fickerstealer | 37af1990b3da0c13879423f0f3b5428df1855efee07ae84b81454470f1397fe9

Analysis

max time kernel
149s
max time network
158s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
30/12/2023, 05:02

Target

0f6cfe9c64fe0447ee421629812490aa.exe
Size

478KB
MD5

0f6cfe9c64fe0447ee421629812490aa
SHA1

1f011cad43f687e5f290eac97bad0859ce4e06db
SHA256

37af1990b3da0c13879423f0f3b5428df1855efee07ae84b81454470f1397fe9
SHA512

5993b8e1b79d083ebdf88dff1f327f2433a144ab311d75b7f2adf1905a5db5b8c25b153b15823f611ac378c6cd20b34c0781f69e36e387a2b41d1ab310b409d1
SSDEEP

12288:/ra30kz2fm9VImjEdIQ9zTwoO2MW0rwrsu:/ra3pK+9qCQ9zH3h3

Score

10^/10

Family

fickerstealer

80.87.192.115:80

Fickerstealer
Ficker is an infostealer written in Rust and ASM.
infostealer fickerstealer

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
16	api.ipify.org

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3452 set thread context of 1880	3452	0f6cfe9c64fe0447ee421629812490aa.exe	48

Suspicious use of WriteProcessMemory 19 IoCs

description	pid	Process	procid_target
PID 3452 wrote to memory of 1880	3452	0f6cfe9c64fe0447ee421629812490aa.exe	48
PID 3452 wrote to memory of 1880	3452	0f6cfe9c64fe0447ee421629812490aa.exe	48
PID 3452 wrote to memory of 1880	3452	0f6cfe9c64fe0447ee421629812490aa.exe	48
PID 3452 wrote to memory of 1880	3452	0f6cfe9c64fe0447ee421629812490aa.exe	48
PID 3452 wrote to memory of 1880	3452	0f6cfe9c64fe0447ee421629812490aa.exe	48
PID 3452 wrote to memory of 1880	3452	0f6cfe9c64fe0447ee421629812490aa.exe	48
PID 3452 wrote to memory of 1880	3452	0f6cfe9c64fe0447ee421629812490aa.exe	48
PID 3452 wrote to memory of 1880	3452	0f6cfe9c64fe0447ee421629812490aa.exe	48
PID 3452 wrote to memory of 1880	3452	0f6cfe9c64fe0447ee421629812490aa.exe	48
PID 3452 wrote to memory of 1880	3452	0f6cfe9c64fe0447ee421629812490aa.exe	48
PID 3452 wrote to memory of 1880	3452	0f6cfe9c64fe0447ee421629812490aa.exe	48
PID 3452 wrote to memory of 1880	3452	0f6cfe9c64fe0447ee421629812490aa.exe	48
PID 3452 wrote to memory of 1880	3452	0f6cfe9c64fe0447ee421629812490aa.exe	48
PID 3452 wrote to memory of 1880	3452	0f6cfe9c64fe0447ee421629812490aa.exe	48
PID 3452 wrote to memory of 1880	3452	0f6cfe9c64fe0447ee421629812490aa.exe	48
PID 3452 wrote to memory of 1880	3452	0f6cfe9c64fe0447ee421629812490aa.exe	48
PID 3452 wrote to memory of 1880	3452	0f6cfe9c64fe0447ee421629812490aa.exe	48
PID 3452 wrote to memory of 1880	3452	0f6cfe9c64fe0447ee421629812490aa.exe	48
PID 3452 wrote to memory of 1880	3452	0f6cfe9c64fe0447ee421629812490aa.exe	48

C:\Users\Admin\AppData\Local\Temp\0f6cfe9c64fe0447ee421629812490aa.exe
"C:\Users\Admin\AppData\Local\Temp\0f6cfe9c64fe0447ee421629812490aa.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3452
- C:\Users\Admin\AppData\Local\Temp\0f6cfe9c64fe0447ee421629812490aa.exe
  "C:\Users\Admin\AppData\Local\Temp\0f6cfe9c64fe0447ee421629812490aa.exe"
  2⤵
  PID:1880

memory/1880-6-0x0000000000400000-0x000000000044F000-memory.dmp

Filesize
316KB

Download
memory/1880-5-0x0000000000400000-0x000000000044F000-memory.dmp

Filesize
316KB

Download
memory/1880-3-0x0000000000400000-0x000000000044F000-memory.dmp

Filesize
316KB

Download
memory/1880-12-0x0000000000400000-0x000000000044F000-memory.dmp

Filesize
316KB

Download
memory/3452-2-0x00000000049D0000-0x0000000004A17000-memory.dmp

Filesize
284KB

Download
memory/3452-1-0x0000000002D40000-0x0000000002E40000-memory.dmp

Filesize
1024KB

Download