fickerstealer | 73d34ceec57d41cab2e4b22046898b531fe0b59ab16c533c7eee3a52caf29848

Analysis

max time kernel
170s
max time network
182s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
07-01-2024 16:52

Target

4988a43a98b7d9c6aa7e71b8a8919fd6.exe
Size

511KB
MD5

4988a43a98b7d9c6aa7e71b8a8919fd6
SHA1

5e0f468d9e9a9d14eef11caf54dafbe384303be4
SHA256

73d34ceec57d41cab2e4b22046898b531fe0b59ab16c533c7eee3a52caf29848
SHA512

1e3feb3861b9c664205edddd09361b2a54a9df3424c582bfdb955a8a65a26eae3adc1c825e7973b13bd9e39626f5723d3efbe27b828c8c47648d87d756f59869
SSDEEP

12288:eXSX3CPuJE0/PRm3HAURSEy0OiISPSpoKT1EW0rF3:pCPuSpRSoUpoMy3

Score

10^/10

Family

fickerstealer

mistral3.xyz:80

Fickerstealer
Ficker is an infostealer written in Rust and ASM.
infostealer fickerstealer

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
52	api.ipify.org

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4228 set thread context of 3160	4228	4988a43a98b7d9c6aa7e71b8a8919fd6.exe	92

Suspicious use of WriteProcessMemory 19 IoCs

description	pid	Process	procid_target
PID 4228 wrote to memory of 3160	4228	4988a43a98b7d9c6aa7e71b8a8919fd6.exe	92
PID 4228 wrote to memory of 3160	4228	4988a43a98b7d9c6aa7e71b8a8919fd6.exe	92
PID 4228 wrote to memory of 3160	4228	4988a43a98b7d9c6aa7e71b8a8919fd6.exe	92
PID 4228 wrote to memory of 3160	4228	4988a43a98b7d9c6aa7e71b8a8919fd6.exe	92
PID 4228 wrote to memory of 3160	4228	4988a43a98b7d9c6aa7e71b8a8919fd6.exe	92
PID 4228 wrote to memory of 3160	4228	4988a43a98b7d9c6aa7e71b8a8919fd6.exe	92
PID 4228 wrote to memory of 3160	4228	4988a43a98b7d9c6aa7e71b8a8919fd6.exe	92
PID 4228 wrote to memory of 3160	4228	4988a43a98b7d9c6aa7e71b8a8919fd6.exe	92
PID 4228 wrote to memory of 3160	4228	4988a43a98b7d9c6aa7e71b8a8919fd6.exe	92
PID 4228 wrote to memory of 3160	4228	4988a43a98b7d9c6aa7e71b8a8919fd6.exe	92
PID 4228 wrote to memory of 3160	4228	4988a43a98b7d9c6aa7e71b8a8919fd6.exe	92
PID 4228 wrote to memory of 3160	4228	4988a43a98b7d9c6aa7e71b8a8919fd6.exe	92
PID 4228 wrote to memory of 3160	4228	4988a43a98b7d9c6aa7e71b8a8919fd6.exe	92
PID 4228 wrote to memory of 3160	4228	4988a43a98b7d9c6aa7e71b8a8919fd6.exe	92
PID 4228 wrote to memory of 3160	4228	4988a43a98b7d9c6aa7e71b8a8919fd6.exe	92
PID 4228 wrote to memory of 3160	4228	4988a43a98b7d9c6aa7e71b8a8919fd6.exe	92
PID 4228 wrote to memory of 3160	4228	4988a43a98b7d9c6aa7e71b8a8919fd6.exe	92
PID 4228 wrote to memory of 3160	4228	4988a43a98b7d9c6aa7e71b8a8919fd6.exe	92
PID 4228 wrote to memory of 3160	4228	4988a43a98b7d9c6aa7e71b8a8919fd6.exe	92

C:\Users\Admin\AppData\Local\Temp\4988a43a98b7d9c6aa7e71b8a8919fd6.exe
"C:\Users\Admin\AppData\Local\Temp\4988a43a98b7d9c6aa7e71b8a8919fd6.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4228
- C:\Users\Admin\AppData\Local\Temp\4988a43a98b7d9c6aa7e71b8a8919fd6.exe
  "C:\Users\Admin\AppData\Local\Temp\4988a43a98b7d9c6aa7e71b8a8919fd6.exe"
  2⤵
  PID:3160

C:\ProgramData\kaosdma.txt

Filesize
12B

MD5
8cf4dec152a9d79a3d62202b886eda9b

SHA1
0c1b3d3d02c0b655aa3526a58486b84872f18cc2

SHA256
c30e56c9c8fe30ffa4a4ff712cf2fa1808ee82ca258cd4c8ebefcc82250b6c01

SHA512
a5a65f0604f8553d0be07bd5214db52d3f167e7511d29cb64e3fa9d8c510cc79976ff2a5acb9b8c09b666f306ac8e4ad389f9a2de3ca46d57b1e91060a4c50fd

Download Submit
memory/3160-3-0x0000000000400000-0x000000000044E000-memory.dmp

Filesize
312KB

Download
memory/3160-5-0x0000000000400000-0x000000000044E000-memory.dmp

Filesize
312KB

Download
memory/3160-6-0x0000000000400000-0x000000000044E000-memory.dmp

Filesize
312KB

Download
memory/3160-14-0x0000000000400000-0x000000000044E000-memory.dmp

Filesize
312KB

Download
memory/4228-1-0x0000000002680000-0x0000000002780000-memory.dmp

Filesize
1024KB

Download
memory/4228-2-0x0000000004120000-0x0000000004167000-memory.dmp

Filesize
284KB

Download