fickerstealer | 9bd83ae2fe3883417d90c0565f8a740d841f5d8886665131b9f4f863d463e4c0

Analysis

max time kernel
150s
max time network
154s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
29-01-2023 18:00

Target

9bd83ae2fe3883417d90c0565f8a740d841f5d8886665131b9f4f863d463e4c0.exe
Size

346KB
MD5

c2adbad2baef729e8ee1643524248bec
SHA1

78bfff37fb9b82bbbd2c95194ceff07785722b7a
SHA256

9bd83ae2fe3883417d90c0565f8a740d841f5d8886665131b9f4f863d463e4c0
SHA512

3be93bf2237f1fc7a96354e3df4a18ff45861fd0dfee6aa5dacfe9a6d3382fd11780cd023f6907b161c12d728cfab4a94d6932a5745952a6f8e3cd6c2114879d
SSDEEP

6144:whg0hjEuy6CevkLU/x2QKNq9dW734b6v3g7ykZMW7iWqZFiWytop1R5:yhguy6hvk4xzKNq9o7366fg7AWeRZFK8

Score

10^/10

Family

fickerstealer

74.119.195.40:80

Fickerstealer
Ficker is an infostealer written in Rust and ASM.
infostealer fickerstealer

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
3	api.ipify.org

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 604 set thread context of 1952	604	9bd83ae2fe3883417d90c0565f8a740d841f5d8886665131b9f4f863d463e4c0.exe	26

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 604 wrote to memory of 1952	604	9bd83ae2fe3883417d90c0565f8a740d841f5d8886665131b9f4f863d463e4c0.exe	26
PID 604 wrote to memory of 1952	604	9bd83ae2fe3883417d90c0565f8a740d841f5d8886665131b9f4f863d463e4c0.exe	26
PID 604 wrote to memory of 1952	604	9bd83ae2fe3883417d90c0565f8a740d841f5d8886665131b9f4f863d463e4c0.exe	26
PID 604 wrote to memory of 1952	604	9bd83ae2fe3883417d90c0565f8a740d841f5d8886665131b9f4f863d463e4c0.exe	26
PID 604 wrote to memory of 1952	604	9bd83ae2fe3883417d90c0565f8a740d841f5d8886665131b9f4f863d463e4c0.exe	26
PID 604 wrote to memory of 1952	604	9bd83ae2fe3883417d90c0565f8a740d841f5d8886665131b9f4f863d463e4c0.exe	26
PID 604 wrote to memory of 1952	604	9bd83ae2fe3883417d90c0565f8a740d841f5d8886665131b9f4f863d463e4c0.exe	26
PID 604 wrote to memory of 1952	604	9bd83ae2fe3883417d90c0565f8a740d841f5d8886665131b9f4f863d463e4c0.exe	26
PID 604 wrote to memory of 1952	604	9bd83ae2fe3883417d90c0565f8a740d841f5d8886665131b9f4f863d463e4c0.exe	26
PID 604 wrote to memory of 1952	604	9bd83ae2fe3883417d90c0565f8a740d841f5d8886665131b9f4f863d463e4c0.exe	26
PID 604 wrote to memory of 1952	604	9bd83ae2fe3883417d90c0565f8a740d841f5d8886665131b9f4f863d463e4c0.exe	26
PID 604 wrote to memory of 1952	604	9bd83ae2fe3883417d90c0565f8a740d841f5d8886665131b9f4f863d463e4c0.exe	26
PID 604 wrote to memory of 1952	604	9bd83ae2fe3883417d90c0565f8a740d841f5d8886665131b9f4f863d463e4c0.exe	26
PID 604 wrote to memory of 1952	604	9bd83ae2fe3883417d90c0565f8a740d841f5d8886665131b9f4f863d463e4c0.exe	26

C:\Users\Admin\AppData\Local\Temp\9bd83ae2fe3883417d90c0565f8a740d841f5d8886665131b9f4f863d463e4c0.exe
"C:\Users\Admin\AppData\Local\Temp\9bd83ae2fe3883417d90c0565f8a740d841f5d8886665131b9f4f863d463e4c0.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:604
- C:\Users\Admin\AppData\Local\Temp\9bd83ae2fe3883417d90c0565f8a740d841f5d8886665131b9f4f863d463e4c0.exe
  "C:\Users\Admin\AppData\Local\Temp\9bd83ae2fe3883417d90c0565f8a740d841f5d8886665131b9f4f863d463e4c0.exe"
  2⤵
  PID:1952

memory/604-54-0x0000000002D49000-0x0000000002D70000-memory.dmp

Filesize
156KB

Download
memory/604-57-0x0000000002D49000-0x0000000002D70000-memory.dmp

Filesize
156KB

Download
memory/604-59-0x0000000000260000-0x00000000002A5000-memory.dmp

Filesize
276KB

Download
memory/1952-55-0x0000000000400000-0x0000000000449000-memory.dmp

Filesize
292KB

Download
memory/1952-60-0x0000000000400000-0x0000000000449000-memory.dmp

Filesize
292KB

Download
memory/1952-61-0x0000000075F81000-0x0000000075F83000-memory.dmp

Filesize
8KB

Download
memory/1952-62-0x0000000000400000-0x0000000000449000-memory.dmp

Filesize
292KB

Download
memory/1952-63-0x0000000000400000-0x0000000000449000-memory.dmp

Filesize
292KB

Download