fickerstealer | 067cab9c4123e51af9d20ae94bb59c21b207fc45a106046470c2b2d5283cf15e

Analysis

max time kernel
145s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
30-12-2023 22:25

Target

1e6666100c72fac437bfebd67672844a.exe
Size

570KB
MD5

1e6666100c72fac437bfebd67672844a
SHA1

cae5be67b0fde097e041520bb5ec51980dc7df68
SHA256

067cab9c4123e51af9d20ae94bb59c21b207fc45a106046470c2b2d5283cf15e
SHA512

21c23eea9f3a82e627eb6ce7680d24e49eab413139b571848a84a58e47d6e15b1c054e588c22b92e7eabf273e25a567efc367bca80f2192bf977c9b3451ba38c
SSDEEP

12288:9UiUE+VmwCIeTxmHRzHVgybaUqTMW0rwrsu:J+Vmw9HZ1g41qTh3

Score

10^/10

Family

fickerstealer

80.87.192.115:80

Fickerstealer
Ficker is an infostealer written in Rust and ASM.
infostealer fickerstealer

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
8	api.ipify.org

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 8 set thread context of 3460	8	1e6666100c72fac437bfebd67672844a.exe	90

Suspicious use of WriteProcessMemory 19 IoCs

description	pid	Process	procid_target
PID 8 wrote to memory of 3460	8	1e6666100c72fac437bfebd67672844a.exe	90
PID 8 wrote to memory of 3460	8	1e6666100c72fac437bfebd67672844a.exe	90
PID 8 wrote to memory of 3460	8	1e6666100c72fac437bfebd67672844a.exe	90
PID 8 wrote to memory of 3460	8	1e6666100c72fac437bfebd67672844a.exe	90
PID 8 wrote to memory of 3460	8	1e6666100c72fac437bfebd67672844a.exe	90
PID 8 wrote to memory of 3460	8	1e6666100c72fac437bfebd67672844a.exe	90
PID 8 wrote to memory of 3460	8	1e6666100c72fac437bfebd67672844a.exe	90
PID 8 wrote to memory of 3460	8	1e6666100c72fac437bfebd67672844a.exe	90
PID 8 wrote to memory of 3460	8	1e6666100c72fac437bfebd67672844a.exe	90
PID 8 wrote to memory of 3460	8	1e6666100c72fac437bfebd67672844a.exe	90
PID 8 wrote to memory of 3460	8	1e6666100c72fac437bfebd67672844a.exe	90
PID 8 wrote to memory of 3460	8	1e6666100c72fac437bfebd67672844a.exe	90
PID 8 wrote to memory of 3460	8	1e6666100c72fac437bfebd67672844a.exe	90
PID 8 wrote to memory of 3460	8	1e6666100c72fac437bfebd67672844a.exe	90
PID 8 wrote to memory of 3460	8	1e6666100c72fac437bfebd67672844a.exe	90
PID 8 wrote to memory of 3460	8	1e6666100c72fac437bfebd67672844a.exe	90
PID 8 wrote to memory of 3460	8	1e6666100c72fac437bfebd67672844a.exe	90
PID 8 wrote to memory of 3460	8	1e6666100c72fac437bfebd67672844a.exe	90
PID 8 wrote to memory of 3460	8	1e6666100c72fac437bfebd67672844a.exe	90

C:\Users\Admin\AppData\Local\Temp\1e6666100c72fac437bfebd67672844a.exe
"C:\Users\Admin\AppData\Local\Temp\1e6666100c72fac437bfebd67672844a.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:8
- C:\Users\Admin\AppData\Local\Temp\1e6666100c72fac437bfebd67672844a.exe
  "C:\Users\Admin\AppData\Local\Temp\1e6666100c72fac437bfebd67672844a.exe"
  2⤵
  PID:3460

C:\ProgramData\kaosdma.txt

Filesize
12B

MD5
8cf4dec152a9d79a3d62202b886eda9b

SHA1
0c1b3d3d02c0b655aa3526a58486b84872f18cc2

SHA256
c30e56c9c8fe30ffa4a4ff712cf2fa1808ee82ca258cd4c8ebefcc82250b6c01

SHA512
a5a65f0604f8553d0be07bd5214db52d3f167e7511d29cb64e3fa9d8c510cc79976ff2a5acb9b8c09b666f306ac8e4ad389f9a2de3ca46d57b1e91060a4c50fd

Download Submit
memory/8-1-0x0000000000770000-0x0000000000870000-memory.dmp

Filesize
1024KB

Download
memory/8-2-0x00000000006F0000-0x0000000000737000-memory.dmp

Filesize
284KB

Download
memory/3460-3-0x0000000000400000-0x000000000044F000-memory.dmp

Filesize
316KB

Download
memory/3460-6-0x0000000000400000-0x000000000044F000-memory.dmp

Filesize
316KB

Download
memory/3460-5-0x0000000000400000-0x000000000044F000-memory.dmp

Filesize
316KB

Download
memory/3460-12-0x0000000000400000-0x000000000044F000-memory.dmp

Filesize
316KB

Download