fickerstealer | 9bd83ae2fe3883417d90c0565f8a740d841f5d8886665131b9f4f863d463e4c0

Analysis

max time kernel
152s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
29-01-2023 18:00

Target

9bd83ae2fe3883417d90c0565f8a740d841f5d8886665131b9f4f863d463e4c0.exe
Size

346KB
MD5

c2adbad2baef729e8ee1643524248bec
SHA1

78bfff37fb9b82bbbd2c95194ceff07785722b7a
SHA256

9bd83ae2fe3883417d90c0565f8a740d841f5d8886665131b9f4f863d463e4c0
SHA512

3be93bf2237f1fc7a96354e3df4a18ff45861fd0dfee6aa5dacfe9a6d3382fd11780cd023f6907b161c12d728cfab4a94d6932a5745952a6f8e3cd6c2114879d
SSDEEP

6144:whg0hjEuy6CevkLU/x2QKNq9dW734b6v3g7ykZMW7iWqZFiWytop1R5:yhguy6hvk4xzKNq9o7366fg7AWeRZFK8

Score

10^/10

Family

fickerstealer

74.119.195.40:80

Fickerstealer
Ficker is an infostealer written in Rust and ASM.
infostealer fickerstealer

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
5	api.ipify.org

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1556 set thread context of 3480	1556	9bd83ae2fe3883417d90c0565f8a740d841f5d8886665131b9f4f863d463e4c0.exe	80

Suspicious use of WriteProcessMemory 13 IoCs

description	pid	Process	procid_target
PID 1556 wrote to memory of 3480	1556	9bd83ae2fe3883417d90c0565f8a740d841f5d8886665131b9f4f863d463e4c0.exe	80
PID 1556 wrote to memory of 3480	1556	9bd83ae2fe3883417d90c0565f8a740d841f5d8886665131b9f4f863d463e4c0.exe	80
PID 1556 wrote to memory of 3480	1556	9bd83ae2fe3883417d90c0565f8a740d841f5d8886665131b9f4f863d463e4c0.exe	80
PID 1556 wrote to memory of 3480	1556	9bd83ae2fe3883417d90c0565f8a740d841f5d8886665131b9f4f863d463e4c0.exe	80
PID 1556 wrote to memory of 3480	1556	9bd83ae2fe3883417d90c0565f8a740d841f5d8886665131b9f4f863d463e4c0.exe	80
PID 1556 wrote to memory of 3480	1556	9bd83ae2fe3883417d90c0565f8a740d841f5d8886665131b9f4f863d463e4c0.exe	80
PID 1556 wrote to memory of 3480	1556	9bd83ae2fe3883417d90c0565f8a740d841f5d8886665131b9f4f863d463e4c0.exe	80
PID 1556 wrote to memory of 3480	1556	9bd83ae2fe3883417d90c0565f8a740d841f5d8886665131b9f4f863d463e4c0.exe	80
PID 1556 wrote to memory of 3480	1556	9bd83ae2fe3883417d90c0565f8a740d841f5d8886665131b9f4f863d463e4c0.exe	80
PID 1556 wrote to memory of 3480	1556	9bd83ae2fe3883417d90c0565f8a740d841f5d8886665131b9f4f863d463e4c0.exe	80
PID 1556 wrote to memory of 3480	1556	9bd83ae2fe3883417d90c0565f8a740d841f5d8886665131b9f4f863d463e4c0.exe	80
PID 1556 wrote to memory of 3480	1556	9bd83ae2fe3883417d90c0565f8a740d841f5d8886665131b9f4f863d463e4c0.exe	80
PID 1556 wrote to memory of 3480	1556	9bd83ae2fe3883417d90c0565f8a740d841f5d8886665131b9f4f863d463e4c0.exe	80

C:\Users\Admin\AppData\Local\Temp\9bd83ae2fe3883417d90c0565f8a740d841f5d8886665131b9f4f863d463e4c0.exe
"C:\Users\Admin\AppData\Local\Temp\9bd83ae2fe3883417d90c0565f8a740d841f5d8886665131b9f4f863d463e4c0.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1556
- C:\Users\Admin\AppData\Local\Temp\9bd83ae2fe3883417d90c0565f8a740d841f5d8886665131b9f4f863d463e4c0.exe
  "C:\Users\Admin\AppData\Local\Temp\9bd83ae2fe3883417d90c0565f8a740d841f5d8886665131b9f4f863d463e4c0.exe"
  2⤵
  PID:3480

memory/1556-132-0x0000000002E29000-0x0000000002E50000-memory.dmp

Filesize
156KB

Download
memory/1556-133-0x0000000002D30000-0x0000000002D75000-memory.dmp

Filesize
276KB

Download
memory/1556-138-0x0000000002E29000-0x0000000002E50000-memory.dmp

Filesize
156KB

Download
memory/3480-135-0x0000000000400000-0x0000000000449000-memory.dmp

Filesize
292KB

Download
memory/3480-137-0x0000000000400000-0x0000000000449000-memory.dmp

Filesize
292KB

Download
memory/3480-139-0x0000000000400000-0x0000000000449000-memory.dmp

Filesize
292KB

Download
memory/3480-140-0x0000000000400000-0x0000000000449000-memory.dmp

Filesize
292KB

Download