fickerstealer | ae02b8a195f1469f4c43c36b67a0a553842fc3b455ee878e13ee5d642a0e8c24

Analysis

max time kernel
142s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
26-01-2024 08:13

Target

76d7f252e4ee38accd3622709f8c522d.exe
Size

580KB
MD5

76d7f252e4ee38accd3622709f8c522d
SHA1

d2a4f442dc12098183c95ba2a0a4a84c7ef7afae
SHA256

ae02b8a195f1469f4c43c36b67a0a553842fc3b455ee878e13ee5d642a0e8c24
SHA512

f9e4a7b5a2c4e9fab9b9e1b7738ea1dc90b8c70e1d8886f27935919b647ff665dd9ed4c82339f1cf8cf5ddd7c1266b55db77f32f61335da1ddb851ac46f661ac
SSDEEP

12288:IdJ9Zq5P4jsJ1vA95b8QcR4s5fPR2ZwiZ5GMW0rwrsu:Oq5P4jsJUMR46PR6wi+h3

Score

10^/10

Family

fickerstealer

80.87.192.115:80

Fickerstealer
Ficker is an infostealer written in Rust and ASM.
infostealer fickerstealer

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
10	api.ipify.org

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1888 set thread context of 3480	1888	76d7f252e4ee38accd3622709f8c522d.exe	89

Suspicious use of WriteProcessMemory 19 IoCs

description	pid	Process	procid_target
PID 1888 wrote to memory of 3480	1888	76d7f252e4ee38accd3622709f8c522d.exe	89
PID 1888 wrote to memory of 3480	1888	76d7f252e4ee38accd3622709f8c522d.exe	89
PID 1888 wrote to memory of 3480	1888	76d7f252e4ee38accd3622709f8c522d.exe	89
PID 1888 wrote to memory of 3480	1888	76d7f252e4ee38accd3622709f8c522d.exe	89
PID 1888 wrote to memory of 3480	1888	76d7f252e4ee38accd3622709f8c522d.exe	89
PID 1888 wrote to memory of 3480	1888	76d7f252e4ee38accd3622709f8c522d.exe	89
PID 1888 wrote to memory of 3480	1888	76d7f252e4ee38accd3622709f8c522d.exe	89
PID 1888 wrote to memory of 3480	1888	76d7f252e4ee38accd3622709f8c522d.exe	89
PID 1888 wrote to memory of 3480	1888	76d7f252e4ee38accd3622709f8c522d.exe	89
PID 1888 wrote to memory of 3480	1888	76d7f252e4ee38accd3622709f8c522d.exe	89
PID 1888 wrote to memory of 3480	1888	76d7f252e4ee38accd3622709f8c522d.exe	89
PID 1888 wrote to memory of 3480	1888	76d7f252e4ee38accd3622709f8c522d.exe	89
PID 1888 wrote to memory of 3480	1888	76d7f252e4ee38accd3622709f8c522d.exe	89
PID 1888 wrote to memory of 3480	1888	76d7f252e4ee38accd3622709f8c522d.exe	89
PID 1888 wrote to memory of 3480	1888	76d7f252e4ee38accd3622709f8c522d.exe	89
PID 1888 wrote to memory of 3480	1888	76d7f252e4ee38accd3622709f8c522d.exe	89
PID 1888 wrote to memory of 3480	1888	76d7f252e4ee38accd3622709f8c522d.exe	89
PID 1888 wrote to memory of 3480	1888	76d7f252e4ee38accd3622709f8c522d.exe	89
PID 1888 wrote to memory of 3480	1888	76d7f252e4ee38accd3622709f8c522d.exe	89

C:\Users\Admin\AppData\Local\Temp\76d7f252e4ee38accd3622709f8c522d.exe
"C:\Users\Admin\AppData\Local\Temp\76d7f252e4ee38accd3622709f8c522d.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1888
- C:\Users\Admin\AppData\Local\Temp\76d7f252e4ee38accd3622709f8c522d.exe
  "C:\Users\Admin\AppData\Local\Temp\76d7f252e4ee38accd3622709f8c522d.exe"
  2⤵
  PID:3480

C:\ProgramData\kaosdma.txt

Filesize
12B

MD5
8cf4dec152a9d79a3d62202b886eda9b

SHA1
0c1b3d3d02c0b655aa3526a58486b84872f18cc2

SHA256
c30e56c9c8fe30ffa4a4ff712cf2fa1808ee82ca258cd4c8ebefcc82250b6c01

SHA512
a5a65f0604f8553d0be07bd5214db52d3f167e7511d29cb64e3fa9d8c510cc79976ff2a5acb9b8c09b666f306ac8e4ad389f9a2de3ca46d57b1e91060a4c50fd

Download Submit
memory/1888-1-0x00000000004F0000-0x00000000005F0000-memory.dmp

Filesize
1024KB

Download
memory/1888-2-0x0000000002090000-0x00000000020D7000-memory.dmp

Filesize
284KB

Download
memory/3480-3-0x0000000000400000-0x000000000044F000-memory.dmp

Filesize
316KB

Download
memory/3480-5-0x0000000000400000-0x000000000044F000-memory.dmp

Filesize
316KB

Download
memory/3480-6-0x0000000000400000-0x000000000044F000-memory.dmp

Filesize
316KB

Download
memory/3480-12-0x0000000000400000-0x000000000044F000-memory.dmp

Filesize
316KB

Download