fickerstealer | dc0bfd7d5d6388b135c18ca902760a62eed421a60dc631256a76b7bb332d8914

Analysis

max time kernel
148s
max time network
155s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
29-01-2023 17:54

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

dc0bfd7d5d6388b135c18ca902760a62eed421a60dc631256a76b7bb332d8914.exe
Size

365KB
MD5

81e8664284df9b206f27d6bfa2c200b0
SHA1

be816f5655a1806862a0739626c71f06f000f7e6
SHA256

dc0bfd7d5d6388b135c18ca902760a62eed421a60dc631256a76b7bb332d8914
SHA512

701b410ffa9aa6bf7f6f5aff058241ca4a8e55634f1f3dbf73e9df4cf33e90212e31c7ad4f0bc334ab1fea37f1152561adb84ff893491f1cd20906bed0d3809a
SSDEEP

6144:0rgsUf1MN2h6rgXIRhWjaK+XQe/7nonfV0apmFOwjKLzYn8lZsNeW:0rgsUf1MN2hDXHwBjonfV9m0wyzA8PW

Score

10^/10

fickerstealer infostealer

Malware Config

Extracted

Family

fickerstealer

deniedfight.com:80

Signatures

Fickerstealer
Ficker is an infostealer written in Rust and ASM.
infostealer fickerstealer

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
3	api.ipify.org

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1264 set thread context of 2040	1264	dc0bfd7d5d6388b135c18ca902760a62eed421a60dc631256a76b7bb332d8914.exe	27

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 1264 wrote to memory of 2040	1264	dc0bfd7d5d6388b135c18ca902760a62eed421a60dc631256a76b7bb332d8914.exe	27
PID 1264 wrote to memory of 2040	1264	dc0bfd7d5d6388b135c18ca902760a62eed421a60dc631256a76b7bb332d8914.exe	27
PID 1264 wrote to memory of 2040	1264	dc0bfd7d5d6388b135c18ca902760a62eed421a60dc631256a76b7bb332d8914.exe	27
PID 1264 wrote to memory of 2040	1264	dc0bfd7d5d6388b135c18ca902760a62eed421a60dc631256a76b7bb332d8914.exe	27
PID 1264 wrote to memory of 2040	1264	dc0bfd7d5d6388b135c18ca902760a62eed421a60dc631256a76b7bb332d8914.exe	27
PID 1264 wrote to memory of 2040	1264	dc0bfd7d5d6388b135c18ca902760a62eed421a60dc631256a76b7bb332d8914.exe	27
PID 1264 wrote to memory of 2040	1264	dc0bfd7d5d6388b135c18ca902760a62eed421a60dc631256a76b7bb332d8914.exe	27
PID 1264 wrote to memory of 2040	1264	dc0bfd7d5d6388b135c18ca902760a62eed421a60dc631256a76b7bb332d8914.exe	27
PID 1264 wrote to memory of 2040	1264	dc0bfd7d5d6388b135c18ca902760a62eed421a60dc631256a76b7bb332d8914.exe	27
PID 1264 wrote to memory of 2040	1264	dc0bfd7d5d6388b135c18ca902760a62eed421a60dc631256a76b7bb332d8914.exe	27
PID 1264 wrote to memory of 2040	1264	dc0bfd7d5d6388b135c18ca902760a62eed421a60dc631256a76b7bb332d8914.exe	27
PID 1264 wrote to memory of 2040	1264	dc0bfd7d5d6388b135c18ca902760a62eed421a60dc631256a76b7bb332d8914.exe	27
PID 1264 wrote to memory of 2040	1264	dc0bfd7d5d6388b135c18ca902760a62eed421a60dc631256a76b7bb332d8914.exe	27
PID 1264 wrote to memory of 2040	1264	dc0bfd7d5d6388b135c18ca902760a62eed421a60dc631256a76b7bb332d8914.exe	27

C:\Users\Admin\AppData\Local\Temp\dc0bfd7d5d6388b135c18ca902760a62eed421a60dc631256a76b7bb332d8914.exe
"C:\Users\Admin\AppData\Local\Temp\dc0bfd7d5d6388b135c18ca902760a62eed421a60dc631256a76b7bb332d8914.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1264
- C:\Users\Admin\AppData\Local\Temp\dc0bfd7d5d6388b135c18ca902760a62eed421a60dc631256a76b7bb332d8914.exe
  "C:\Users\Admin\AppData\Local\Temp\dc0bfd7d5d6388b135c18ca902760a62eed421a60dc631256a76b7bb332d8914.exe"
  2⤵
  PID:2040

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1264-54-0x0000000000CD8000-0x0000000000D00000-memory.dmp

Filesize
160KB

Download
memory/1264-58-0x0000000000CD8000-0x0000000000D00000-memory.dmp

Filesize
160KB

Download
memory/1264-59-0x0000000000220000-0x0000000000265000-memory.dmp

Filesize
276KB

Download
memory/2040-55-0x0000000000400000-0x0000000000449000-memory.dmp

Filesize
292KB

Download
memory/2040-60-0x0000000000400000-0x0000000000449000-memory.dmp

Filesize
292KB

Download
memory/2040-61-0x0000000000400000-0x0000000000449000-memory.dmp

Filesize
292KB

Download
memory/2040-62-0x0000000075C61000-0x0000000075C63000-memory.dmp

Filesize
8KB

Download
memory/2040-63-0x0000000000400000-0x0000000000449000-memory.dmp

Filesize
292KB

Download