fickerstealer | 650d6515a224637d65394be9f6a5790cf09ba5e0da0099b4c4b274b62beb008b

Analysis

max time kernel
142s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
28-12-2023 05:44

Target

c8b6cdc61f0434ad4184c82017b3b61e.exe
Size

590KB
MD5

c8b6cdc61f0434ad4184c82017b3b61e
SHA1

d4788225dc46d5ea0e04fea397dc8b44bf91629c
SHA256

650d6515a224637d65394be9f6a5790cf09ba5e0da0099b4c4b274b62beb008b
SHA512

7d1c8fb8917809c68357e8fb6eafa6413671108798536f21072f8c463adaf96dc0a2e784e4749da677ea3d982ff5f2c1170dfd4922a9e8dbe87f2a640a0e6048
SSDEEP

12288:dLqaFu1RWTjI+oK6jXso36wt9deuzGWaFwslMW0rwrsu:saFu1mj96Dsq6wt9d9ZaWoh3

Score

10^/10

Family

fickerstealer

80.87.192.115:80

Fickerstealer
Ficker is an infostealer written in Rust and ASM.
infostealer fickerstealer

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow	ioc
11	api.ipify.org

Suspicious use of SetThreadContext 1 IoCs

Processes:

c8b6cdc61f0434ad4184c82017b3b61e.exe

description	pid	Process	procid_target
PID 1776 set thread context of 3416	1776	c8b6cdc61f0434ad4184c82017b3b61e.exe	40

Suspicious use of WriteProcessMemory 19 IoCs

Processes:

c8b6cdc61f0434ad4184c82017b3b61e.exe

description	pid	Process	procid_target
PID 1776 wrote to memory of 3416	1776	c8b6cdc61f0434ad4184c82017b3b61e.exe	40
PID 1776 wrote to memory of 3416	1776	c8b6cdc61f0434ad4184c82017b3b61e.exe	40
PID 1776 wrote to memory of 3416	1776	c8b6cdc61f0434ad4184c82017b3b61e.exe	40
PID 1776 wrote to memory of 3416	1776	c8b6cdc61f0434ad4184c82017b3b61e.exe	40
PID 1776 wrote to memory of 3416	1776	c8b6cdc61f0434ad4184c82017b3b61e.exe	40
PID 1776 wrote to memory of 3416	1776	c8b6cdc61f0434ad4184c82017b3b61e.exe	40
PID 1776 wrote to memory of 3416	1776	c8b6cdc61f0434ad4184c82017b3b61e.exe	40
PID 1776 wrote to memory of 3416	1776	c8b6cdc61f0434ad4184c82017b3b61e.exe	40
PID 1776 wrote to memory of 3416	1776	c8b6cdc61f0434ad4184c82017b3b61e.exe	40
PID 1776 wrote to memory of 3416	1776	c8b6cdc61f0434ad4184c82017b3b61e.exe	40
PID 1776 wrote to memory of 3416	1776	c8b6cdc61f0434ad4184c82017b3b61e.exe	40
PID 1776 wrote to memory of 3416	1776	c8b6cdc61f0434ad4184c82017b3b61e.exe	40
PID 1776 wrote to memory of 3416	1776	c8b6cdc61f0434ad4184c82017b3b61e.exe	40
PID 1776 wrote to memory of 3416	1776	c8b6cdc61f0434ad4184c82017b3b61e.exe	40
PID 1776 wrote to memory of 3416	1776	c8b6cdc61f0434ad4184c82017b3b61e.exe	40
PID 1776 wrote to memory of 3416	1776	c8b6cdc61f0434ad4184c82017b3b61e.exe	40
PID 1776 wrote to memory of 3416	1776	c8b6cdc61f0434ad4184c82017b3b61e.exe	40
PID 1776 wrote to memory of 3416	1776	c8b6cdc61f0434ad4184c82017b3b61e.exe	40
PID 1776 wrote to memory of 3416	1776	c8b6cdc61f0434ad4184c82017b3b61e.exe	40

C:\Users\Admin\AppData\Local\Temp\c8b6cdc61f0434ad4184c82017b3b61e.exe
"C:\Users\Admin\AppData\Local\Temp\c8b6cdc61f0434ad4184c82017b3b61e.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1776
- C:\Users\Admin\AppData\Local\Temp\c8b6cdc61f0434ad4184c82017b3b61e.exe
  "C:\Users\Admin\AppData\Local\Temp\c8b6cdc61f0434ad4184c82017b3b61e.exe"
  2⤵
  PID:3416

C:\ProgramData\kaosdma.txt

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
memory/1776-2-0x0000000004FD0000-0x0000000005017000-memory.dmp

Filesize
284KB

Download
memory/1776-1-0x0000000003530000-0x0000000003630000-memory.dmp

Filesize
1024KB

Download
memory/3416-5-0x0000000000400000-0x000000000044F000-memory.dmp

Filesize
316KB

Download
memory/3416-6-0x0000000000400000-0x000000000044F000-memory.dmp

Filesize
316KB

Download
memory/3416-3-0x0000000000400000-0x000000000044F000-memory.dmp

Filesize
316KB

Download
memory/3416-12-0x0000000000400000-0x000000000044F000-memory.dmp

Filesize
316KB

Download