Analysis
-
max time kernel
159s -
max time network
176s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
03-06-2024 10:55
Static task
static1
Behavioral task
behavioral1
Sample
Setup.exe
Resource
win7-20240508-en
windows7-x64
Behavioral task
behavioral2
Sample
Setup.exe
Resource
win10v2004-20240226-en
windows10-2004-x64
General
-
Target
Setup.exe
-
Size
793.8MB
-
MD5
9a851a47a9bd2f92c61d2486d1be3064
-
SHA1
3cda31c06db97246705d95dfcf4908eafb514b87
-
SHA256
7c2b51c31a895f2eeb6afe748f11d0f6a16355b01c41f22749043c0da7804206
-
SHA512
90340910dc1ee90ccfe7f451578de67c5ca32b95525157acd8b5bc2e99b9c0b2254bfb58997cc848a0ead871bc3f1e03dbb152d56aa709c4ecd3742404eec27b
-
SSDEEP
196608:6spHQk/ICYcdYtOQYMvm6Iu+8RuJQHIsuRuJyPquRuJXMD349nt3njto03qJbYav:6csCYgIBH2XD349nt3nW03s8up
Malware Config
Extracted
fickerstealer
45.93.201.181:80
Signatures
-
Fickerstealer
Ficker is an infostealer written in Rust and ASM.
-
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 34 api.ipify.org -
Suspicious behavior: EnumeratesProcesses 42 IoCs
pid Process 3484 Setup.exe 3484 Setup.exe 3484 Setup.exe 3484 Setup.exe 3484 Setup.exe 3484 Setup.exe 3484 Setup.exe 3484 Setup.exe 3484 Setup.exe 3484 Setup.exe 3484 Setup.exe 3484 Setup.exe 3484 Setup.exe 3484 Setup.exe 3484 Setup.exe 3484 Setup.exe 3484 Setup.exe 3484 Setup.exe 3484 Setup.exe 3484 Setup.exe 3484 Setup.exe 3484 Setup.exe 3484 Setup.exe 3484 Setup.exe 3484 Setup.exe 3484 Setup.exe 3484 Setup.exe 3484 Setup.exe 3484 Setup.exe 3484 Setup.exe 3484 Setup.exe 3484 Setup.exe 3484 Setup.exe 3484 Setup.exe 3484 Setup.exe 3484 Setup.exe 3484 Setup.exe 3484 Setup.exe 3484 Setup.exe 3484 Setup.exe 3484 Setup.exe 3484 Setup.exe -
Suspicious use of WriteProcessMemory 21 IoCs
description pid Process procid_target PID 3484 wrote to memory of 2740 3484 Setup.exe 98 PID 3484 wrote to memory of 2740 3484 Setup.exe 98 PID 3484 wrote to memory of 2740 3484 Setup.exe 98 PID 3484 wrote to memory of 2740 3484 Setup.exe 98 PID 3484 wrote to memory of 2740 3484 Setup.exe 98 PID 3484 wrote to memory of 2740 3484 Setup.exe 98 PID 3484 wrote to memory of 2740 3484 Setup.exe 98 PID 3484 wrote to memory of 2740 3484 Setup.exe 98 PID 3484 wrote to memory of 2740 3484 Setup.exe 98 PID 3484 wrote to memory of 2740 3484 Setup.exe 98 PID 3484 wrote to memory of 2740 3484 Setup.exe 98 PID 3484 wrote to memory of 2740 3484 Setup.exe 98 PID 3484 wrote to memory of 2740 3484 Setup.exe 98 PID 3484 wrote to memory of 2740 3484 Setup.exe 98 PID 3484 wrote to memory of 2740 3484 Setup.exe 98 PID 3484 wrote to memory of 2740 3484 Setup.exe 98 PID 3484 wrote to memory of 2740 3484 Setup.exe 98 PID 3484 wrote to memory of 2740 3484 Setup.exe 98 PID 3484 wrote to memory of 2740 3484 Setup.exe 98 PID 3484 wrote to memory of 2740 3484 Setup.exe 98 PID 3484 wrote to memory of 2740 3484 Setup.exe 98
Processes
-
C:\Users\Admin\AppData\Local\Temp\Setup.exe"C:\Users\Admin\AppData\Local\Temp\Setup.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3484 -
C:\Users\Admin\AppData\Local\Temp\Setup.exe"C:\Users\Admin\AppData\Local\Temp\Setup.exe"2⤵PID:2740
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4232 --field-trial-handle=2656,i,16940681401824032220,151921362336696246,262144 --variations-seed-version /prefetch:81⤵PID:3816
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
14B
MD51207bc197a1ebd72a77f1a771cad9e52
SHA18ed121ff66d407150d7390b9276fe690dd213b27
SHA256260658b9cb063d6ce96f681b18704e02fae7bf8fc995fc249ab0be1400983476
SHA512d037cfa3b6e6ced9652b2c781bb54cf48dbaa0aaff05039ae4fd0122749eda472807d4198981aa6ceffeba6d2b23d7ad08d7d96983dbd8539cf6b07e46e157f4