Analysis
-
max time kernel
142s -
max time network
121s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
05-02-2024 20:59
Static task
static1
Behavioral task
behavioral1
Sample
92fbec26fdd3d15c1b50b670ee321f87.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
92fbec26fdd3d15c1b50b670ee321f87.exe
Resource
win10v2004-20231215-en
General
-
Target
92fbec26fdd3d15c1b50b670ee321f87.exe
-
Size
460KB
-
MD5
92fbec26fdd3d15c1b50b670ee321f87
-
SHA1
f561e738540e40321de33d6fb121ed6c28cae291
-
SHA256
acb0f1bf13c90fa01b172ef9d046d6f9078a2d986842772fe97b95c952b18714
-
SHA512
cc092b16feeb8bb57928a36ce8bc02f799b2cea51b37b0a929b5ea86b0a7efbe4120917a3817f51bb3f9460169fb9626158dab1acbcef7a51c8113558cfcbc68
-
SSDEEP
6144:v2U5I9yN0ZhInWAzNSa041dMrzNIqJ99sLiSX+qAY6RwoOL8MW0rLAb56dpLN4X7:vLFNB9zrQX629GWKp8woOIMW0rwrsu
Malware Config
Extracted
fickerstealer
80.87.192.115:80
Signatures
-
Fickerstealer
Ficker is an infostealer written in Rust and ASM.
-
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 6 api.ipify.org -
Suspicious use of SetThreadContext 1 IoCs
Processes:
92fbec26fdd3d15c1b50b670ee321f87.exedescription pid process target process PID 3220 set thread context of 3276 3220 92fbec26fdd3d15c1b50b670ee321f87.exe 92fbec26fdd3d15c1b50b670ee321f87.exe -
Suspicious use of WriteProcessMemory 19 IoCs
Processes:
92fbec26fdd3d15c1b50b670ee321f87.exedescription pid process target process PID 3220 wrote to memory of 3276 3220 92fbec26fdd3d15c1b50b670ee321f87.exe 92fbec26fdd3d15c1b50b670ee321f87.exe PID 3220 wrote to memory of 3276 3220 92fbec26fdd3d15c1b50b670ee321f87.exe 92fbec26fdd3d15c1b50b670ee321f87.exe PID 3220 wrote to memory of 3276 3220 92fbec26fdd3d15c1b50b670ee321f87.exe 92fbec26fdd3d15c1b50b670ee321f87.exe PID 3220 wrote to memory of 3276 3220 92fbec26fdd3d15c1b50b670ee321f87.exe 92fbec26fdd3d15c1b50b670ee321f87.exe PID 3220 wrote to memory of 3276 3220 92fbec26fdd3d15c1b50b670ee321f87.exe 92fbec26fdd3d15c1b50b670ee321f87.exe PID 3220 wrote to memory of 3276 3220 92fbec26fdd3d15c1b50b670ee321f87.exe 92fbec26fdd3d15c1b50b670ee321f87.exe PID 3220 wrote to memory of 3276 3220 92fbec26fdd3d15c1b50b670ee321f87.exe 92fbec26fdd3d15c1b50b670ee321f87.exe PID 3220 wrote to memory of 3276 3220 92fbec26fdd3d15c1b50b670ee321f87.exe 92fbec26fdd3d15c1b50b670ee321f87.exe PID 3220 wrote to memory of 3276 3220 92fbec26fdd3d15c1b50b670ee321f87.exe 92fbec26fdd3d15c1b50b670ee321f87.exe PID 3220 wrote to memory of 3276 3220 92fbec26fdd3d15c1b50b670ee321f87.exe 92fbec26fdd3d15c1b50b670ee321f87.exe PID 3220 wrote to memory of 3276 3220 92fbec26fdd3d15c1b50b670ee321f87.exe 92fbec26fdd3d15c1b50b670ee321f87.exe PID 3220 wrote to memory of 3276 3220 92fbec26fdd3d15c1b50b670ee321f87.exe 92fbec26fdd3d15c1b50b670ee321f87.exe PID 3220 wrote to memory of 3276 3220 92fbec26fdd3d15c1b50b670ee321f87.exe 92fbec26fdd3d15c1b50b670ee321f87.exe PID 3220 wrote to memory of 3276 3220 92fbec26fdd3d15c1b50b670ee321f87.exe 92fbec26fdd3d15c1b50b670ee321f87.exe PID 3220 wrote to memory of 3276 3220 92fbec26fdd3d15c1b50b670ee321f87.exe 92fbec26fdd3d15c1b50b670ee321f87.exe PID 3220 wrote to memory of 3276 3220 92fbec26fdd3d15c1b50b670ee321f87.exe 92fbec26fdd3d15c1b50b670ee321f87.exe PID 3220 wrote to memory of 3276 3220 92fbec26fdd3d15c1b50b670ee321f87.exe 92fbec26fdd3d15c1b50b670ee321f87.exe PID 3220 wrote to memory of 3276 3220 92fbec26fdd3d15c1b50b670ee321f87.exe 92fbec26fdd3d15c1b50b670ee321f87.exe PID 3220 wrote to memory of 3276 3220 92fbec26fdd3d15c1b50b670ee321f87.exe 92fbec26fdd3d15c1b50b670ee321f87.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\92fbec26fdd3d15c1b50b670ee321f87.exe"C:\Users\Admin\AppData\Local\Temp\92fbec26fdd3d15c1b50b670ee321f87.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3220 -
C:\Users\Admin\AppData\Local\Temp\92fbec26fdd3d15c1b50b670ee321f87.exe"C:\Users\Admin\AppData\Local\Temp\92fbec26fdd3d15c1b50b670ee321f87.exe"2⤵PID:3276
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
12B
MD58cf4dec152a9d79a3d62202b886eda9b
SHA10c1b3d3d02c0b655aa3526a58486b84872f18cc2
SHA256c30e56c9c8fe30ffa4a4ff712cf2fa1808ee82ca258cd4c8ebefcc82250b6c01
SHA512a5a65f0604f8553d0be07bd5214db52d3f167e7511d29cb64e3fa9d8c510cc79976ff2a5acb9b8c09b666f306ac8e4ad389f9a2de3ca46d57b1e91060a4c50fd