fickerstealer | 78dce934e15d7dd8be0038d350f32d1d02128b560fb328f954ce44b7fead353e

Analysis

max time kernel
149s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
16-02-2024 08:12

Target

9fdeed473f923e282c4394ff58191cbc.exe
Size

470KB
MD5

9fdeed473f923e282c4394ff58191cbc
SHA1

2ba8aafc4717afd8d374448b2193adba7a3d3f11
SHA256

78dce934e15d7dd8be0038d350f32d1d02128b560fb328f954ce44b7fead353e
SHA512

f25a915edb13ab797dcb128050b24aa1da90a0531d7d5d2a482e2c7ad74b2dc9792fdf1db4e75fa474e266718a3cdc47468ad6422c54d9498fce588a3d9ddb95
SSDEEP

6144:i+0ZycPjPPztWO/9adNDF5AJxbjYfC1lAAJB/L1XaW0rLFb56dpLN4XQKJ3:QycPzPztWuad5ebj09AnxXaW0rN3

Score

10^/10

Family

fickerstealer

asfasfvcxvdbs.com:80

Fickerstealer
Ficker is an infostealer written in Rust and ASM.
infostealer fickerstealer

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow	ioc
8	api.ipify.org

Suspicious use of SetThreadContext 1 IoCs

Processes:

9fdeed473f923e282c4394ff58191cbc.exe

description	pid	Process	procid_target
PID 2688 set thread context of 4900	2688	9fdeed473f923e282c4394ff58191cbc.exe	84

Suspicious use of WriteProcessMemory 19 IoCs

Processes:

9fdeed473f923e282c4394ff58191cbc.exe

description	pid	Process	procid_target
PID 2688 wrote to memory of 4900	2688	9fdeed473f923e282c4394ff58191cbc.exe	84
PID 2688 wrote to memory of 4900	2688	9fdeed473f923e282c4394ff58191cbc.exe	84
PID 2688 wrote to memory of 4900	2688	9fdeed473f923e282c4394ff58191cbc.exe	84
PID 2688 wrote to memory of 4900	2688	9fdeed473f923e282c4394ff58191cbc.exe	84
PID 2688 wrote to memory of 4900	2688	9fdeed473f923e282c4394ff58191cbc.exe	84
PID 2688 wrote to memory of 4900	2688	9fdeed473f923e282c4394ff58191cbc.exe	84
PID 2688 wrote to memory of 4900	2688	9fdeed473f923e282c4394ff58191cbc.exe	84
PID 2688 wrote to memory of 4900	2688	9fdeed473f923e282c4394ff58191cbc.exe	84
PID 2688 wrote to memory of 4900	2688	9fdeed473f923e282c4394ff58191cbc.exe	84
PID 2688 wrote to memory of 4900	2688	9fdeed473f923e282c4394ff58191cbc.exe	84
PID 2688 wrote to memory of 4900	2688	9fdeed473f923e282c4394ff58191cbc.exe	84
PID 2688 wrote to memory of 4900	2688	9fdeed473f923e282c4394ff58191cbc.exe	84
PID 2688 wrote to memory of 4900	2688	9fdeed473f923e282c4394ff58191cbc.exe	84
PID 2688 wrote to memory of 4900	2688	9fdeed473f923e282c4394ff58191cbc.exe	84
PID 2688 wrote to memory of 4900	2688	9fdeed473f923e282c4394ff58191cbc.exe	84
PID 2688 wrote to memory of 4900	2688	9fdeed473f923e282c4394ff58191cbc.exe	84
PID 2688 wrote to memory of 4900	2688	9fdeed473f923e282c4394ff58191cbc.exe	84
PID 2688 wrote to memory of 4900	2688	9fdeed473f923e282c4394ff58191cbc.exe	84
PID 2688 wrote to memory of 4900	2688	9fdeed473f923e282c4394ff58191cbc.exe	84

C:\Users\Admin\AppData\Local\Temp\9fdeed473f923e282c4394ff58191cbc.exe
"C:\Users\Admin\AppData\Local\Temp\9fdeed473f923e282c4394ff58191cbc.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2688
- C:\Users\Admin\AppData\Local\Temp\9fdeed473f923e282c4394ff58191cbc.exe
  "C:\Users\Admin\AppData\Local\Temp\9fdeed473f923e282c4394ff58191cbc.exe"
  2⤵
  PID:4900

C:\ProgramData\kaosdma.txt

Filesize
12B

MD5
8cf4dec152a9d79a3d62202b886eda9b

SHA1
0c1b3d3d02c0b655aa3526a58486b84872f18cc2

SHA256
c30e56c9c8fe30ffa4a4ff712cf2fa1808ee82ca258cd4c8ebefcc82250b6c01

SHA512
a5a65f0604f8553d0be07bd5214db52d3f167e7511d29cb64e3fa9d8c510cc79976ff2a5acb9b8c09b666f306ac8e4ad389f9a2de3ca46d57b1e91060a4c50fd

Download Submit
memory/2688-1-0x0000000002CD0000-0x0000000002DD0000-memory.dmp

Filesize
1024KB

Download
memory/2688-2-0x00000000049D0000-0x0000000004A17000-memory.dmp

Filesize
284KB

Download
memory/4900-3-0x0000000000400000-0x000000000044F000-memory.dmp

Filesize
316KB

Download
memory/4900-5-0x0000000000400000-0x000000000044F000-memory.dmp

Filesize
316KB

Download
memory/4900-6-0x0000000000400000-0x000000000044F000-memory.dmp

Filesize
316KB

Download
memory/4900-12-0x0000000000400000-0x000000000044F000-memory.dmp

Filesize
316KB

Download