fickerstealer | 7c2b51c31a895f2eeb6afe748f11d0f6a16355b01c41f22749043c0da7804206

Analysis

user interaction
yes
max time kernel
39s
max time network
40s
platform
windows10-ltsc_2021_x64
resource
win10ltsc2021-20260911-es
resource tags

arch:x64arch:x86image:win10ltsc2021-20260911-eslocale:es-esos:windows10-ltsc_2021-x64systemwindows
submitted
30/09/2026, 18:39

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Setup.exe
Size 793.8MB
Sample260930-xar7eswt9m
SHA256 7c2b51c31a895f2eeb6afe748f11d0f6a16355b01c41f22749043c0da7804206
MD5 9a851a47a9bd2f92c61d2486d1be3064
SHA1 3cda31c06db97246705d95dfcf4908eafb514b87
SHA512 90340910dc1ee90ccfe7f451578de67c5ca32b95525157acd8b5bc2e99b9c0b2254bfb58997cc848a0ead871bc3f1e03dbb152d56aa709c4ecd3742404eec27b
SSDEEP 196608:6spHQk/ICYcdYtOQYMvm6Iu+8RuJQHIsuRuJyPquRuJXMD349nt3njto03qJbYav:6csCYgIBH2XD349nt3nW03s8up
TLSH
T17D894816A384D526E5630E774D1BDAD878297E301E20984F7FA83F4C6F3DB91A928353
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery fickerstealer infostealer

Malware Config

Extracted

Family

fickerstealer

45.93.201.181:80

Signatures

Family: Fickerstealer
Ficker is an infostealer written in Rust and ASM.
infostealer fickerstealer

Looks up external IP address via web service 1 TTPs 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

discovery

Internet Connection Discovery

T1016.001

flow	ioc
7	api.ipify.org

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	Setup.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	Setup.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Setup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Setup.exe

Suspicious behavior: EnumeratesProcesses 42 IoCs

pid	Process
868	Setup.exe
868	Setup.exe
868	Setup.exe
868	Setup.exe
868	Setup.exe
868	Setup.exe
868	Setup.exe
868	Setup.exe
868	Setup.exe
868	Setup.exe
868	Setup.exe
868	Setup.exe
868	Setup.exe
868	Setup.exe
868	Setup.exe
868	Setup.exe
868	Setup.exe
868	Setup.exe
868	Setup.exe
868	Setup.exe
868	Setup.exe
868	Setup.exe
868	Setup.exe
868	Setup.exe
868	Setup.exe
868	Setup.exe
868	Setup.exe
868	Setup.exe
868	Setup.exe
868	Setup.exe
868	Setup.exe
868	Setup.exe
868	Setup.exe
868	Setup.exe
868	Setup.exe
868	Setup.exe
868	Setup.exe
868	Setup.exe
868	Setup.exe
868	Setup.exe
868	Setup.exe
868	Setup.exe

Suspicious use of WriteProcessMemory 15 IoCs

description	pid	Process	procid_target
PID 868 wrote to memory of 2008	868	Setup.exe	90
PID 868 wrote to memory of 2008	868	Setup.exe	90
PID 868 wrote to memory of 2008	868	Setup.exe	90
PID 868 wrote to memory of 2008	868	Setup.exe	90
PID 868 wrote to memory of 2008	868	Setup.exe	90
PID 868 wrote to memory of 2008	868	Setup.exe	90
PID 868 wrote to memory of 2008	868	Setup.exe	90
PID 868 wrote to memory of 2008	868	Setup.exe	90
PID 868 wrote to memory of 2008	868	Setup.exe	90
PID 868 wrote to memory of 2008	868	Setup.exe	90
PID 868 wrote to memory of 2008	868	Setup.exe	90
PID 868 wrote to memory of 2008	868	Setup.exe	90
PID 868 wrote to memory of 2008	868	Setup.exe	90
PID 868 wrote to memory of 2008	868	Setup.exe	90
PID 868 wrote to memory of 2008	868	Setup.exe	90

C:\Users\Admin\AppData\Local\Temp\Setup.exe
"C:\Users\Admin\AppData\Local\Temp\Setup.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:868
- C:\Users\Admin\AppData\Local\Temp\Setup.exe
  "C:\Users\Admin\AppData\Local\Temp\Setup.exe"
  2⤵
  - Reads the TCP/IP host and domain name from the registry
  - System Location Discovery: System Language Discovery
  PID:2008

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:3552

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

krosqm.txt

Path C:\ProgramData\krosqm.txt
Size 12B
SHA256 63d319fda299dbf038e9cebaa8d2ffcdc66f23d9ccc54b11f55a55df2e2c17cd
MD5 b696454ddb84570ad89d8c2e09ee1973
SHA1 5c23b9843f8c35a23fef7d0a07afe13953d636bc
SHA512 128bc524a2be89b66ec25bc8ad5a3944d80d4c335b448e2cc6534e8703068dceb75f32507392263e3dae516788586d0b5455855b31232fd01a90265279c965d5
MD5 SHA1 SHA512

Submit Download

memory/868-0-0x0000000000400000-0x0000000001400000-memory.dmp

Download

memory/2008-1-0x0000000000400000-0x0000000000466000-memory.dmp

Download

memory/2008-2-0x0000000000400000-0x0000000000466000-memory.dmp

Download

memory/2008-8-0x0000000000400000-0x0000000000466000-memory.dmp

Download