fickerstealer | 7161075691c2a958782a978fe9fe03877c57d0ead683273d47b22be10352c3a6

Analysis

max time kernel
148s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
06-01-2024 00:48

Target

44db05f808d1987031f1e3ed9b0c9430.exe
Size

534KB
MD5

44db05f808d1987031f1e3ed9b0c9430
SHA1

6d46101aa34ec94b889f86f402036bf78b9b8225
SHA256

7161075691c2a958782a978fe9fe03877c57d0ead683273d47b22be10352c3a6
SHA512

9ef3e3947d34414815c0fdc861c71f220de5276010d81f8761f5bd03baa9349ca403829d179018493e80a9666f5e8ce0ca800ccda787db850f850ca716d0f2b6
SSDEEP

6144:i7im0etmuEnUZEvy2aGpw0PmyfQLKIHZrNVfs8VSMW0rLAb56dpLN4XQKJrsu:iGzfyTGpVPgRN2TMW0rwrsu

Score

10^/10

Family

fickerstealer

80.87.192.115:80

Fickerstealer
Ficker is an infostealer written in Rust and ASM.
infostealer fickerstealer

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow	ioc
11	api.ipify.org

Suspicious use of SetThreadContext 1 IoCs

Processes:

44db05f808d1987031f1e3ed9b0c9430.exe

description	pid	Process	procid_target
PID 4232 set thread context of 2396	4232	44db05f808d1987031f1e3ed9b0c9430.exe	92

Suspicious use of WriteProcessMemory 19 IoCs

Processes:

44db05f808d1987031f1e3ed9b0c9430.exe

description	pid	Process	procid_target
PID 4232 wrote to memory of 2396	4232	44db05f808d1987031f1e3ed9b0c9430.exe	92
PID 4232 wrote to memory of 2396	4232	44db05f808d1987031f1e3ed9b0c9430.exe	92
PID 4232 wrote to memory of 2396	4232	44db05f808d1987031f1e3ed9b0c9430.exe	92
PID 4232 wrote to memory of 2396	4232	44db05f808d1987031f1e3ed9b0c9430.exe	92
PID 4232 wrote to memory of 2396	4232	44db05f808d1987031f1e3ed9b0c9430.exe	92
PID 4232 wrote to memory of 2396	4232	44db05f808d1987031f1e3ed9b0c9430.exe	92
PID 4232 wrote to memory of 2396	4232	44db05f808d1987031f1e3ed9b0c9430.exe	92
PID 4232 wrote to memory of 2396	4232	44db05f808d1987031f1e3ed9b0c9430.exe	92
PID 4232 wrote to memory of 2396	4232	44db05f808d1987031f1e3ed9b0c9430.exe	92
PID 4232 wrote to memory of 2396	4232	44db05f808d1987031f1e3ed9b0c9430.exe	92
PID 4232 wrote to memory of 2396	4232	44db05f808d1987031f1e3ed9b0c9430.exe	92
PID 4232 wrote to memory of 2396	4232	44db05f808d1987031f1e3ed9b0c9430.exe	92
PID 4232 wrote to memory of 2396	4232	44db05f808d1987031f1e3ed9b0c9430.exe	92
PID 4232 wrote to memory of 2396	4232	44db05f808d1987031f1e3ed9b0c9430.exe	92
PID 4232 wrote to memory of 2396	4232	44db05f808d1987031f1e3ed9b0c9430.exe	92
PID 4232 wrote to memory of 2396	4232	44db05f808d1987031f1e3ed9b0c9430.exe	92
PID 4232 wrote to memory of 2396	4232	44db05f808d1987031f1e3ed9b0c9430.exe	92
PID 4232 wrote to memory of 2396	4232	44db05f808d1987031f1e3ed9b0c9430.exe	92
PID 4232 wrote to memory of 2396	4232	44db05f808d1987031f1e3ed9b0c9430.exe	92

C:\Users\Admin\AppData\Local\Temp\44db05f808d1987031f1e3ed9b0c9430.exe
"C:\Users\Admin\AppData\Local\Temp\44db05f808d1987031f1e3ed9b0c9430.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4232
- C:\Users\Admin\AppData\Local\Temp\44db05f808d1987031f1e3ed9b0c9430.exe
  "C:\Users\Admin\AppData\Local\Temp\44db05f808d1987031f1e3ed9b0c9430.exe"
  2⤵
  PID:2396

memory/2396-5-0x0000000000400000-0x000000000044F000-memory.dmp

Filesize
316KB

Download
memory/2396-6-0x0000000000400000-0x000000000044F000-memory.dmp

Filesize
316KB

Download
memory/2396-3-0x0000000000400000-0x000000000044F000-memory.dmp

Filesize
316KB

Download
memory/2396-12-0x0000000000400000-0x000000000044F000-memory.dmp

Filesize
316KB

Download
memory/4232-2-0x0000000003170000-0x00000000031B7000-memory.dmp

Filesize
284KB

Download
memory/4232-1-0x0000000001490000-0x0000000001590000-memory.dmp

Filesize
1024KB

Download