fickerstealer | 8d7f0042459c12c3406a7df00345abbb94e6d94430fcf86949ed378e4412c6bb

Analysis

max time kernel
155s
max time network
182s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
31-12-2023 07:41

Target

2dc444a79c5ca26e6bd366eb5dc16379.exe
Size

590KB
MD5

2dc444a79c5ca26e6bd366eb5dc16379
SHA1

2e18f9916153f7c0139cba88d9609c6902b06deb
SHA256

8d7f0042459c12c3406a7df00345abbb94e6d94430fcf86949ed378e4412c6bb
SHA512

4f68f9a769b3faef8aed67f781c4caee6f0a021381ab16444483c3c42dbb7d1e79e91c0758f46d32afa0624499b0cadddaf1f82f02a3ed6529cbf562f551122e
SSDEEP

6144:cIqDutDrHDSKzneQDkZfwMEhGpX5Ig5BWjoy8rEEUr8QrMW0rLAb56dpLN4XQKJ3:0qRrHDSKzneaYjrBW0y83xgMW0rwrsu

Score

10^/10

Family

fickerstealer

80.87.192.115:80

Fickerstealer
Ficker is an infostealer written in Rust and ASM.
infostealer fickerstealer

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow	ioc
42	api.ipify.org

Suspicious use of SetThreadContext 1 IoCs

Processes:

2dc444a79c5ca26e6bd366eb5dc16379.exe

description	pid	Process	procid_target
PID 1416 set thread context of 4556	1416	2dc444a79c5ca26e6bd366eb5dc16379.exe	92

Suspicious use of WriteProcessMemory 19 IoCs

Processes:

2dc444a79c5ca26e6bd366eb5dc16379.exe

description	pid	Process	procid_target
PID 1416 wrote to memory of 4556	1416	2dc444a79c5ca26e6bd366eb5dc16379.exe	92
PID 1416 wrote to memory of 4556	1416	2dc444a79c5ca26e6bd366eb5dc16379.exe	92
PID 1416 wrote to memory of 4556	1416	2dc444a79c5ca26e6bd366eb5dc16379.exe	92
PID 1416 wrote to memory of 4556	1416	2dc444a79c5ca26e6bd366eb5dc16379.exe	92
PID 1416 wrote to memory of 4556	1416	2dc444a79c5ca26e6bd366eb5dc16379.exe	92
PID 1416 wrote to memory of 4556	1416	2dc444a79c5ca26e6bd366eb5dc16379.exe	92
PID 1416 wrote to memory of 4556	1416	2dc444a79c5ca26e6bd366eb5dc16379.exe	92
PID 1416 wrote to memory of 4556	1416	2dc444a79c5ca26e6bd366eb5dc16379.exe	92
PID 1416 wrote to memory of 4556	1416	2dc444a79c5ca26e6bd366eb5dc16379.exe	92
PID 1416 wrote to memory of 4556	1416	2dc444a79c5ca26e6bd366eb5dc16379.exe	92
PID 1416 wrote to memory of 4556	1416	2dc444a79c5ca26e6bd366eb5dc16379.exe	92
PID 1416 wrote to memory of 4556	1416	2dc444a79c5ca26e6bd366eb5dc16379.exe	92
PID 1416 wrote to memory of 4556	1416	2dc444a79c5ca26e6bd366eb5dc16379.exe	92
PID 1416 wrote to memory of 4556	1416	2dc444a79c5ca26e6bd366eb5dc16379.exe	92
PID 1416 wrote to memory of 4556	1416	2dc444a79c5ca26e6bd366eb5dc16379.exe	92
PID 1416 wrote to memory of 4556	1416	2dc444a79c5ca26e6bd366eb5dc16379.exe	92
PID 1416 wrote to memory of 4556	1416	2dc444a79c5ca26e6bd366eb5dc16379.exe	92
PID 1416 wrote to memory of 4556	1416	2dc444a79c5ca26e6bd366eb5dc16379.exe	92
PID 1416 wrote to memory of 4556	1416	2dc444a79c5ca26e6bd366eb5dc16379.exe	92

C:\Users\Admin\AppData\Local\Temp\2dc444a79c5ca26e6bd366eb5dc16379.exe
"C:\Users\Admin\AppData\Local\Temp\2dc444a79c5ca26e6bd366eb5dc16379.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1416
- C:\Users\Admin\AppData\Local\Temp\2dc444a79c5ca26e6bd366eb5dc16379.exe
  "C:\Users\Admin\AppData\Local\Temp\2dc444a79c5ca26e6bd366eb5dc16379.exe"
  2⤵
  PID:4556

C:\ProgramData\kaosdma.txt

Filesize
12B

MD5
8cf4dec152a9d79a3d62202b886eda9b

SHA1
0c1b3d3d02c0b655aa3526a58486b84872f18cc2

SHA256
c30e56c9c8fe30ffa4a4ff712cf2fa1808ee82ca258cd4c8ebefcc82250b6c01

SHA512
a5a65f0604f8553d0be07bd5214db52d3f167e7511d29cb64e3fa9d8c510cc79976ff2a5acb9b8c09b666f306ac8e4ad389f9a2de3ca46d57b1e91060a4c50fd

Download Submit
memory/1416-1-0x0000000003550000-0x0000000003650000-memory.dmp

Filesize
1024KB

Download
memory/1416-2-0x00000000034D0000-0x0000000003517000-memory.dmp

Filesize
284KB

Download
memory/4556-3-0x0000000000400000-0x000000000044F000-memory.dmp

Filesize
316KB

Download
memory/4556-5-0x0000000000400000-0x000000000044F000-memory.dmp

Filesize
316KB

Download
memory/4556-6-0x0000000000400000-0x000000000044F000-memory.dmp

Filesize
316KB

Download
memory/4556-13-0x0000000000400000-0x000000000044F000-memory.dmp

Filesize
316KB

Download