512c92fc3e1dc8a6c9fa1ea6cfbfd.exe	81
PID 3004 wrote to memory of 4960	3004	456e86c827d3b4018aa9d78ad50ef6a301d512c92fc3e1dc8a6c9fa1ea6cfbfd.exe	81
PID 3004 wrote to memory of 4960	3004	456e86c827d3b4018aa9d78ad50ef6a301d512c92fc3e1dc8a6c9fa1ea6cfbfd.exe	81
PID 3004 wrote to memory of 4960	3004	456e86c827d3b4018aa9d78ad50ef6a301d512c92fc3e1dc8a6c9fa1ea6cfbfd.exe	81
PID 3004 wrote to memory of 4960	3004	456e86c827d3b4018aa9d78ad50ef6a301d512c92fc3e1dc8a6c9fa1ea6cfbfd.exe	81

C:\Users\Admin\AppData\Local\Temp\456e86c827d3b4018aa9d78ad50ef6a301d512c92fc3e1dc8a6c9fa1ea6cfbfd.exe
"C:\Users\Admin\AppData\Local\Temp\456e86c827d3b4018aa9d78ad50ef6a301d512c92fc3e1dc8a6c9fa1ea6cfbfd.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3004
- C:\Users\Admin\AppData\Local\Temp\456e86c827d3b4018aa9d78ad50ef6a301d512c92fc3e1dc8a6c9fa1ea6cfbfd.exe
  "C:\Users\Admin\AppData\Local\Temp\456e86c827d3b4018aa9d78ad50ef6a301d512c92fc3e1dc8a6c9fa1ea6cfbfd.exe"
  2⤵
  PID:4960

memory/3004-136-0x00000000005E9000-0x0000000000610000-memory.dmp

Filesize
156KB

Download
memory/3004-137-0x0000000000980000-0x00000000009C4000-memory.dmp

Filesize
272KB

Download
memory/4960-133-0x0000000000400000-0x0000000000447000-memory.dmp

Filesize
284KB

Download
memory/4960-135-0x0000000000400000-0x0000000000447000-memory.dmp

Filesize
284KB

Download
memory/4960-138-0x0000000000400000-0x0000000000447000-memory.dmp

Filesize
284KB

Download