fickerstealer | 08d215fd35494280e6397e8bc527bd6de64eb78a73acd3bd07a01da376ed4cb7

Analysis

max time kernel
148s
max time network
151s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
16-03-2024 04:03

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1cr.exe
Size

667KB
MD5

8c56ecce67e5e43e872863f41fe03eab
SHA1

ad4785bf01141163053f421d15fe76a460836c9b
SHA256

25eb1831bf580a45f9464bcf50ef2b3d35021f6eb5e42874b2dd8fd8544cf853
SHA512

63ade7eca68d011e979e2ff0568899136b3fec35370959fafe751edfff379e88b25431584e9cdc80c4d7354b9f6ed894ae4b9e6402d51a0af82f1544299c1a1c
SSDEEP

12288:XNECjrWAEX1Cfy0BTutPKgUlPB8+OuIwYs84X7IY4sCjlbg4xWvVf:XNNjryCf1BTuIXlPB8+ODwYG7IY4sCjq

Score

10^/10

fickerstealer infostealer

Malware Config

Extracted

Family

fickerstealer

109.234.35.192:80

Signatures

Fickerstealer
Ficker is an infostealer written in Rust and ASM.
infostealer fickerstealer
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

3 api.ipify.org
Suspicious use of SetThreadContext 1 IoCs

Processes:

1cr.exe

description pid process target process

PID 1936 set thread context of 2756 1936 1cr.exe 1cr.exe

flow	ioc
3	api.ipify.org

description	pid	process	target process
PID 1936 set thread context of 2756	1936	1cr.exe	1cr.exe

Suspicious use of WriteProcessMemory 13 IoCs

Processes:

1cr.exe

description	pid	process	target process
PID 1936 wrote to memory of 2756	1936	1cr.exe	1cr.exe
PID 1936 wrote to memory of 2756	1936	1cr.exe	1cr.exe
PID 1936 wrote to memory of 2756	1936	1cr.exe	1cr.exe
PID 1936 wrote to memory of 2756	1936	1cr.exe	1cr.exe
PID 1936 wrote to memory of 2756	1936	1cr.exe	1cr.exe
PID 1936 wrote to memory of 2756	1936	1cr.exe	1cr.exe
PID 1936 wrote to memory of 2756	1936	1cr.exe	1cr.exe
PID 1936 wrote to memory of 2756	1936	1cr.exe	1cr.exe
PID 1936 wrote to memory of 2756	1936	1cr.exe	1cr.exe
PID 1936 wrote to memory of 2756	1936	1cr.exe	1cr.exe
PID 1936 wrote to memory of 2756	1936	1cr.exe	1cr.exe
PID 1936 wrote to memory of 2756	1936	1cr.exe	1cr.exe
PID 1936 wrote to memory of 2756	1936	1cr.exe	1cr.exe

C:\Users\Admin\AppData\Local\Temp\1cr.exe
"C:\Users\Admin\AppData\Local\Temp\1cr.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1936

C:\Users\Admin\AppData\Local\Temp\1cr.exe
"{path}"
2⤵
PID:2756

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\kaosdma.txt
Filesize
12B

MD5
8cf4dec152a9d79a3d62202b886eda9b

SHA1
0c1b3d3d02c0b655aa3526a58486b84872f18cc2

SHA256
c30e56c9c8fe30ffa4a4ff712cf2fa1808ee82ca258cd4c8ebefcc82250b6c01

SHA512
a5a65f0604f8553d0be07bd5214db52d3f167e7511d29cb64e3fa9d8c510cc79976ff2a5acb9b8c09b666f306ac8e4ad389f9a2de3ca46d57b1e91060a4c50fd

Download Submit
memory/1936-1-0x0000000073F60000-0x000000007464E000-memory.dmp

Filesize
6.9MB

Download
memory/1936-0-0x0000000000290000-0x000000000033E000-memory.dmp

Filesize
696KB

Download
memory/1936-2-0x0000000004F10000-0x0000000004F50000-memory.dmp

Filesize
256KB

Download
memory/1936-3-0x0000000000620000-0x0000000000628000-memory.dmp

Filesize
32KB

Download
memory/1936-4-0x0000000073F60000-0x000000007464E000-memory.dmp

Filesize
6.9MB

Download
memory/1936-5-0x0000000004F10000-0x0000000004F50000-memory.dmp

Filesize
256KB

Download
memory/1936-6-0x00000000052A0000-0x0000000005342000-memory.dmp

Filesize
648KB

Download
memory/1936-20-0x0000000073F60000-0x000000007464E000-memory.dmp

Filesize
6.9MB

Download
memory/2756-10-0x0000000000400000-0x0000000000448000-memory.dmp

Filesize
288KB

Download
memory/2756-9-0x0000000000400000-0x0000000000448000-memory.dmp

Filesize
288KB

Download
memory/2756-11-0x0000000000400000-0x0000000000448000-memory.dmp

Filesize
288KB

Download
memory/2756-12-0x0000000000400000-0x0000000000448000-memory.dmp

Filesize
288KB

Download
memory/2756-13-0x0000000000400000-0x0000000000448000-memory.dmp

Filesize
288KB

Download
memory/2756-14-0x0000000000400000-0x0000000000448000-memory.dmp

Filesize
288KB

Download
memory/2756-15-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2756-8-0x0000000000400000-0x0000000000448000-memory.dmp

Filesize
288KB

Download
memory/2756-19-0x0000000000400000-0x0000000000448000-memory.dmp

Filesize
288KB

Download
memory/2756-21-0x0000000000400000-0x0000000000448000-memory.dmp

Filesize
288KB

Download
memory/2756-7-0x0000000000400000-0x0000000000448000-memory.dmp

Filesize
288KB

Download
memory/2756-27-0x0000000000400000-0x0000000000448000-memory.dmp

Filesize
288KB

Download