fickerstealer | f9ff859f39a9e54d733f9c3da77a0c42a4f9c6c53eccccfd7e874b8b5018ec96

Analysis

max time kernel
15s
max time network
26s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
19-09-2024 14:13

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Setup.exe
Size

793.8MB
MD5

9a851a47a9bd2f92c61d2486d1be3064
SHA1

3cda31c06db97246705d95dfcf4908eafb514b87
SHA256

7c2b51c31a895f2eeb6afe748f11d0f6a16355b01c41f22749043c0da7804206
SHA512

90340910dc1ee90ccfe7f451578de67c5ca32b95525157acd8b5bc2e99b9c0b2254bfb58997cc848a0ead871bc3f1e03dbb152d56aa709c4ecd3742404eec27b
SSDEEP

196608:6spHQk/ICYcdYtOQYMvm6Iu+8RuJQHIsuRuJyPquRuJXMD349nt3njto03qJbYav:6csCYgIBH2XD349nt3nW03s8up

Score

10^/10

fickerstealer discovery infostealer

Malware Config

Extracted

Family

fickerstealer

45.93.201.181:80

Signatures

Fickerstealer
Ficker is an infostealer written in Rust and ASM.
infostealer fickerstealer

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
4	api.ipify.org

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2716	2552	WerFault.exe	32

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Setup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Setup.exe

Suspicious behavior: EnumeratesProcesses 21 IoCs

pid	Process
2224	Setup.exe
2224	Setup.exe
2224	Setup.exe
2224	Setup.exe
2224	Setup.exe
2224	Setup.exe
2224	Setup.exe
2224	Setup.exe
2224	Setup.exe
2224	Setup.exe
2224	Setup.exe
2224	Setup.exe
2224	Setup.exe
2224	Setup.exe
2224	Setup.exe
2224	Setup.exe
2224	Setup.exe
2224	Setup.exe
2224	Setup.exe
2224	Setup.exe
2224	Setup.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: 33	2108	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	2108	AUDIODG.EXE
Token: 33	2108	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	2108	AUDIODG.EXE

Suspicious use of WriteProcessMemory 32 IoCs

description	pid	Process	procid_target
PID 2224 wrote to memory of 2552	2224	Setup.exe	32
PID 2224 wrote to memory of 2552	2224	Setup.exe	32
PID 2224 wrote to memory of 2552	2224	Setup.exe	32
PID 2224 wrote to memory of 2552	2224	Setup.exe	32
PID 2224 wrote to memory of 2552	2224	Setup.exe	32
PID 2224 wrote to memory of 2552	2224	Setup.exe	32
PID 2224 wrote to memory of 2552	2224	Setup.exe	32
PID 2224 wrote to memory of 2552	2224	Setup.exe	32
PID 2224 wrote to memory of 2552	2224	Setup.exe	32
PID 2224 wrote to memory of 2552	2224	Setup.exe	32
PID 2224 wrote to memory of 2552	2224	Setup.exe	32
PID 2224 wrote to memory of 2552	2224	Setup.exe	32
PID 2224 wrote to memory of 2552	2224	Setup.exe	32
PID 2224 wrote to memory of 2552	2224	Setup.exe	32
PID 2224 wrote to memory of 2552	2224	Setup.exe	32
PID 2224 wrote to memory of 2552	2224	Setup.exe	32
PID 2224 wrote to memory of 2552	2224	Setup.exe	32
PID 2224 wrote to memory of 2552	2224	Setup.exe	32
PID 2224 wrote to memory of 2552	2224	Setup.exe	32
PID 2224 wrote to memory of 2552	2224	Setup.exe	32
PID 2224 wrote to memory of 2552	2224	Setup.exe	32
PID 2224 wrote to memory of 2552	2224	Setup.exe	32
PID 2224 wrote to memory of 2552	2224	Setup.exe	32
PID 2224 wrote to memory of 2552	2224	Setup.exe	32
PID 2224 wrote to memory of 2552	2224	Setup.exe	32
PID 2552 wrote to memory of 2716	2552	Setup.exe	33
PID 2552 wrote to memory of 2716	2552	Setup.exe	33
PID 2552 wrote to memory of 2716	2552	Setup.exe	33
PID 2552 wrote to memory of 2716	2552	Setup.exe	33
PID 2552 wrote to memory of 2716	2552	Setup.exe	33
PID 2552 wrote to memory of 2716	2552	Setup.exe	33
PID 2552 wrote to memory of 2716	2552	Setup.exe	33

C:\Users\Admin\AppData\Local\Temp\Setup.exe
"C:\Users\Admin\AppData\Local\Temp\Setup.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2224
- C:\Users\Admin\AppData\Local\Temp\Setup.exe
  "C:\Users\Admin\AppData\Local\Temp\Setup.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2552
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2552 -s 1260
    3⤵
    - Program crash
    PID:2716

C:\Windows\explorer.exe
"C:\Windows\explorer.exe"
1⤵
PID:2964

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x460
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2108

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\krosqm.txt

Filesize
13B

MD5
e2fff14c2469af9d19a47bd7b8778f5c

SHA1
35762a46e2073cca003063a2ea2220eef5e16341

SHA256
5a7484c0f29556f1544f0112fa6af02c0d3200148c8b18ee31b8664ef6419278

SHA512
6fdd90db662374ffffe76bb43230a743aa802ae8773daea983564706a1436eade62ceaee0fdd931d62c3e87b0e181dcf0be42ef37b69b41c7dd279890f4537e3

Download Submit
memory/2224-1-0x0000000000400000-0x0000000001400000-memory.dmp

Filesize
16.0MB

Download
memory/2552-0-0x0000000000400000-0x0000000000466000-memory.dmp

Filesize
408KB

Download
memory/2552-3-0x0000000000400000-0x0000000000466000-memory.dmp

Filesize
408KB

Download
memory/2552-4-0x0000000000400000-0x0000000000466000-memory.dmp

Filesize
408KB

Download
memory/2552-11-0x0000000000400000-0x0000000000466000-memory.dmp

Filesize
408KB

Download