Analysis
-
max time kernel
143s -
max time network
126s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
30-12-2023 05:02
Static task
static1
Behavioral task
behavioral1
Sample
0f6cfe9c64fe0447ee421629812490aa.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
0f6cfe9c64fe0447ee421629812490aa.exe
Resource
win10v2004-20231215-en
General
-
Target
0f6cfe9c64fe0447ee421629812490aa.exe
-
Size
478KB
-
MD5
0f6cfe9c64fe0447ee421629812490aa
-
SHA1
1f011cad43f687e5f290eac97bad0859ce4e06db
-
SHA256
37af1990b3da0c13879423f0f3b5428df1855efee07ae84b81454470f1397fe9
-
SHA512
5993b8e1b79d083ebdf88dff1f327f2433a144ab311d75b7f2adf1905a5db5b8c25b153b15823f611ac378c6cd20b34c0781f69e36e387a2b41d1ab310b409d1
-
SSDEEP
12288:/ra30kz2fm9VImjEdIQ9zTwoO2MW0rwrsu:/ra3pK+9qCQ9zH3h3
Malware Config
Extracted
fickerstealer
80.87.192.115:80
Signatures
-
Fickerstealer
Ficker is an infostealer written in Rust and ASM.
-
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 3 api.ipify.org -
Suspicious use of SetThreadContext 1 IoCs
Processes:
0f6cfe9c64fe0447ee421629812490aa.exedescription pid process target process PID 2024 set thread context of 2328 2024 0f6cfe9c64fe0447ee421629812490aa.exe 0f6cfe9c64fe0447ee421629812490aa.exe -
Suspicious use of WriteProcessMemory 20 IoCs
Processes:
0f6cfe9c64fe0447ee421629812490aa.exedescription pid process target process PID 2024 wrote to memory of 2328 2024 0f6cfe9c64fe0447ee421629812490aa.exe 0f6cfe9c64fe0447ee421629812490aa.exe PID 2024 wrote to memory of 2328 2024 0f6cfe9c64fe0447ee421629812490aa.exe 0f6cfe9c64fe0447ee421629812490aa.exe PID 2024 wrote to memory of 2328 2024 0f6cfe9c64fe0447ee421629812490aa.exe 0f6cfe9c64fe0447ee421629812490aa.exe PID 2024 wrote to memory of 2328 2024 0f6cfe9c64fe0447ee421629812490aa.exe 0f6cfe9c64fe0447ee421629812490aa.exe PID 2024 wrote to memory of 2328 2024 0f6cfe9c64fe0447ee421629812490aa.exe 0f6cfe9c64fe0447ee421629812490aa.exe PID 2024 wrote to memory of 2328 2024 0f6cfe9c64fe0447ee421629812490aa.exe 0f6cfe9c64fe0447ee421629812490aa.exe PID 2024 wrote to memory of 2328 2024 0f6cfe9c64fe0447ee421629812490aa.exe 0f6cfe9c64fe0447ee421629812490aa.exe PID 2024 wrote to memory of 2328 2024 0f6cfe9c64fe0447ee421629812490aa.exe 0f6cfe9c64fe0447ee421629812490aa.exe PID 2024 wrote to memory of 2328 2024 0f6cfe9c64fe0447ee421629812490aa.exe 0f6cfe9c64fe0447ee421629812490aa.exe PID 2024 wrote to memory of 2328 2024 0f6cfe9c64fe0447ee421629812490aa.exe 0f6cfe9c64fe0447ee421629812490aa.exe PID 2024 wrote to memory of 2328 2024 0f6cfe9c64fe0447ee421629812490aa.exe 0f6cfe9c64fe0447ee421629812490aa.exe PID 2024 wrote to memory of 2328 2024 0f6cfe9c64fe0447ee421629812490aa.exe 0f6cfe9c64fe0447ee421629812490aa.exe PID 2024 wrote to memory of 2328 2024 0f6cfe9c64fe0447ee421629812490aa.exe 0f6cfe9c64fe0447ee421629812490aa.exe PID 2024 wrote to memory of 2328 2024 0f6cfe9c64fe0447ee421629812490aa.exe 0f6cfe9c64fe0447ee421629812490aa.exe PID 2024 wrote to memory of 2328 2024 0f6cfe9c64fe0447ee421629812490aa.exe 0f6cfe9c64fe0447ee421629812490aa.exe PID 2024 wrote to memory of 2328 2024 0f6cfe9c64fe0447ee421629812490aa.exe 0f6cfe9c64fe0447ee421629812490aa.exe PID 2024 wrote to memory of 2328 2024 0f6cfe9c64fe0447ee421629812490aa.exe 0f6cfe9c64fe0447ee421629812490aa.exe PID 2024 wrote to memory of 2328 2024 0f6cfe9c64fe0447ee421629812490aa.exe 0f6cfe9c64fe0447ee421629812490aa.exe PID 2024 wrote to memory of 2328 2024 0f6cfe9c64fe0447ee421629812490aa.exe 0f6cfe9c64fe0447ee421629812490aa.exe PID 2024 wrote to memory of 2328 2024 0f6cfe9c64fe0447ee421629812490aa.exe 0f6cfe9c64fe0447ee421629812490aa.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\0f6cfe9c64fe0447ee421629812490aa.exe"C:\Users\Admin\AppData\Local\Temp\0f6cfe9c64fe0447ee421629812490aa.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\0f6cfe9c64fe0447ee421629812490aa.exe"C:\Users\Admin\AppData\Local\Temp\0f6cfe9c64fe0447ee421629812490aa.exe"2⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\ProgramData\kaosdma.txtFilesize
12B
MD58cf4dec152a9d79a3d62202b886eda9b
SHA10c1b3d3d02c0b655aa3526a58486b84872f18cc2
SHA256c30e56c9c8fe30ffa4a4ff712cf2fa1808ee82ca258cd4c8ebefcc82250b6c01
SHA512a5a65f0604f8553d0be07bd5214db52d3f167e7511d29cb64e3fa9d8c510cc79976ff2a5acb9b8c09b666f306ac8e4ad389f9a2de3ca46d57b1e91060a4c50fd
-
memory/2024-1-0x0000000002D90000-0x0000000002E90000-memory.dmpFilesize
1024KB
-
memory/2024-3-0x0000000000220000-0x0000000000267000-memory.dmpFilesize
284KB
-
memory/2328-2-0x000000007EFDE000-0x000000007EFDF000-memory.dmpFilesize
4KB
-
memory/2328-5-0x0000000000400000-0x000000000044F000-memory.dmpFilesize
316KB
-
memory/2328-7-0x0000000000400000-0x000000000044F000-memory.dmpFilesize
316KB
-
memory/2328-8-0x0000000000400000-0x000000000044F000-memory.dmpFilesize
316KB
-
memory/2328-14-0x0000000000400000-0x000000000044F000-memory.dmpFilesize
316KB