Analysis
-
max time kernel
141s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
31-12-2023 00:07
Static task
static1
Behavioral task
behavioral1
Sample
2115fa4a17a9800f76b21e2dc18109d8.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
2115fa4a17a9800f76b21e2dc18109d8.exe
Resource
win10v2004-20231215-en
General
-
Target
2115fa4a17a9800f76b21e2dc18109d8.exe
-
Size
492KB
-
MD5
2115fa4a17a9800f76b21e2dc18109d8
-
SHA1
f8dc6e5633aadc7ccf12ff0c8f3bb0954049937c
-
SHA256
76641a0ab4e33d5d69e95991da7d72e88f989b27171c7993d30bbf7a969cfc6f
-
SHA512
294815ac7e410fc159c035e604b0a97b0fd3382afe010a380d80a73b8b5098aa406c85231ea178954431ee50c93c6f2520cd55fc4cb4d5aff0778fc09364ec78
-
SSDEEP
6144:81YDRoTY/Ah0Rz5sxBEpbfFsPYPY/3AnRwoOL81vwMW0rLAb56dpLN4XQKJrsu:MQIsAhIdscZiYPYvARwoOaIMW0rwrsu
Malware Config
Extracted
fickerstealer
80.87.192.115:80
Signatures
-
Fickerstealer
Ficker is an infostealer written in Rust and ASM.
-
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 3 api.ipify.org -
Suspicious use of SetThreadContext 1 IoCs
Processes:
2115fa4a17a9800f76b21e2dc18109d8.exedescription pid process target process PID 2128 set thread context of 2356 2128 2115fa4a17a9800f76b21e2dc18109d8.exe 2115fa4a17a9800f76b21e2dc18109d8.exe -
Suspicious use of WriteProcessMemory 20 IoCs
Processes:
2115fa4a17a9800f76b21e2dc18109d8.exedescription pid process target process PID 2128 wrote to memory of 2356 2128 2115fa4a17a9800f76b21e2dc18109d8.exe 2115fa4a17a9800f76b21e2dc18109d8.exe PID 2128 wrote to memory of 2356 2128 2115fa4a17a9800f76b21e2dc18109d8.exe 2115fa4a17a9800f76b21e2dc18109d8.exe PID 2128 wrote to memory of 2356 2128 2115fa4a17a9800f76b21e2dc18109d8.exe 2115fa4a17a9800f76b21e2dc18109d8.exe PID 2128 wrote to memory of 2356 2128 2115fa4a17a9800f76b21e2dc18109d8.exe 2115fa4a17a9800f76b21e2dc18109d8.exe PID 2128 wrote to memory of 2356 2128 2115fa4a17a9800f76b21e2dc18109d8.exe 2115fa4a17a9800f76b21e2dc18109d8.exe PID 2128 wrote to memory of 2356 2128 2115fa4a17a9800f76b21e2dc18109d8.exe 2115fa4a17a9800f76b21e2dc18109d8.exe PID 2128 wrote to memory of 2356 2128 2115fa4a17a9800f76b21e2dc18109d8.exe 2115fa4a17a9800f76b21e2dc18109d8.exe PID 2128 wrote to memory of 2356 2128 2115fa4a17a9800f76b21e2dc18109d8.exe 2115fa4a17a9800f76b21e2dc18109d8.exe PID 2128 wrote to memory of 2356 2128 2115fa4a17a9800f76b21e2dc18109d8.exe 2115fa4a17a9800f76b21e2dc18109d8.exe PID 2128 wrote to memory of 2356 2128 2115fa4a17a9800f76b21e2dc18109d8.exe 2115fa4a17a9800f76b21e2dc18109d8.exe PID 2128 wrote to memory of 2356 2128 2115fa4a17a9800f76b21e2dc18109d8.exe 2115fa4a17a9800f76b21e2dc18109d8.exe PID 2128 wrote to memory of 2356 2128 2115fa4a17a9800f76b21e2dc18109d8.exe 2115fa4a17a9800f76b21e2dc18109d8.exe PID 2128 wrote to memory of 2356 2128 2115fa4a17a9800f76b21e2dc18109d8.exe 2115fa4a17a9800f76b21e2dc18109d8.exe PID 2128 wrote to memory of 2356 2128 2115fa4a17a9800f76b21e2dc18109d8.exe 2115fa4a17a9800f76b21e2dc18109d8.exe PID 2128 wrote to memory of 2356 2128 2115fa4a17a9800f76b21e2dc18109d8.exe 2115fa4a17a9800f76b21e2dc18109d8.exe PID 2128 wrote to memory of 2356 2128 2115fa4a17a9800f76b21e2dc18109d8.exe 2115fa4a17a9800f76b21e2dc18109d8.exe PID 2128 wrote to memory of 2356 2128 2115fa4a17a9800f76b21e2dc18109d8.exe 2115fa4a17a9800f76b21e2dc18109d8.exe PID 2128 wrote to memory of 2356 2128 2115fa4a17a9800f76b21e2dc18109d8.exe 2115fa4a17a9800f76b21e2dc18109d8.exe PID 2128 wrote to memory of 2356 2128 2115fa4a17a9800f76b21e2dc18109d8.exe 2115fa4a17a9800f76b21e2dc18109d8.exe PID 2128 wrote to memory of 2356 2128 2115fa4a17a9800f76b21e2dc18109d8.exe 2115fa4a17a9800f76b21e2dc18109d8.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2115fa4a17a9800f76b21e2dc18109d8.exe"C:\Users\Admin\AppData\Local\Temp\2115fa4a17a9800f76b21e2dc18109d8.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\2115fa4a17a9800f76b21e2dc18109d8.exe"C:\Users\Admin\AppData\Local\Temp\2115fa4a17a9800f76b21e2dc18109d8.exe"2⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\ProgramData\kaosdma.txtFilesize
12B
MD58cf4dec152a9d79a3d62202b886eda9b
SHA10c1b3d3d02c0b655aa3526a58486b84872f18cc2
SHA256c30e56c9c8fe30ffa4a4ff712cf2fa1808ee82ca258cd4c8ebefcc82250b6c01
SHA512a5a65f0604f8553d0be07bd5214db52d3f167e7511d29cb64e3fa9d8c510cc79976ff2a5acb9b8c09b666f306ac8e4ad389f9a2de3ca46d57b1e91060a4c50fd
-
memory/2128-4-0x0000000002E12000-0x0000000002E3A000-memory.dmpFilesize
160KB
-
memory/2128-6-0x0000000000220000-0x0000000000267000-memory.dmpFilesize
284KB
-
memory/2356-3-0x0000000000400000-0x000000000044F000-memory.dmpFilesize
316KB
-
memory/2356-7-0x0000000000400000-0x000000000044F000-memory.dmpFilesize
316KB
-
memory/2356-8-0x0000000000400000-0x000000000044F000-memory.dmpFilesize
316KB
-
memory/2356-1-0x000000007EFDE000-0x000000007EFDF000-memory.dmpFilesize
4KB
-
memory/2356-14-0x0000000000400000-0x000000000044F000-memory.dmpFilesize
316KB