Analysis
-
max time kernel
121s -
max time network
130s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
20-03-2024 11:58
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
Setup.exe
Resource
win7-20240221-en
windows7-x64
4 signatures
300 seconds
Behavioral task
behavioral2
Sample
Setup.exe
Resource
win10v2004-20240226-en
windows10-2004-x64
4 signatures
300 seconds
General
-
Target
Setup.exe
-
Size
793.8MB
-
MD5
9a851a47a9bd2f92c61d2486d1be3064
-
SHA1
3cda31c06db97246705d95dfcf4908eafb514b87
-
SHA256
7c2b51c31a895f2eeb6afe748f11d0f6a16355b01c41f22749043c0da7804206
-
SHA512
90340910dc1ee90ccfe7f451578de67c5ca32b95525157acd8b5bc2e99b9c0b2254bfb58997cc848a0ead871bc3f1e03dbb152d56aa709c4ecd3742404eec27b
-
SSDEEP
196608:6spHQk/ICYcdYtOQYMvm6Iu+8RuJQHIsuRuJyPquRuJXMD349nt3njto03qJbYav:6csCYgIBH2XD349nt3nW03s8up
Score
10/10
Malware Config
Extracted
Family
fickerstealer
C2
45.93.201.181:80
Signatures
-
Fickerstealer
Ficker is an infostealer written in Rust and ASM.
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target Process procid_target 2504 2664 WerFault.exe 28 -
Suspicious behavior: EnumeratesProcesses 21 IoCs
Processes:
Setup.exepid Process 2012 Setup.exe 2012 Setup.exe 2012 Setup.exe 2012 Setup.exe 2012 Setup.exe 2012 Setup.exe 2012 Setup.exe 2012 Setup.exe 2012 Setup.exe 2012 Setup.exe 2012 Setup.exe 2012 Setup.exe 2012 Setup.exe 2012 Setup.exe 2012 Setup.exe 2012 Setup.exe 2012 Setup.exe 2012 Setup.exe 2012 Setup.exe 2012 Setup.exe 2012 Setup.exe -
Suspicious use of WriteProcessMemory 32 IoCs
Processes:
Setup.exeSetup.exedescription pid Process procid_target PID 2012 wrote to memory of 2664 2012 Setup.exe 28 PID 2012 wrote to memory of 2664 2012 Setup.exe 28 PID 2012 wrote to memory of 2664 2012 Setup.exe 28 PID 2012 wrote to memory of 2664 2012 Setup.exe 28 PID 2012 wrote to memory of 2664 2012 Setup.exe 28 PID 2012 wrote to memory of 2664 2012 Setup.exe 28 PID 2012 wrote to memory of 2664 2012 Setup.exe 28 PID 2012 wrote to memory of 2664 2012 Setup.exe 28 PID 2012 wrote to memory of 2664 2012 Setup.exe 28 PID 2012 wrote to memory of 2664 2012 Setup.exe 28 PID 2012 wrote to memory of 2664 2012 Setup.exe 28 PID 2012 wrote to memory of 2664 2012 Setup.exe 28 PID 2012 wrote to memory of 2664 2012 Setup.exe 28 PID 2012 wrote to memory of 2664 2012 Setup.exe 28 PID 2012 wrote to memory of 2664 2012 Setup.exe 28 PID 2012 wrote to memory of 2664 2012 Setup.exe 28 PID 2012 wrote to memory of 2664 2012 Setup.exe 28 PID 2012 wrote to memory of 2664 2012 Setup.exe 28 PID 2012 wrote to memory of 2664 2012 Setup.exe 28 PID 2012 wrote to memory of 2664 2012 Setup.exe 28 PID 2012 wrote to memory of 2664 2012 Setup.exe 28 PID 2012 wrote to memory of 2664 2012 Setup.exe 28 PID 2012 wrote to memory of 2664 2012 Setup.exe 28 PID 2012 wrote to memory of 2664 2012 Setup.exe 28 PID 2012 wrote to memory of 2664 2012 Setup.exe 28 PID 2664 wrote to memory of 2504 2664 Setup.exe 29 PID 2664 wrote to memory of 2504 2664 Setup.exe 29 PID 2664 wrote to memory of 2504 2664 Setup.exe 29 PID 2664 wrote to memory of 2504 2664 Setup.exe 29 PID 2664 wrote to memory of 2504 2664 Setup.exe 29 PID 2664 wrote to memory of 2504 2664 Setup.exe 29 PID 2664 wrote to memory of 2504 2664 Setup.exe 29
Processes
-
C:\Users\Admin\AppData\Local\Temp\Setup.exe"C:\Users\Admin\AppData\Local\Temp\Setup.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2012 -
C:\Users\Admin\AppData\Local\Temp\Setup.exe"C:\Users\Admin\AppData\Local\Temp\Setup.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:2664 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2664 -s 2563⤵
- Program crash
PID:2504
-
-
-
C:\Windows\explorer.exe"C:\Windows\explorer.exe"1⤵PID:2628