fickerstealer | 5f3061aee58a7acc32cd8f2c2777dc2514e9cb6b13a80d2c289867a56d8cb2f8

Analysis

max time kernel
91s
max time network
127s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
23-01-2023 15:04

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

5f3061aee58a7acc32cd8f2c2777dc2514e9cb6b13a80d2c289867a56d8cb2f8.exe
Size

4.8MB
MD5

dacb55c5b52f0749ddae6708496f6f7f
SHA1

008b432a937354ac690f0f5c2067785dc1c8ddef
SHA256

5f3061aee58a7acc32cd8f2c2777dc2514e9cb6b13a80d2c289867a56d8cb2f8
SHA512

0ed7aab9bbfffb443be13c60f6b8b103cd31436b0d1cbb2b2a5ec43a1e84ff09510a012f0003ef0d46e0c4ecc80f8a31c2ac4f7919dff2bc3152b51461fae744
SSDEEP

24576:/u7JMHhcvsRw7K0q/2cbyBCvNJeWKaij3yQZ9pxmQ3A9EhIAiqOXqgSWfaPSJaky:/uTv8w7G2cbOCjPmv9p+SvorASl87X

Score

10^/10

fickerstealer infostealer spyware stealer

Malware Config

Extracted

Family

fickerstealer

91.240.118.51:253

Signatures

Fickerstealer
Ficker is an infostealer written in Rust and ASM.
infostealer fickerstealer
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081

Program crash 5 IoCs

pid	pid_target	Process	procid_target
4560	5036	WerFault.exe	75
3408	5036	WerFault.exe	75
4804	5036	WerFault.exe	75
4312	5036	WerFault.exe	75
4436	5036	WerFault.exe	75

C:\Users\Admin\AppData\Local\Temp\5f3061aee58a7acc32cd8f2c2777dc2514e9cb6b13a80d2c289867a56d8cb2f8.exe
"C:\Users\Admin\AppData\Local\Temp\5f3061aee58a7acc32cd8f2c2777dc2514e9cb6b13a80d2c289867a56d8cb2f8.exe"
1⤵
PID:5036
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 5036 -s 1048
  2⤵
  - Program crash
  PID:4560
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 5036 -s 1356
  2⤵
  - Program crash
  PID:3408
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 5036 -s 1116
  2⤵
  - Program crash
  PID:4804
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 5036 -s 1356
  2⤵
  - Program crash
  PID:4312
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 5036 -s 152
  2⤵
  - Program crash
  PID:4436

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 5036 -ip 5036
1⤵
PID:1864

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 5036 -ip 5036
1⤵
PID:3256

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 5036 -ip 5036
1⤵
PID:2220

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 5036 -ip 5036
1⤵
PID:3540

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 5036 -ip 5036
1⤵
PID:4792

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

T1081

Discovery

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/5036-132-0x00000000030D0000-0x000000000350E000-memory.dmp

Filesize
4.2MB

Download
memory/5036-133-0x0000000000400000-0x00000000008CF000-memory.dmp

Filesize
4.8MB

Download
memory/5036-134-0x0000000000400000-0x00000000008CF000-memory.dmp

Filesize
4.8MB

Download
memory/5036-135-0x0000000000400000-0x00000000008CF000-memory.dmp

Filesize
4.8MB

Download