fickerstealer | 08d215fd35494280e6397e8bc527bd6de64eb78a73acd3bd07a01da376ed4cb7

Analysis

max time kernel
148s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
16-03-2024 04:03

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1cr.exe
Size

667KB
MD5

8c56ecce67e5e43e872863f41fe03eab
SHA1

ad4785bf01141163053f421d15fe76a460836c9b
SHA256

25eb1831bf580a45f9464bcf50ef2b3d35021f6eb5e42874b2dd8fd8544cf853
SHA512

63ade7eca68d011e979e2ff0568899136b3fec35370959fafe751edfff379e88b25431584e9cdc80c4d7354b9f6ed894ae4b9e6402d51a0af82f1544299c1a1c
SSDEEP

12288:XNECjrWAEX1Cfy0BTutPKgUlPB8+OuIwYs84X7IY4sCjlbg4xWvVf:XNNjryCf1BTuIXlPB8+ODwYG7IY4sCjq

Score

10^/10

fickerstealer infostealer

Malware Config

Extracted

Family

fickerstealer

109.234.35.192:80

Signatures

Fickerstealer
Ficker is an infostealer written in Rust and ASM.
infostealer fickerstealer
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

98 api.ipify.org
Suspicious use of SetThreadContext 1 IoCs

Processes:

1cr.exe

description pid process target process

PID 4984 set thread context of 2912 4984 1cr.exe 1cr.exe
Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

1cr.exe

pid process

4984 1cr.exe
4984 1cr.exe
4984 1cr.exe
4984 1cr.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

1cr.exe

description pid process

Token: SeDebugPrivilege 4984 1cr.exe

flow	ioc
98	api.ipify.org

description	pid	process	target process
PID 4984 set thread context of 2912	4984	1cr.exe	1cr.exe

pid	process
4984	1cr.exe
4984	1cr.exe
4984	1cr.exe
4984	1cr.exe

description	pid	process
Token: SeDebugPrivilege	4984	1cr.exe

Suspicious use of WriteProcessMemory 18 IoCs

Processes:

1cr.exe

description	pid	process	target process
PID 4984 wrote to memory of 5116	4984	1cr.exe	1cr.exe
PID 4984 wrote to memory of 5116	4984	1cr.exe	1cr.exe
PID 4984 wrote to memory of 5116	4984	1cr.exe	1cr.exe
PID 4984 wrote to memory of 4444	4984	1cr.exe	1cr.exe
PID 4984 wrote to memory of 4444	4984	1cr.exe	1cr.exe
PID 4984 wrote to memory of 4444	4984	1cr.exe	1cr.exe
PID 4984 wrote to memory of 2912	4984	1cr.exe	1cr.exe
PID 4984 wrote to memory of 2912	4984	1cr.exe	1cr.exe
PID 4984 wrote to memory of 2912	4984	1cr.exe	1cr.exe
PID 4984 wrote to memory of 2912	4984	1cr.exe	1cr.exe
PID 4984 wrote to memory of 2912	4984	1cr.exe	1cr.exe
PID 4984 wrote to memory of 2912	4984	1cr.exe	1cr.exe
PID 4984 wrote to memory of 2912	4984	1cr.exe	1cr.exe
PID 4984 wrote to memory of 2912	4984	1cr.exe	1cr.exe
PID 4984 wrote to memory of 2912	4984	1cr.exe	1cr.exe
PID 4984 wrote to memory of 2912	4984	1cr.exe	1cr.exe
PID 4984 wrote to memory of 2912	4984	1cr.exe	1cr.exe
PID 4984 wrote to memory of 2912	4984	1cr.exe	1cr.exe

C:\Users\Admin\AppData\Local\Temp\1cr.exe
"C:\Users\Admin\AppData\Local\Temp\1cr.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4984

C:\Users\Admin\AppData\Local\Temp\1cr.exe
"{path}"
2⤵
PID:5116

C:\Users\Admin\AppData\Local\Temp\1cr.exe
"{path}"
2⤵
PID:4444

C:\Users\Admin\AppData\Local\Temp\1cr.exe
"{path}"
2⤵
PID:2912

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\kaosdma.txt
Filesize
12B

MD5
8cf4dec152a9d79a3d62202b886eda9b

SHA1
0c1b3d3d02c0b655aa3526a58486b84872f18cc2

SHA256
c30e56c9c8fe30ffa4a4ff712cf2fa1808ee82ca258cd4c8ebefcc82250b6c01

SHA512
a5a65f0604f8553d0be07bd5214db52d3f167e7511d29cb64e3fa9d8c510cc79976ff2a5acb9b8c09b666f306ac8e4ad389f9a2de3ca46d57b1e91060a4c50fd

Download Submit
memory/2912-11-0x0000000000400000-0x0000000000448000-memory.dmp

Filesize
288KB

Download
memory/2912-22-0x0000000000400000-0x0000000000448000-memory.dmp

Filesize
288KB

Download
memory/2912-15-0x0000000000400000-0x0000000000448000-memory.dmp

Filesize
288KB

Download
memory/2912-14-0x0000000000400000-0x0000000000448000-memory.dmp

Filesize
288KB

Download
memory/4984-4-0x0000000004F10000-0x0000000004F20000-memory.dmp

Filesize
64KB

Download
memory/4984-6-0x00000000062F0000-0x000000000638C000-memory.dmp

Filesize
624KB

Download
memory/4984-7-0x0000000005300000-0x0000000005308000-memory.dmp

Filesize
32KB

Download
memory/4984-8-0x0000000074AF0000-0x00000000752A0000-memory.dmp

Filesize
7.7MB

Download
memory/4984-9-0x0000000004F10000-0x0000000004F20000-memory.dmp

Filesize
64KB

Download
memory/4984-10-0x0000000006390000-0x0000000006432000-memory.dmp

Filesize
648KB

Download
memory/4984-5-0x0000000004D40000-0x0000000004D4A000-memory.dmp

Filesize
40KB

Download
memory/4984-0-0x00000000001F0000-0x000000000029E000-memory.dmp

Filesize
696KB

Download
memory/4984-16-0x0000000074AF0000-0x00000000752A0000-memory.dmp

Filesize
7.7MB

Download
memory/4984-3-0x0000000004C90000-0x0000000004D22000-memory.dmp

Filesize
584KB

Download
memory/4984-2-0x0000000005310000-0x00000000058B4000-memory.dmp

Filesize
5.6MB

Download
memory/4984-1-0x0000000074AF0000-0x00000000752A0000-memory.dmp

Filesize
7.7MB

Download