fickerstealer | 8d9e809be04dc65ba40a2baf764a36b9c659952c3b2e3f889c4d02bf791c8091

Analysis

max time kernel
141s
max time network
121s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
31-12-2023 07:28

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2d641a2668319b179db045309c835cb0.exe
Size

515KB
MD5

2d641a2668319b179db045309c835cb0
SHA1

93f1d3f68fb97b23999e464901234d26c681c7f7
SHA256

8d9e809be04dc65ba40a2baf764a36b9c659952c3b2e3f889c4d02bf791c8091
SHA512

6f60556b62feb94f320892c7bba9857936aee5e6b1ccd6fe7d2cc670ddb399713cec493067ca9f905a89d287970531562917b4c77b73c51674192460201d5244
SSDEEP

6144:9aARY/o9hIOUTDxXb1FTSbPNZKv2m1GreaHOs5VTORshwRoaYYPpcMW0rLAb56ds:5RF9eTDh1VSDFveBY+sXAOMW0rwrsu

Score

10^/10

fickerstealer infostealer

Malware Config

Extracted

Family

fickerstealer

80.87.192.115:80

Signatures

Fickerstealer
Ficker is an infostealer written in Rust and ASM.
infostealer fickerstealer

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow	ioc
3	api.ipify.org

Suspicious use of SetThreadContext 1 IoCs

Processes:

2d641a2668319b179db045309c835cb0.exe

description	pid	Process	procid_target
PID 2252 set thread context of 1968	2252	2d641a2668319b179db045309c835cb0.exe	28

Suspicious use of WriteProcessMemory 20 IoCs

Processes:

2d641a2668319b179db045309c835cb0.exe

description	pid	Process	procid_target
PID 2252 wrote to memory of 1968	2252	2d641a2668319b179db045309c835cb0.exe	28
PID 2252 wrote to memory of 1968	2252	2d641a2668319b179db045309c835cb0.exe	28
PID 2252 wrote to memory of 1968	2252	2d641a2668319b179db045309c835cb0.exe	28
PID 2252 wrote to memory of 1968	2252	2d641a2668319b179db045309c835cb0.exe	28
PID 2252 wrote to memory of 1968	2252	2d641a2668319b179db045309c835cb0.exe	28
PID 2252 wrote to memory of 1968	2252	2d641a2668319b179db045309c835cb0.exe	28
PID 2252 wrote to memory of 1968	2252	2d641a2668319b179db045309c835cb0.exe	28
PID 2252 wrote to memory of 1968	2252	2d641a2668319b179db045309c835cb0.exe	28
PID 2252 wrote to memory of 1968	2252	2d641a2668319b179db045309c835cb0.exe	28
PID 2252 wrote to memory of 1968	2252	2d641a2668319b179db045309c835cb0.exe	28
PID 2252 wrote to memory of 1968	2252	2d641a2668319b179db045309c835cb0.exe	28
PID 2252 wrote to memory of 1968	2252	2d641a2668319b179db045309c835cb0.exe	28
PID 2252 wrote to memory of 1968	2252	2d641a2668319b179db045309c835cb0.exe	28
PID 2252 wrote to memory of 1968	2252	2d641a2668319b179db045309c835cb0.exe	28
PID 2252 wrote to memory of 1968	2252	2d641a2668319b179db045309c835cb0.exe	28
PID 2252 wrote to memory of 1968	2252	2d641a2668319b179db045309c835cb0.exe	28
PID 2252 wrote to memory of 1968	2252	2d641a2668319b179db045309c835cb0.exe	28
PID 2252 wrote to memory of 1968	2252	2d641a2668319b179db045309c835cb0.exe	28
PID 2252 wrote to memory of 1968	2252	2d641a2668319b179db045309c835cb0.exe	28
PID 2252 wrote to memory of 1968	2252	2d641a2668319b179db045309c835cb0.exe	28

C:\Users\Admin\AppData\Local\Temp\2d641a2668319b179db045309c835cb0.exe
"C:\Users\Admin\AppData\Local\Temp\2d641a2668319b179db045309c835cb0.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2252
- C:\Users\Admin\AppData\Local\Temp\2d641a2668319b179db045309c835cb0.exe
  "C:\Users\Admin\AppData\Local\Temp\2d641a2668319b179db045309c835cb0.exe"
  2⤵
  PID:1968

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1968-2-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/1968-8-0x0000000000400000-0x000000000044F000-memory.dmp

Filesize
316KB

Download
memory/1968-7-0x0000000000400000-0x000000000044F000-memory.dmp

Filesize
316KB

Download
memory/1968-5-0x0000000000400000-0x000000000044F000-memory.dmp

Filesize
316KB

Download
memory/1968-14-0x0000000000400000-0x000000000044F000-memory.dmp

Filesize
316KB

Download
memory/2252-4-0x0000000000220000-0x0000000000267000-memory.dmp

Filesize
284KB

Download
memory/2252-1-0x0000000002560000-0x0000000002660000-memory.dmp

Filesize
1024KB

Download