Analysis
-
max time kernel
150s -
max time network
153s -
platform
windows7_x64 -
resource
win7-20230220-en -
resource tags
arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system -
submitted
26-03-2023 16:56
Static task
static1
Behavioral task
behavioral1
Sample
42a3a11367f39f4b5dda0d40b1183330072f8d85c3d2e79e42c46489e7dcce1d.exe
Resource
win7-20230220-en
windows7-x64
11 signatures
150 seconds
Behavioral task
behavioral2
Sample
42a3a11367f39f4b5dda0d40b1183330072f8d85c3d2e79e42c46489e7dcce1d.exe
Resource
win10v2004-20230220-en
windows10-2004-x64
4 signatures
150 seconds
General
-
Target
42a3a11367f39f4b5dda0d40b1183330072f8d85c3d2e79e42c46489e7dcce1d.exe
-
Size
480KB
-
MD5
a8347795e62fd5ea607f98579c1d49ec
-
SHA1
6e4b74e8f7447b6a7db13b4dbcefea258e430a4f
-
SHA256
42a3a11367f39f4b5dda0d40b1183330072f8d85c3d2e79e42c46489e7dcce1d
-
SHA512
790726f6e8045324e1482e8614194299f1b501fa73f22ef516dddf5157404fbaeb7ef1983f4f771f34673d6749853a236ceff97be3e58d32740d2e08b7f5e349
-
SSDEEP
6144:ALaTiFA3m+iCOvax2wVTqUiYTOefJC/cpTQbrZxBqZugCoZsBgbIOHH4:AuTH3mzCYA20mMOehjkbr7BUug6gbL4
Score
10/10
Malware Config
Extracted
Family
fickerstealer
C2
fasdas.link:8080
Signatures
-
Fickerstealer
Ficker is an infostealer written in Rust and ASM.
-
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 3 api.ipify.org -
Drops file in System32 directory 1 IoCs
description ioc Process File opened for modification C:\Windows\system32\eventvwr.msc mmc.exe -
Suspicious use of SetThreadContext 3 IoCs
description pid Process procid_target PID 1636 set thread context of 1932 1636 42a3a11367f39f4b5dda0d40b1183330072f8d85c3d2e79e42c46489e7dcce1d.exe 26 PID 2000 set thread context of 1788 2000 42a3a11367f39f4b5dda0d40b1183330072f8d85c3d2e79e42c46489e7dcce1d.exe 32 PID 1268 set thread context of 1508 1268 42a3a11367f39f4b5dda0d40b1183330072f8d85c3d2e79e42c46489e7dcce1d.exe 34 -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1168 taskmgr.exe 1168 taskmgr.exe 1168 taskmgr.exe 1168 taskmgr.exe 1168 taskmgr.exe 1168 taskmgr.exe 1168 taskmgr.exe 1168 taskmgr.exe 1168 taskmgr.exe 1168 taskmgr.exe 1168 taskmgr.exe 1168 taskmgr.exe 1168 taskmgr.exe 1168 taskmgr.exe 1168 taskmgr.exe 1168 taskmgr.exe 1168 taskmgr.exe 1168 taskmgr.exe 1168 taskmgr.exe 1168 taskmgr.exe 1168 taskmgr.exe 1168 taskmgr.exe 1168 taskmgr.exe 1168 taskmgr.exe 1168 taskmgr.exe 1168 taskmgr.exe 1168 taskmgr.exe 1168 taskmgr.exe 1168 taskmgr.exe 1168 taskmgr.exe 1168 taskmgr.exe 1168 taskmgr.exe 1168 taskmgr.exe 1168 taskmgr.exe 1168 taskmgr.exe 1168 taskmgr.exe 1168 taskmgr.exe 1168 taskmgr.exe 1168 taskmgr.exe 1168 taskmgr.exe 1168 taskmgr.exe 1168 taskmgr.exe 1168 taskmgr.exe 1168 taskmgr.exe 1168 taskmgr.exe 1168 taskmgr.exe 1168 taskmgr.exe 1168 taskmgr.exe 1168 taskmgr.exe 1168 taskmgr.exe 1168 taskmgr.exe 1168 taskmgr.exe 1168 taskmgr.exe 1168 taskmgr.exe 1168 taskmgr.exe 1168 taskmgr.exe 1168 taskmgr.exe 1168 taskmgr.exe 1168 taskmgr.exe 1168 taskmgr.exe 1168 taskmgr.exe 1168 taskmgr.exe 1168 taskmgr.exe 1168 taskmgr.exe -
Suspicious behavior: GetForegroundWindowSpam 2 IoCs
pid Process 1168 taskmgr.exe 272 mmc.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 1168 taskmgr.exe Token: SeSecurityPrivilege 272 mmc.exe Token: 33 272 mmc.exe Token: SeIncBasePriorityPrivilege 272 mmc.exe Token: 33 272 mmc.exe Token: SeIncBasePriorityPrivilege 272 mmc.exe Token: 33 272 mmc.exe Token: SeIncBasePriorityPrivilege 272 mmc.exe Token: 33 272 mmc.exe Token: SeIncBasePriorityPrivilege 272 mmc.exe Token: 33 272 mmc.exe Token: SeIncBasePriorityPrivilege 272 mmc.exe Token: 33 272 mmc.exe Token: SeIncBasePriorityPrivilege 272 mmc.exe Token: 33 272 mmc.exe Token: SeIncBasePriorityPrivilege 272 mmc.exe Token: 33 272 mmc.exe Token: SeIncBasePriorityPrivilege 272 mmc.exe Token: 33 272 mmc.exe Token: SeIncBasePriorityPrivilege 272 mmc.exe Token: 33 272 mmc.exe Token: SeIncBasePriorityPrivilege 272 mmc.exe Token: 33 272 mmc.exe Token: SeIncBasePriorityPrivilege 272 mmc.exe Token: 33 272 mmc.exe Token: SeIncBasePriorityPrivilege 272 mmc.exe Token: 33 272 mmc.exe Token: SeIncBasePriorityPrivilege 272 mmc.exe Token: 33 272 mmc.exe Token: SeIncBasePriorityPrivilege 272 mmc.exe Token: 33 272 mmc.exe Token: SeIncBasePriorityPrivilege 272 mmc.exe Token: 33 272 mmc.exe Token: SeIncBasePriorityPrivilege 272 mmc.exe Token: 33 272 mmc.exe Token: SeIncBasePriorityPrivilege 272 mmc.exe Token: SeSecurityPrivilege 272 mmc.exe Token: 33 272 mmc.exe Token: SeIncBasePriorityPrivilege 272 mmc.exe Token: 33 272 mmc.exe Token: SeIncBasePriorityPrivilege 272 mmc.exe Token: 33 272 mmc.exe Token: SeIncBasePriorityPrivilege 272 mmc.exe Token: 33 272 mmc.exe Token: SeIncBasePriorityPrivilege 272 mmc.exe Token: 33 272 mmc.exe Token: SeIncBasePriorityPrivilege 272 mmc.exe Token: 33 272 mmc.exe Token: SeIncBasePriorityPrivilege 272 mmc.exe Token: 33 272 mmc.exe Token: SeIncBasePriorityPrivilege 272 mmc.exe Token: 33 272 mmc.exe Token: SeIncBasePriorityPrivilege 272 mmc.exe Token: 33 272 mmc.exe Token: SeIncBasePriorityPrivilege 272 mmc.exe Token: 33 272 mmc.exe Token: SeIncBasePriorityPrivilege 272 mmc.exe Token: 33 272 mmc.exe Token: SeIncBasePriorityPrivilege 272 mmc.exe Token: 33 272 mmc.exe Token: SeIncBasePriorityPrivilege 272 mmc.exe Token: 33 272 mmc.exe Token: SeIncBasePriorityPrivilege 272 mmc.exe Token: 33 272 mmc.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 1168 taskmgr.exe 1168 taskmgr.exe 1168 taskmgr.exe 1168 taskmgr.exe 1168 taskmgr.exe 1168 taskmgr.exe 1168 taskmgr.exe 1168 taskmgr.exe 1168 taskmgr.exe 1168 taskmgr.exe 1168 taskmgr.exe 1168 taskmgr.exe 1168 taskmgr.exe 1168 taskmgr.exe 1168 taskmgr.exe 1168 taskmgr.exe 1168 taskmgr.exe 1168 taskmgr.exe 1168 taskmgr.exe 1168 taskmgr.exe 1168 taskmgr.exe 1168 taskmgr.exe 1168 taskmgr.exe 1168 taskmgr.exe 1168 taskmgr.exe 1168 taskmgr.exe 1168 taskmgr.exe 1168 taskmgr.exe 1168 taskmgr.exe 1168 taskmgr.exe 1168 taskmgr.exe 1168 taskmgr.exe 1168 taskmgr.exe 1168 taskmgr.exe 1168 taskmgr.exe 1168 taskmgr.exe 1168 taskmgr.exe 1168 taskmgr.exe 1168 taskmgr.exe 1168 taskmgr.exe 1168 taskmgr.exe 1168 taskmgr.exe 1168 taskmgr.exe 1168 taskmgr.exe 1168 taskmgr.exe 1168 taskmgr.exe 1168 taskmgr.exe 1168 taskmgr.exe 1168 taskmgr.exe 1168 taskmgr.exe 1168 taskmgr.exe 1168 taskmgr.exe 1168 taskmgr.exe 1168 taskmgr.exe 1168 taskmgr.exe 1168 taskmgr.exe 1168 taskmgr.exe 1168 taskmgr.exe 1168 taskmgr.exe 1168 taskmgr.exe 1168 taskmgr.exe 1168 taskmgr.exe 1168 taskmgr.exe 1168 taskmgr.exe -
Suspicious use of SendNotifyMessage 64 IoCs
pid Process 1168 taskmgr.exe 1168 taskmgr.exe 1168 taskmgr.exe 1168 taskmgr.exe 1168 taskmgr.exe 1168 taskmgr.exe 1168 taskmgr.exe 1168 taskmgr.exe 1168 taskmgr.exe 1168 taskmgr.exe 1168 taskmgr.exe 1168 taskmgr.exe 1168 taskmgr.exe 1168 taskmgr.exe 1168 taskmgr.exe 1168 taskmgr.exe 1168 taskmgr.exe 1168 taskmgr.exe 1168 taskmgr.exe 1168 taskmgr.exe 1168 taskmgr.exe 1168 taskmgr.exe 1168 taskmgr.exe 1168 taskmgr.exe 1168 taskmgr.exe 1168 taskmgr.exe 1168 taskmgr.exe 1168 taskmgr.exe 1168 taskmgr.exe 1168 taskmgr.exe 1168 taskmgr.exe 1168 taskmgr.exe 1168 taskmgr.exe 1168 taskmgr.exe 1168 taskmgr.exe 1168 taskmgr.exe 1168 taskmgr.exe 1168 taskmgr.exe 1168 taskmgr.exe 1168 taskmgr.exe 1168 taskmgr.exe 1168 taskmgr.exe 1168 taskmgr.exe 1168 taskmgr.exe 1168 taskmgr.exe 1168 taskmgr.exe 1168 taskmgr.exe 1168 taskmgr.exe 1168 taskmgr.exe 1168 taskmgr.exe 1168 taskmgr.exe 1168 taskmgr.exe 1168 taskmgr.exe 1168 taskmgr.exe 1168 taskmgr.exe 1168 taskmgr.exe 1168 taskmgr.exe 1168 taskmgr.exe 1168 taskmgr.exe 1168 taskmgr.exe 1168 taskmgr.exe 1168 taskmgr.exe 1168 taskmgr.exe 1168 taskmgr.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 272 mmc.exe 272 mmc.exe -
Suspicious use of WriteProcessMemory 42 IoCs
description pid Process procid_target PID 1636 wrote to memory of 1932 1636 42a3a11367f39f4b5dda0d40b1183330072f8d85c3d2e79e42c46489e7dcce1d.exe 26 PID 1636 wrote to memory of 1932 1636 42a3a11367f39f4b5dda0d40b1183330072f8d85c3d2e79e42c46489e7dcce1d.exe 26 PID 1636 wrote to memory of 1932 1636 42a3a11367f39f4b5dda0d40b1183330072f8d85c3d2e79e42c46489e7dcce1d.exe 26 PID 1636 wrote to memory of 1932 1636 42a3a11367f39f4b5dda0d40b1183330072f8d85c3d2e79e42c46489e7dcce1d.exe 26 PID 1636 wrote to memory of 1932 1636 42a3a11367f39f4b5dda0d40b1183330072f8d85c3d2e79e42c46489e7dcce1d.exe 26 PID 1636 wrote to memory of 1932 1636 42a3a11367f39f4b5dda0d40b1183330072f8d85c3d2e79e42c46489e7dcce1d.exe 26 PID 1636 wrote to memory of 1932 1636 42a3a11367f39f4b5dda0d40b1183330072f8d85c3d2e79e42c46489e7dcce1d.exe 26 PID 1636 wrote to memory of 1932 1636 42a3a11367f39f4b5dda0d40b1183330072f8d85c3d2e79e42c46489e7dcce1d.exe 26 PID 1636 wrote to memory of 1932 1636 42a3a11367f39f4b5dda0d40b1183330072f8d85c3d2e79e42c46489e7dcce1d.exe 26 PID 1636 wrote to memory of 1932 1636 42a3a11367f39f4b5dda0d40b1183330072f8d85c3d2e79e42c46489e7dcce1d.exe 26 PID 1636 wrote to memory of 1932 1636 42a3a11367f39f4b5dda0d40b1183330072f8d85c3d2e79e42c46489e7dcce1d.exe 26 PID 1636 wrote to memory of 1932 1636 42a3a11367f39f4b5dda0d40b1183330072f8d85c3d2e79e42c46489e7dcce1d.exe 26 PID 1636 wrote to memory of 1932 1636 42a3a11367f39f4b5dda0d40b1183330072f8d85c3d2e79e42c46489e7dcce1d.exe 26 PID 1636 wrote to memory of 1932 1636 42a3a11367f39f4b5dda0d40b1183330072f8d85c3d2e79e42c46489e7dcce1d.exe 26 PID 2000 wrote to memory of 1788 2000 42a3a11367f39f4b5dda0d40b1183330072f8d85c3d2e79e42c46489e7dcce1d.exe 32 PID 2000 wrote to memory of 1788 2000 42a3a11367f39f4b5dda0d40b1183330072f8d85c3d2e79e42c46489e7dcce1d.exe 32 PID 2000 wrote to memory of 1788 2000 42a3a11367f39f4b5dda0d40b1183330072f8d85c3d2e79e42c46489e7dcce1d.exe 32 PID 2000 wrote to memory of 1788 2000 42a3a11367f39f4b5dda0d40b1183330072f8d85c3d2e79e42c46489e7dcce1d.exe 32 PID 2000 wrote to memory of 1788 2000 42a3a11367f39f4b5dda0d40b1183330072f8d85c3d2e79e42c46489e7dcce1d.exe 32 PID 2000 wrote to memory of 1788 2000 42a3a11367f39f4b5dda0d40b1183330072f8d85c3d2e79e42c46489e7dcce1d.exe 32 PID 2000 wrote to memory of 1788 2000 42a3a11367f39f4b5dda0d40b1183330072f8d85c3d2e79e42c46489e7dcce1d.exe 32 PID 2000 wrote to memory of 1788 2000 42a3a11367f39f4b5dda0d40b1183330072f8d85c3d2e79e42c46489e7dcce1d.exe 32 PID 2000 wrote to memory of 1788 2000 42a3a11367f39f4b5dda0d40b1183330072f8d85c3d2e79e42c46489e7dcce1d.exe 32 PID 2000 wrote to memory of 1788 2000 42a3a11367f39f4b5dda0d40b1183330072f8d85c3d2e79e42c46489e7dcce1d.exe 32 PID 2000 wrote to memory of 1788 2000 42a3a11367f39f4b5dda0d40b1183330072f8d85c3d2e79e42c46489e7dcce1d.exe 32 PID 2000 wrote to memory of 1788 2000 42a3a11367f39f4b5dda0d40b1183330072f8d85c3d2e79e42c46489e7dcce1d.exe 32 PID 2000 wrote to memory of 1788 2000 42a3a11367f39f4b5dda0d40b1183330072f8d85c3d2e79e42c46489e7dcce1d.exe 32 PID 2000 wrote to memory of 1788 2000 42a3a11367f39f4b5dda0d40b1183330072f8d85c3d2e79e42c46489e7dcce1d.exe 32 PID 1268 wrote to memory of 1508 1268 42a3a11367f39f4b5dda0d40b1183330072f8d85c3d2e79e42c46489e7dcce1d.exe 34 PID 1268 wrote to memory of 1508 1268 42a3a11367f39f4b5dda0d40b1183330072f8d85c3d2e79e42c46489e7dcce1d.exe 34 PID 1268 wrote to memory of 1508 1268 42a3a11367f39f4b5dda0d40b1183330072f8d85c3d2e79e42c46489e7dcce1d.exe 34 PID 1268 wrote to memory of 1508 1268 42a3a11367f39f4b5dda0d40b1183330072f8d85c3d2e79e42c46489e7dcce1d.exe 34 PID 1268 wrote to memory of 1508 1268 42a3a11367f39f4b5dda0d40b1183330072f8d85c3d2e79e42c46489e7dcce1d.exe 34 PID 1268 wrote to memory of 1508 1268 42a3a11367f39f4b5dda0d40b1183330072f8d85c3d2e79e42c46489e7dcce1d.exe 34 PID 1268 wrote to memory of 1508 1268 42a3a11367f39f4b5dda0d40b1183330072f8d85c3d2e79e42c46489e7dcce1d.exe 34 PID 1268 wrote to memory of 1508 1268 42a3a11367f39f4b5dda0d40b1183330072f8d85c3d2e79e42c46489e7dcce1d.exe 34 PID 1268 wrote to memory of 1508 1268 42a3a11367f39f4b5dda0d40b1183330072f8d85c3d2e79e42c46489e7dcce1d.exe 34 PID 1268 wrote to memory of 1508 1268 42a3a11367f39f4b5dda0d40b1183330072f8d85c3d2e79e42c46489e7dcce1d.exe 34 PID 1268 wrote to memory of 1508 1268 42a3a11367f39f4b5dda0d40b1183330072f8d85c3d2e79e42c46489e7dcce1d.exe 34 PID 1268 wrote to memory of 1508 1268 42a3a11367f39f4b5dda0d40b1183330072f8d85c3d2e79e42c46489e7dcce1d.exe 34 PID 1268 wrote to memory of 1508 1268 42a3a11367f39f4b5dda0d40b1183330072f8d85c3d2e79e42c46489e7dcce1d.exe 34 PID 1268 wrote to memory of 1508 1268 42a3a11367f39f4b5dda0d40b1183330072f8d85c3d2e79e42c46489e7dcce1d.exe 34
Processes
-
C:\Users\Admin\AppData\Local\Temp\42a3a11367f39f4b5dda0d40b1183330072f8d85c3d2e79e42c46489e7dcce1d.exe"C:\Users\Admin\AppData\Local\Temp\42a3a11367f39f4b5dda0d40b1183330072f8d85c3d2e79e42c46489e7dcce1d.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1636 -
C:\Users\Admin\AppData\Local\Temp\42a3a11367f39f4b5dda0d40b1183330072f8d85c3d2e79e42c46489e7dcce1d.exe"C:\Users\Admin\AppData\Local\Temp\42a3a11367f39f4b5dda0d40b1183330072f8d85c3d2e79e42c46489e7dcce1d.exe"2⤵PID:1932
-
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1168
-
C:\Users\Admin\AppData\Local\Temp\42a3a11367f39f4b5dda0d40b1183330072f8d85c3d2e79e42c46489e7dcce1d.exe"C:\Users\Admin\AppData\Local\Temp\42a3a11367f39f4b5dda0d40b1183330072f8d85c3d2e79e42c46489e7dcce1d.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2000 -
C:\Users\Admin\AppData\Local\Temp\42a3a11367f39f4b5dda0d40b1183330072f8d85c3d2e79e42c46489e7dcce1d.exe"C:\Users\Admin\AppData\Local\Temp\42a3a11367f39f4b5dda0d40b1183330072f8d85c3d2e79e42c46489e7dcce1d.exe"2⤵PID:1788
-
-
C:\Users\Admin\AppData\Local\Temp\42a3a11367f39f4b5dda0d40b1183330072f8d85c3d2e79e42c46489e7dcce1d.exe"C:\Users\Admin\AppData\Local\Temp\42a3a11367f39f4b5dda0d40b1183330072f8d85c3d2e79e42c46489e7dcce1d.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1268 -
C:\Users\Admin\AppData\Local\Temp\42a3a11367f39f4b5dda0d40b1183330072f8d85c3d2e79e42c46489e7dcce1d.exe"C:\Users\Admin\AppData\Local\Temp\42a3a11367f39f4b5dda0d40b1183330072f8d85c3d2e79e42c46489e7dcce1d.exe"2⤵PID:1508
-
-
C:\Windows\system32\mmc.exe"C:\Windows\system32\mmc.exe" "C:\Windows\system32\eventvwr.msc" /s1⤵
- Drops file in System32 directory
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:272
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
12B
MD571d587e911373f62d72a158eceb6e0e7
SHA168d81a1a4fb19c609288a94f10d1bbb92d972a68
SHA256acce61361a3dee677653fa2909f29530202335835c71031ba4dff50682ae5de8
SHA512a0010c487c8b1eeae82ae82896bf5f48b7ec5573197bbe149b6803093a32b3b470ef0b122278e404cd5df296376bb0629438609997d52c14757ff1c3e6756060
-
Filesize
109B
MD5884320a9b8f018f309f5a96107133f89
SHA1102e8a8f3c91a10d9d670e0b3715bd2e0acee5ff
SHA25650fd9d76d1c43bb16b166de02aaf8adec09eb5bc4cefdca9d1af2e0f7b1d8f64
SHA512b815fcbd7263b6667f01478b955f9734b1bddbcd7ca8e62ef8ff1ec46ed99931ba466c976ac781f1bd899125571585d580f6f232cc37b8e9ed87935981b99b78