Analysis
- max time kernel
148s - max time network
151s - platform
windows7_x64 - resource
win7-20231129-en - resource tags
- submitted
16/03/2024, 04:03
General
- Target 1cr.exe
- Size 667KB
- Sample240316-embq4abd5t
- SHA256 25eb1831bf580a45f9464bcf50ef2b3d35021f6eb5e42874b2dd8fd8544cf853
Malware Config
Extracted
-
fickerstealer
-
109.234.35.192:80
Signatures
- Fickerstealer
Ficker is an infostealer written in Rust and ASM.
- Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Suspicious use of SetThreadContext 1 IoCs
- Suspicious use of WriteProcessMemory 13 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\1cr.exe"C:\Users\Admin\AppData\Local\Temp\1cr.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\1cr.exe"{path}"2⤵
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
kaosdma.txt
memory/1936-1-0x0000000073F60000-0x000000007464E000-memory.dmp
memory/1936-0-0x0000000000290000-0x000000000033E000-memory.dmp
memory/1936-2-0x0000000004F10000-0x0000000004F50000-memory.dmp
memory/1936-3-0x0000000000620000-0x0000000000628000-memory.dmp
memory/1936-4-0x0000000073F60000-0x000000007464E000-memory.dmp
memory/1936-5-0x0000000004F10000-0x0000000004F50000-memory.dmp
memory/1936-6-0x00000000052A0000-0x0000000005342000-memory.dmp
memory/1936-20-0x0000000073F60000-0x000000007464E000-memory.dmp
memory/2756-10-0x0000000000400000-0x0000000000448000-memory.dmp
memory/2756-9-0x0000000000400000-0x0000000000448000-memory.dmp
memory/2756-11-0x0000000000400000-0x0000000000448000-memory.dmp
memory/2756-12-0x0000000000400000-0x0000000000448000-memory.dmp
memory/2756-13-0x0000000000400000-0x0000000000448000-memory.dmp
memory/2756-14-0x0000000000400000-0x0000000000448000-memory.dmp
memory/2756-15-0x000000007EFDE000-0x000000007EFDF000-memory.dmp
memory/2756-8-0x0000000000400000-0x0000000000448000-memory.dmp
memory/2756-19-0x0000000000400000-0x0000000000448000-memory.dmp
memory/2756-21-0x0000000000400000-0x0000000000448000-memory.dmp
memory/2756-7-0x0000000000400000-0x0000000000448000-memory.dmp
memory/2756-27-0x0000000000400000-0x0000000000448000-memory.dmp