fickerstealer | 08d215fd35494280e6397e8bc527bd6de64eb78a73acd3bd07a01da376ed4cb7

Analysis

max time kernel
148s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
16/03/2024, 04:03

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
1cr.exe
Size 667KB
Sample240316-embq4abd5t
SHA256 25eb1831bf580a45f9464bcf50ef2b3d35021f6eb5e42874b2dd8fd8544cf853
MD5 8c56ecce67e5e43e872863f41fe03eab
SHA1 ad4785bf01141163053f421d15fe76a460836c9b
SHA512 63ade7eca68d011e979e2ff0568899136b3fec35370959fafe751edfff379e88b25431584e9cdc80c4d7354b9f6ed894ae4b9e6402d51a0af82f1544299c1a1c
SSDEEP 12288:XNECjrWAEX1Cfy0BTutPKgUlPB8+OuIwYs84X7IY4sCjlbg4xWvVf:XNNjryCf1BTuIXlPB8+ODwYG7IY4sCjq
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

fickerstealer infostealer

Malware Config

Extracted

Family

fickerstealer

109.234.35.192:80

Signatures

Fickerstealer
Ficker is an infostealer written in Rust and ASM.
infostealer fickerstealer

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
98	api.ipify.org

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4984 set thread context of 2912	4984	1cr.exe	103

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
4984	1cr.exe
4984	1cr.exe
4984	1cr.exe
4984	1cr.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4984	1cr.exe

Suspicious use of WriteProcessMemory 18 IoCs

description	pid	Process	procid_target
PID 4984 wrote to memory of 5116	4984	1cr.exe	101
PID 4984 wrote to memory of 5116	4984	1cr.exe	101
PID 4984 wrote to memory of 5116	4984	1cr.exe	101
PID 4984 wrote to memory of 4444	4984	1cr.exe	102
PID 4984 wrote to memory of 4444	4984	1cr.exe	102
PID 4984 wrote to memory of 4444	4984	1cr.exe	102
PID 4984 wrote to memory of 2912	4984	1cr.exe	103
PID 4984 wrote to memory of 2912	4984	1cr.exe	103
PID 4984 wrote to memory of 2912	4984	1cr.exe	103
PID 4984 wrote to memory of 2912	4984	1cr.exe	103
PID 4984 wrote to memory of 2912	4984	1cr.exe	103
PID 4984 wrote to memory of 2912	4984	1cr.exe	103
PID 4984 wrote to memory of 2912	4984	1cr.exe	103
PID 4984 wrote to memory of 2912	4984	1cr.exe	103
PID 4984 wrote to memory of 2912	4984	1cr.exe	103
PID 4984 wrote to memory of 2912	4984	1cr.exe	103
PID 4984 wrote to memory of 2912	4984	1cr.exe	103
PID 4984 wrote to memory of 2912	4984	1cr.exe	103

C:\Users\Admin\AppData\Local\Temp\1cr.exe
"C:\Users\Admin\AppData\Local\Temp\1cr.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4984
- C:\Users\Admin\AppData\Local\Temp\1cr.exe
  "{path}"
  2⤵
  PID:5116
- C:\Users\Admin\AppData\Local\Temp\1cr.exe
  "{path}"
  2⤵
  PID:4444
- C:\Users\Admin\AppData\Local\Temp\1cr.exe
  "{path}"
  2⤵
  PID:2912

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

kaosdma.txt

Path C:\ProgramData\kaosdma.txt
Size 12B
SHA256 c30e56c9c8fe30ffa4a4ff712cf2fa1808ee82ca258cd4c8ebefcc82250b6c01
MD5 8cf4dec152a9d79a3d62202b886eda9b
SHA1 0c1b3d3d02c0b655aa3526a58486b84872f18cc2
SHA512 a5a65f0604f8553d0be07bd5214db52d3f167e7511d29cb64e3fa9d8c510cc79976ff2a5acb9b8c09b666f306ac8e4ad389f9a2de3ca46d57b1e91060a4c50fd
MD5 SHA1 SHA512

Submit Download

memory/2912-11-0x0000000000400000-0x0000000000448000-memory.dmp

Download

memory/2912-22-0x0000000000400000-0x0000000000448000-memory.dmp

Download

memory/2912-15-0x0000000000400000-0x0000000000448000-memory.dmp

Download

memory/2912-14-0x0000000000400000-0x0000000000448000-memory.dmp

Download

memory/4984-4-0x0000000004F10000-0x0000000004F20000-memory.dmp

Download

memory/4984-6-0x00000000062F0000-0x000000000638C000-memory.dmp

Download

memory/4984-7-0x0000000005300000-0x0000000005308000-memory.dmp

Download

memory/4984-8-0x0000000074AF0000-0x00000000752A0000-memory.dmp

Download

memory/4984-9-0x0000000004F10000-0x0000000004F20000-memory.dmp

Download

memory/4984-10-0x0000000006390000-0x0000000006432000-memory.dmp

Download

memory/4984-5-0x0000000004D40000-0x0000000004D4A000-memory.dmp

Download

memory/4984-0-0x00000000001F0000-0x000000000029E000-memory.dmp

Download

memory/4984-16-0x0000000074AF0000-0x00000000752A0000-memory.dmp

Download

memory/4984-3-0x0000000004C90000-0x0000000004D22000-memory.dmp

Download

memory/4984-2-0x0000000005310000-0x00000000058B4000-memory.dmp

Download

memory/4984-1-0x0000000074AF0000-0x00000000752A0000-memory.dmp

Download