Analysis
-
max time kernel
1807s -
max time network
1818s -
platform
windows10-1703_x64 -
resource
win10-20230220-en -
resource tags
arch:x64arch:x86image:win10-20230220-enlocale:en-usos:windows10-1703-x64system -
submitted
27-05-2023 14:27
Static task
static1
Behavioral task
behavioral1
Sample
Setup.exe
Resource
win10-20230220-en
General
-
Target
Setup.exe
-
Size
793.8MB
-
MD5
9a851a47a9bd2f92c61d2486d1be3064
-
SHA1
3cda31c06db97246705d95dfcf4908eafb514b87
-
SHA256
7c2b51c31a895f2eeb6afe748f11d0f6a16355b01c41f22749043c0da7804206
-
SHA512
90340910dc1ee90ccfe7f451578de67c5ca32b95525157acd8b5bc2e99b9c0b2254bfb58997cc848a0ead871bc3f1e03dbb152d56aa709c4ecd3742404eec27b
-
SSDEEP
196608:6spHQk/ICYcdYtOQYMvm6Iu+8RuJQHIsuRuJyPquRuJXMD349nt3njto03qJbYav:6csCYgIBH2XD349nt3nW03s8up
Malware Config
Extracted
fickerstealer
45.93.201.181:80
Signatures
-
Fickerstealer
Ficker is an infostealer written in Rust and ASM.
-
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 3 api.ipify.org -
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 3188 2960 WerFault.exe Setup.exe -
Suspicious behavior: EnumeratesProcesses 42 IoCs
Processes:
Setup.exepid process 1892 Setup.exe 1892 Setup.exe 1892 Setup.exe 1892 Setup.exe 1892 Setup.exe 1892 Setup.exe 1892 Setup.exe 1892 Setup.exe 1892 Setup.exe 1892 Setup.exe 1892 Setup.exe 1892 Setup.exe 1892 Setup.exe 1892 Setup.exe 1892 Setup.exe 1892 Setup.exe 1892 Setup.exe 1892 Setup.exe 1892 Setup.exe 1892 Setup.exe 1892 Setup.exe 1892 Setup.exe 1892 Setup.exe 1892 Setup.exe 1892 Setup.exe 1892 Setup.exe 1892 Setup.exe 1892 Setup.exe 1892 Setup.exe 1892 Setup.exe 1892 Setup.exe 1892 Setup.exe 1892 Setup.exe 1892 Setup.exe 1892 Setup.exe 1892 Setup.exe 1892 Setup.exe 1892 Setup.exe 1892 Setup.exe 1892 Setup.exe 1892 Setup.exe 1892 Setup.exe -
Suspicious use of WriteProcessMemory 21 IoCs
Processes:
Setup.exedescription pid process target process PID 1892 wrote to memory of 2960 1892 Setup.exe Setup.exe PID 1892 wrote to memory of 2960 1892 Setup.exe Setup.exe PID 1892 wrote to memory of 2960 1892 Setup.exe Setup.exe PID 1892 wrote to memory of 2960 1892 Setup.exe Setup.exe PID 1892 wrote to memory of 2960 1892 Setup.exe Setup.exe PID 1892 wrote to memory of 2960 1892 Setup.exe Setup.exe PID 1892 wrote to memory of 2960 1892 Setup.exe Setup.exe PID 1892 wrote to memory of 2960 1892 Setup.exe Setup.exe PID 1892 wrote to memory of 2960 1892 Setup.exe Setup.exe PID 1892 wrote to memory of 2960 1892 Setup.exe Setup.exe PID 1892 wrote to memory of 2960 1892 Setup.exe Setup.exe PID 1892 wrote to memory of 2960 1892 Setup.exe Setup.exe PID 1892 wrote to memory of 2960 1892 Setup.exe Setup.exe PID 1892 wrote to memory of 2960 1892 Setup.exe Setup.exe PID 1892 wrote to memory of 2960 1892 Setup.exe Setup.exe PID 1892 wrote to memory of 2960 1892 Setup.exe Setup.exe PID 1892 wrote to memory of 2960 1892 Setup.exe Setup.exe PID 1892 wrote to memory of 2960 1892 Setup.exe Setup.exe PID 1892 wrote to memory of 2960 1892 Setup.exe Setup.exe PID 1892 wrote to memory of 2960 1892 Setup.exe Setup.exe PID 1892 wrote to memory of 2960 1892 Setup.exe Setup.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Setup.exe"C:\Users\Admin\AppData\Local\Temp\Setup.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Setup.exe"C:\Users\Admin\AppData\Local\Temp\Setup.exe"2⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2960 -s 16603⤵
- Program crash
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1892-121-0x0000000000400000-0x0000000001400000-memory.dmpFilesize
16.0MB
-
memory/1892-122-0x0000000033A70000-0x0000000033AEB000-memory.dmpFilesize
492KB
-
memory/1892-127-0x0000000033BD0000-0x0000000033D5E000-memory.dmpFilesize
1.6MB
-
memory/1892-130-0x0000000033A70000-0x0000000033AEB000-memory.dmpFilesize
492KB
-
memory/2960-124-0x0000000000400000-0x0000000000466000-memory.dmpFilesize
408KB
-
memory/2960-125-0x0000000000400000-0x0000000000466000-memory.dmpFilesize
408KB
-
memory/2960-126-0x0000000000400000-0x0000000000466000-memory.dmpFilesize
408KB
-
memory/2960-128-0x00000000001C0000-0x00000000001C1000-memory.dmpFilesize
4KB
-
memory/2960-131-0x0000000000400000-0x0000000000466000-memory.dmpFilesize
408KB