fickerstealer | f9ff859f39a9e54d733f9c3da77a0c42a4f9c6c53eccccfd7e874b8b5018ec96

Analysis

max time kernel
49s
max time network
54s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
30-06-2024 04:59

Target

Setup.exe
Size

793.8MB
MD5

9a851a47a9bd2f92c61d2486d1be3064
SHA1

3cda31c06db97246705d95dfcf4908eafb514b87
SHA256

7c2b51c31a895f2eeb6afe748f11d0f6a16355b01c41f22749043c0da7804206
SHA512

90340910dc1ee90ccfe7f451578de67c5ca32b95525157acd8b5bc2e99b9c0b2254bfb58997cc848a0ead871bc3f1e03dbb152d56aa709c4ecd3742404eec27b
SSDEEP

196608:6spHQk/ICYcdYtOQYMvm6Iu+8RuJQHIsuRuJyPquRuJXMD349nt3njto03qJbYav:6csCYgIBH2XD349nt3nW03s8up

Score

10^/10

Family

fickerstealer

45.93.201.181:80

Fickerstealer
Ficker is an infostealer written in Rust and ASM.
infostealer fickerstealer
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

3 api.ipify.org
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2052 2600 WerFault.exe Setup.exe

flow	ioc
3	api.ipify.org

pid	pid_target	process	target process
2052	2600	WerFault.exe	Setup.exe

Suspicious behavior: EnumeratesProcesses 42 IoCs

Processes:

Setup.exe

Suspicious use of WriteProcessMemory 21 IoCs

Processes:

Setup.exe

description	pid	process	target process
PID 2996 wrote to memory of 2600	2996	Setup.exe	Setup.exe
PID 2996 wrote to memory of 2600	2996	Setup.exe	Setup.exe
PID 2996 wrote to memory of 2600	2996	Setup.exe	Setup.exe
PID 2996 wrote to memory of 2600	2996	Setup.exe	Setup.exe
PID 2996 wrote to memory of 2600	2996	Setup.exe	Setup.exe
PID 2996 wrote to memory of 2600	2996	Setup.exe	Setup.exe
PID 2996 wrote to memory of 2600	2996	Setup.exe	Setup.exe
PID 2996 wrote to memory of 2600	2996	Setup.exe	Setup.exe
PID 2996 wrote to memory of 2600	2996	Setup.exe	Setup.exe
PID 2996 wrote to memory of 2600	2996	Setup.exe	Setup.exe
PID 2996 wrote to memory of 2600	2996	Setup.exe	Setup.exe
PID 2996 wrote to memory of 2600	2996	Setup.exe	Setup.exe
PID 2996 wrote to memory of 2600	2996	Setup.exe	Setup.exe
PID 2996 wrote to memory of 2600	2996	Setup.exe	Setup.exe
PID 2996 wrote to memory of 2600	2996	Setup.exe	Setup.exe
PID 2996 wrote to memory of 2600	2996	Setup.exe	Setup.exe
PID 2996 wrote to memory of 2600	2996	Setup.exe	Setup.exe
PID 2996 wrote to memory of 2600	2996	Setup.exe	Setup.exe
PID 2996 wrote to memory of 2600	2996	Setup.exe	Setup.exe
PID 2996 wrote to memory of 2600	2996	Setup.exe	Setup.exe
PID 2996 wrote to memory of 2600	2996	Setup.exe	Setup.exe

C:\Users\Admin\AppData\Local\Temp\Setup.exe
"C:\Users\Admin\AppData\Local\Temp\Setup.exe"
2⤵
PID:2600

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2600 -s 1592
3⤵
- Program crash
PID:2052

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2600 -ip 2600
1⤵
PID:3616

memory/2600-1-0x0000000000400000-0x0000000000466000-memory.dmp

Filesize
408KB

Download
memory/2600-2-0x0000000000400000-0x0000000000466000-memory.dmp

Filesize
408KB

Download
memory/2600-4-0x0000000000400000-0x0000000000466000-memory.dmp

Filesize
408KB

Download
memory/2996-3-0x0000000033DD0000-0x0000000033EC0000-memory.dmp

Filesize
960KB

Download
memory/2996-0-0x0000000000400000-0x0000000001400000-memory.dmp

Filesize
16.0MB

Download