fickerstealer | b3fe666403a4cd92cda1e96ddc4b035cc6f384f566d4cf6c34ed92d43a6650e8

Analysis

max time kernel
175s
max time network
191s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
31-12-2023 04:57

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

29108949012d41570cdf27f0323d5969.exe
Size

594KB
MD5

29108949012d41570cdf27f0323d5969
SHA1

77c61b8c9d35915b6c002c318806dbd15f52e4b4
SHA256

b3fe666403a4cd92cda1e96ddc4b035cc6f384f566d4cf6c34ed92d43a6650e8
SHA512

153a018127b59190260cb08ba6bfe4be7e00e3cd43f68b58dbd8a2712378cafa7c490ac09eaae9847ed4dc2dfbac597dd9ee010e2f3aa8d984fe27e4037c788c
SSDEEP

12288:6uvoig7EUP68iZOnbbONIEVH1KMW0rwrsu:qig7fnbiZVVKh3

Score

10^/10

fickerstealer infostealer

Malware Config

Extracted

Family

fickerstealer

80.87.192.115:80

Signatures

Fickerstealer
Ficker is an infostealer written in Rust and ASM.
infostealer fickerstealer
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

24 api.ipify.org
Suspicious use of SetThreadContext 1 IoCs

Processes:

29108949012d41570cdf27f0323d5969.exe

description pid process target process

PID 2796 set thread context of 1068 2796 29108949012d41570cdf27f0323d5969.exe 29108949012d41570cdf27f0323d5969.exe

flow	ioc
24	api.ipify.org

description	pid	process	target process
PID 2796 set thread context of 1068	2796	29108949012d41570cdf27f0323d5969.exe	29108949012d41570cdf27f0323d5969.exe

Suspicious use of WriteProcessMemory 19 IoCs

Processes:

29108949012d41570cdf27f0323d5969.exe

C:\Users\Admin\AppData\Local\Temp\29108949012d41570cdf27f0323d5969.exe
"C:\Users\Admin\AppData\Local\Temp\29108949012d41570cdf27f0323d5969.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2796
- C:\Users\Admin\AppData\Local\Temp\29108949012d41570cdf27f0323d5969.exe
  "C:\Users\Admin\AppData\Local\Temp\29108949012d41570cdf27f0323d5969.exe"
  2⤵
  PID:1068

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1068-3-0x0000000000400000-0x000000000044F000-memory.dmp

Filesize
316KB

Download
memory/1068-5-0x0000000000400000-0x000000000044F000-memory.dmp

Filesize
316KB

Download
memory/1068-6-0x0000000000400000-0x000000000044F000-memory.dmp

Filesize
316KB

Download
memory/1068-12-0x0000000000400000-0x000000000044F000-memory.dmp

Filesize
316KB

Download
memory/2796-1-0x0000000003460000-0x0000000003560000-memory.dmp

Filesize
1024KB

Download
memory/2796-2-0x0000000003410000-0x0000000003457000-memory.dmp

Filesize
284KB

Download

description	pid	process	target process
PID 2796 wrote to memory of 1068	2796	29108949012d41570cdf27f0323d5969.exe	29108949012d41570cdf27f0323d5969.exe
PID 2796 wrote to memory of 1068	2796	29108949012d41570cdf27f0323d5969.exe	29108949012d41570cdf27f0323d5969.exe
PID 2796 wrote to memory of 1068	2796	29108949012d41570cdf27f0323d5969.exe	29108949012d41570cdf27f0323d5969.exe
PID 2796 wrote to memory of 1068	2796	29108949012d41570cdf27f0323d5969.exe	29108949012d41570cdf27f0323d5969.exe
PID 2796 wrote to memory of 1068	2796	29108949012d41570cdf27f0323d5969.exe	29108949012d41570cdf27f0323d5969.exe
PID 2796 wrote to memory of 1068	2796	29108949012d41570cdf27f0323d5969.exe	29108949012d41570cdf27f0323d5969.exe
PID 2796 wrote to memory of 1068	2796	29108949012d41570cdf27f0323d5969.exe	29108949012d41570cdf27f0323d5969.exe
PID 2796 wrote to memory of 1068	2796	29108949012d41570cdf27f0323d5969.exe	29108949012d41570cdf27f0323d5969.exe
PID 2796 wrote to memory of 1068	2796	29108949012d41570cdf27f0323d5969.exe	29108949012d41570cdf27f0323d5969.exe
PID 2796 wrote to memory of 1068	2796	29108949012d41570cdf27f0323d5969.exe	29108949012d41570cdf27f0323d5969.exe
PID 2796 wrote to memory of 1068	2796	29108949012d41570cdf27f0323d5969.exe	29108949012d41570cdf27f0323d5969.exe
PID 2796 wrote to memory of 1068	2796	29108949012d41570cdf27f0323d5969.exe	29108949012d41570cdf27f0323d5969.exe
PID 2796 wrote to memory of 1068	2796	29108949012d41570cdf27f0323d5969.exe	29108949012d41570cdf27f0323d5969.exe
PID 2796 wrote to memory of 1068	2796	29108949012d41570cdf27f0323d5969.exe	29108949012d41570cdf27f0323d5969.exe
PID 2796 wrote to memory of 1068	2796	29108949012d41570cdf27f0323d5969.exe	29108949012d41570cdf27f0323d5969.exe
PID 2796 wrote to memory of 1068	2796	29108949012d41570cdf27f0323d5969.exe	29108949012d41570cdf27f0323d5969.exe
PID 2796 wrote to memory of 1068	2796	29108949012d41570cdf27f0323d5969.exe	29108949012d41570cdf27f0323d5969.exe
PID 2796 wrote to memory of 1068	2796	29108949012d41570cdf27f0323d5969.exe	29108949012d41570cdf27f0323d5969.exe
PID 2796 wrote to memory of 1068	2796	29108949012d41570cdf27f0323d5969.exe	29108949012d41570cdf27f0323d5969.exe