fickerstealer | fde86687975a5ad9475f7a794077bcb8e2404cc70e1662930be15384d3a6edda

Analysis

max time kernel
153s
max time network
160s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
29-01-2023 17:59

Target

fde86687975a5ad9475f7a794077bcb8e2404cc70e1662930be15384d3a6edda.exe
Size

277KB
MD5

605db2ba5163b547c8a3fbc3eda9300d
SHA1

b356fa386bb6ca5816429189bb7d687121dfb131
SHA256

fde86687975a5ad9475f7a794077bcb8e2404cc70e1662930be15384d3a6edda
SHA512

48444f4d53ebccc13e7d0627b7ff01ebb2bbf1fcfab8cf5fc3577608c1f6426cdde68850e2fad6f6394eb7b94f79d079e2f82483158ab541694acd33d60e38a8
SSDEEP

6144:f8bcvL/PEIbNj0jgorXqtK4FxLXhngbN81xtt:f+cvzPEIb2jgor6IWdXVf

Score

10^/10

Family

fickerstealer

deniedfight.com:80

Fickerstealer
Ficker is an infostealer written in Rust and ASM.
infostealer fickerstealer

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
16	api.ipify.org

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2084 set thread context of 3840	2084	fde86687975a5ad9475f7a794077bcb8e2404cc70e1662930be15384d3a6edda.exe	80

Suspicious use of WriteProcessMemory 13 IoCs

description	pid	Process	procid_target
PID 2084 wrote to memory of 3840	2084	fde86687975a5ad9475f7a794077bcb8e2404cc70e1662930be15384d3a6edda.exe	80
PID 2084 wrote to memory of 3840	2084	fde86687975a5ad9475f7a794077bcb8e2404cc70e1662930be15384d3a6edda.exe	80
PID 2084 wrote to memory of 3840	2084	fde86687975a5ad9475f7a794077bcb8e2404cc70e1662930be15384d3a6edda.exe	80
PID 2084 wrote to memory of 3840	2084	fde86687975a5ad9475f7a794077bcb8e2404cc70e1662930be15384d3a6edda.exe	80
PID 2084 wrote to memory of 3840	2084	fde86687975a5ad9475f7a794077bcb8e2404cc70e1662930be15384d3a6edda.exe	80
PID 2084 wrote to memory of 3840	2084	fde86687975a5ad9475f7a794077bcb8e2404cc70e1662930be15384d3a6edda.exe	80
PID 2084 wrote to memory of 3840	2084	fde86687975a5ad9475f7a794077bcb8e2404cc70e1662930be15384d3a6edda.exe	80
PID 2084 wrote to memory of 3840	2084	fde86687975a5ad9475f7a794077bcb8e2404cc70e1662930be15384d3a6edda.exe	80
PID 2084 wrote to memory of 3840	2084	fde86687975a5ad9475f7a794077bcb8e2404cc70e1662930be15384d3a6edda.exe	80
PID 2084 wrote to memory of 3840	2084	fde86687975a5ad9475f7a794077bcb8e2404cc70e1662930be15384d3a6edda.exe	80
PID 2084 wrote to memory of 3840	2084	fde86687975a5ad9475f7a794077bcb8e2404cc70e1662930be15384d3a6edda.exe	80
PID 2084 wrote to memory of 3840	2084	fde86687975a5ad9475f7a794077bcb8e2404cc70e1662930be15384d3a6edda.exe	80
PID 2084 wrote to memory of 3840	2084	fde86687975a5ad9475f7a794077bcb8e2404cc70e1662930be15384d3a6edda.exe	80

C:\Users\Admin\AppData\Local\Temp\fde86687975a5ad9475f7a794077bcb8e2404cc70e1662930be15384d3a6edda.exe
"C:\Users\Admin\AppData\Local\Temp\fde86687975a5ad9475f7a794077bcb8e2404cc70e1662930be15384d3a6edda.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2084
- C:\Users\Admin\AppData\Local\Temp\fde86687975a5ad9475f7a794077bcb8e2404cc70e1662930be15384d3a6edda.exe
  "C:\Users\Admin\AppData\Local\Temp\fde86687975a5ad9475f7a794077bcb8e2404cc70e1662930be15384d3a6edda.exe"
  2⤵
  PID:3840

memory/2084-132-0x0000000000A5A000-0x0000000000A82000-memory.dmp

Filesize
160KB

Download
memory/2084-133-0x00000000009E0000-0x0000000000A25000-memory.dmp

Filesize
276KB

Download
memory/2084-137-0x0000000000A5A000-0x0000000000A82000-memory.dmp

Filesize
160KB

Download
memory/3840-135-0x0000000000400000-0x0000000000449000-memory.dmp

Filesize
292KB

Download
memory/3840-138-0x0000000000400000-0x0000000000449000-memory.dmp

Filesize
292KB

Download
memory/3840-139-0x0000000000400000-0x0000000000449000-memory.dmp

Filesize
292KB

Download
memory/3840-140-0x0000000000400000-0x0000000000449000-memory.dmp

Filesize
292KB

Download