Analysis

  • max time kernel
    150s
  • max time network
    159s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220812-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
  • submitted
    30-11-2022 17:23

General

  • Target

    7fdbd3e7a891eb6dded35fd2d2481adce7fcbb7dbe8a87696be1780f7b41fac9.exe

  • Size

    242KB

  • MD5

    0ffe2e52a11e7a7e8261b7f87a1fe7d6

  • SHA1

    c6248b1ff1820edc20ce9b764ff39e0e28c1060d

  • SHA256

    7fdbd3e7a891eb6dded35fd2d2481adce7fcbb7dbe8a87696be1780f7b41fac9

  • SHA512

    4a647e84dc71443fccbec11d00c5b56ec6445227a342aa889bc24db66077dafc7eea9d4d833a97e7edfca4c168a44293c6ae3796ef1038d2d65cf5d43384d741

  • SSDEEP

    6144:bJgOKh/7pBVd0kCeghN1m2eOTZ08shMSPLN1hv1R5:dgOU7p10besNI2lmLvhtH

Malware Config

Extracted

Family

fickerstealer

C2

74.119.195.40:80

Signatures

  • Fickerstealer

    Ficker is an infostealer written in Rust and ASM.

  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext 1 IoCs
  • Suspicious use of WriteProcessMemory 13 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\7fdbd3e7a891eb6dded35fd2d2481adce7fcbb7dbe8a87696be1780f7b41fac9.exe
    "C:\Users\Admin\AppData\Local\Temp\7fdbd3e7a891eb6dded35fd2d2481adce7fcbb7dbe8a87696be1780f7b41fac9.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:1568
    • C:\Users\Admin\AppData\Local\Temp\7fdbd3e7a891eb6dded35fd2d2481adce7fcbb7dbe8a87696be1780f7b41fac9.exe
      "C:\Users\Admin\AppData\Local\Temp\7fdbd3e7a891eb6dded35fd2d2481adce7fcbb7dbe8a87696be1780f7b41fac9.exe"
      2⤵
        PID:3668

    Network

    MITRE ATT&CK Matrix

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/1568-137-0x0000000000580000-0x00000000005C5000-memory.dmp

      Filesize

      276KB

    • memory/1568-135-0x0000000000629000-0x0000000000650000-memory.dmp

      Filesize

      156KB

    • memory/3668-132-0x0000000000000000-mapping.dmp

    • memory/3668-133-0x0000000000400000-0x0000000000449000-memory.dmp

      Filesize

      292KB

    • memory/3668-136-0x0000000000400000-0x0000000000449000-memory.dmp

      Filesize

      292KB

    • memory/3668-138-0x0000000000400000-0x0000000000449000-memory.dmp

      Filesize

      292KB