fickerstealer | dc0bfd7d5d6388b135c18ca902760a62eed421a60dc631256a76b7bb332d8914

Analysis

max time kernel
149s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
29-01-2023 17:54

Target

dc0bfd7d5d6388b135c18ca902760a62eed421a60dc631256a76b7bb332d8914.exe
Size

365KB
MD5

81e8664284df9b206f27d6bfa2c200b0
SHA1

be816f5655a1806862a0739626c71f06f000f7e6
SHA256

dc0bfd7d5d6388b135c18ca902760a62eed421a60dc631256a76b7bb332d8914
SHA512

701b410ffa9aa6bf7f6f5aff058241ca4a8e55634f1f3dbf73e9df4cf33e90212e31c7ad4f0bc334ab1fea37f1152561adb84ff893491f1cd20906bed0d3809a
SSDEEP

6144:0rgsUf1MN2h6rgXIRhWjaK+XQe/7nonfV0apmFOwjKLzYn8lZsNeW:0rgsUf1MN2hDXHwBjonfV9m0wyzA8PW

Score

10^/10

Family

fickerstealer

deniedfight.com:80

Fickerstealer
Ficker is an infostealer written in Rust and ASM.
infostealer fickerstealer

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
6	api.ipify.org

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4456 set thread context of 3224	4456	dc0bfd7d5d6388b135c18ca902760a62eed421a60dc631256a76b7bb332d8914.exe	82

Suspicious use of WriteProcessMemory 13 IoCs

description	pid	Process	procid_target
PID 4456 wrote to memory of 3224	4456	dc0bfd7d5d6388b135c18ca902760a62eed421a60dc631256a76b7bb332d8914.exe	82
PID 4456 wrote to memory of 3224	4456	dc0bfd7d5d6388b135c18ca902760a62eed421a60dc631256a76b7bb332d8914.exe	82
PID 4456 wrote to memory of 3224	4456	dc0bfd7d5d6388b135c18ca902760a62eed421a60dc631256a76b7bb332d8914.exe	82
PID 4456 wrote to memory of 3224	4456	dc0bfd7d5d6388b135c18ca902760a62eed421a60dc631256a76b7bb332d8914.exe	82
PID 4456 wrote to memory of 3224	4456	dc0bfd7d5d6388b135c18ca902760a62eed421a60dc631256a76b7bb332d8914.exe	82
PID 4456 wrote to memory of 3224	4456	dc0bfd7d5d6388b135c18ca902760a62eed421a60dc631256a76b7bb332d8914.exe	82
PID 4456 wrote to memory of 3224	4456	dc0bfd7d5d6388b135c18ca902760a62eed421a60dc631256a76b7bb332d8914.exe	82
PID 4456 wrote to memory of 3224	4456	dc0bfd7d5d6388b135c18ca902760a62eed421a60dc631256a76b7bb332d8914.exe	82
PID 4456 wrote to memory of 3224	4456	dc0bfd7d5d6388b135c18ca902760a62eed421a60dc631256a76b7bb332d8914.exe	82
PID 4456 wrote to memory of 3224	4456	dc0bfd7d5d6388b135c18ca902760a62eed421a60dc631256a76b7bb332d8914.exe	82
PID 4456 wrote to memory of 3224	4456	dc0bfd7d5d6388b135c18ca902760a62eed421a60dc631256a76b7bb332d8914.exe	82
PID 4456 wrote to memory of 3224	4456	dc0bfd7d5d6388b135c18ca902760a62eed421a60dc631256a76b7bb332d8914.exe	82
PID 4456 wrote to memory of 3224	4456	dc0bfd7d5d6388b135c18ca902760a62eed421a60dc631256a76b7bb332d8914.exe	82

C:\Users\Admin\AppData\Local\Temp\dc0bfd7d5d6388b135c18ca902760a62eed421a60dc631256a76b7bb332d8914.exe
"C:\Users\Admin\AppData\Local\Temp\dc0bfd7d5d6388b135c18ca902760a62eed421a60dc631256a76b7bb332d8914.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4456
- C:\Users\Admin\AppData\Local\Temp\dc0bfd7d5d6388b135c18ca902760a62eed421a60dc631256a76b7bb332d8914.exe
  "C:\Users\Admin\AppData\Local\Temp\dc0bfd7d5d6388b135c18ca902760a62eed421a60dc631256a76b7bb332d8914.exe"
  2⤵
  PID:3224

memory/3224-133-0x0000000000400000-0x0000000000449000-memory.dmp

Filesize
292KB

Download
memory/3224-136-0x0000000000400000-0x0000000000449000-memory.dmp

Filesize
292KB

Download
memory/3224-138-0x0000000000400000-0x0000000000449000-memory.dmp

Filesize
292KB

Download
memory/3224-139-0x0000000000400000-0x0000000000449000-memory.dmp

Filesize
292KB

Download
memory/4456-135-0x0000000000BC3000-0x0000000000BEA000-memory.dmp

Filesize
156KB

Download
memory/4456-137-0x0000000000930000-0x0000000000975000-memory.dmp

Filesize
276KB

Download