fickerstealer | 7c2b51c31a895f2eeb6afe748f11d0f6a16355b01c41f22749043c0da7804206

Analysis

max time kernel
306s
max time network
320s
platform
windows10-2004_x64
resource
win10v2004-20230703-en
resource tags

arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
submitted
31-07-2023 16:13

Target

Setup.exe
Size

793.8MB
MD5

9a851a47a9bd2f92c61d2486d1be3064
SHA1

3cda31c06db97246705d95dfcf4908eafb514b87
SHA256

7c2b51c31a895f2eeb6afe748f11d0f6a16355b01c41f22749043c0da7804206
SHA512

90340910dc1ee90ccfe7f451578de67c5ca32b95525157acd8b5bc2e99b9c0b2254bfb58997cc848a0ead871bc3f1e03dbb152d56aa709c4ecd3742404eec27b
SSDEEP

196608:6spHQk/ICYcdYtOQYMvm6Iu+8RuJQHIsuRuJyPquRuJXMD349nt3njto03qJbYav:6csCYgIBH2XD349nt3nW03s8up

Score

10^/10

Family

fickerstealer

45.93.201.181:80

Fickerstealer
Ficker is an infostealer written in Rust and ASM.
infostealer fickerstealer

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
22	api.ipify.org

Suspicious behavior: EnumeratesProcesses 42 IoCs

Suspicious use of WriteProcessMemory 21 IoCs

description	pid	Process	procid_target
PID 3332 wrote to memory of 4804	3332	Setup.exe	93
PID 3332 wrote to memory of 4804	3332	Setup.exe	93
PID 3332 wrote to memory of 4804	3332	Setup.exe	93
PID 3332 wrote to memory of 4804	3332	Setup.exe	93
PID 3332 wrote to memory of 4804	3332	Setup.exe	93
PID 3332 wrote to memory of 4804	3332	Setup.exe	93
PID 3332 wrote to memory of 4804	3332	Setup.exe	93
PID 3332 wrote to memory of 4804	3332	Setup.exe	93
PID 3332 wrote to memory of 4804	3332	Setup.exe	93
PID 3332 wrote to memory of 4804	3332	Setup.exe	93
PID 3332 wrote to memory of 4804	3332	Setup.exe	93
PID 3332 wrote to memory of 4804	3332	Setup.exe	93
PID 3332 wrote to memory of 4804	3332	Setup.exe	93
PID 3332 wrote to memory of 4804	3332	Setup.exe	93
PID 3332 wrote to memory of 4804	3332	Setup.exe	93
PID 3332 wrote to memory of 4804	3332	Setup.exe	93
PID 3332 wrote to memory of 4804	3332	Setup.exe	93
PID 3332 wrote to memory of 4804	3332	Setup.exe	93
PID 3332 wrote to memory of 4804	3332	Setup.exe	93
PID 3332 wrote to memory of 4804	3332	Setup.exe	93
PID 3332 wrote to memory of 4804	3332	Setup.exe	93

C:\Users\Admin\AppData\Local\Temp\Setup.exe
"C:\Users\Admin\AppData\Local\Temp\Setup.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3332
- C:\Users\Admin\AppData\Local\Temp\Setup.exe
  "C:\Users\Admin\AppData\Local\Temp\Setup.exe"
  2⤵
  PID:4804

C:\ProgramData\krosqm.txt

Filesize
12B

MD5
71d587e911373f62d72a158eceb6e0e7

SHA1
68d81a1a4fb19c609288a94f10d1bbb92d972a68

SHA256
acce61361a3dee677653fa2909f29530202335835c71031ba4dff50682ae5de8

SHA512
a0010c487c8b1eeae82ae82896bf5f48b7ec5573197bbe149b6803093a32b3b470ef0b122278e404cd5df296376bb0629438609997d52c14757ff1c3e6756060

Download Submit
memory/3332-133-0x0000000000400000-0x0000000001400000-memory.dmp

Filesize
16.0MB

Download
memory/3332-134-0x0000000032070000-0x00000000320EB000-memory.dmp

Filesize
492KB

Download
memory/3332-135-0x0000000077682000-0x0000000077683000-memory.dmp

Filesize
4KB

Download
memory/3332-136-0x0000000033C30000-0x0000000033DD3000-memory.dmp

Filesize
1.6MB

Download
memory/3332-144-0x0000000032070000-0x00000000320EB000-memory.dmp

Filesize
492KB

Download
memory/4804-139-0x0000000000400000-0x0000000000466000-memory.dmp

Filesize
408KB

Download
memory/4804-137-0x0000000077682000-0x0000000077683000-memory.dmp

Filesize
4KB

Download
memory/4804-140-0x0000000000400000-0x0000000000466000-memory.dmp

Filesize
408KB

Download
memory/4804-143-0x0000000000400000-0x0000000000466000-memory.dmp

Filesize
408KB

Download
memory/4804-145-0x00000000001C0000-0x00000000001C1000-memory.dmp

Filesize
4KB

Download
memory/4804-151-0x0000000000400000-0x0000000000466000-memory.dmp

Filesize
408KB

Download