Analysis
-
max time kernel
147s -
max time network
184s -
platform
windows10-2004_x64 -
resource
win10v2004-20220414-en -
submitted
12-05-2022 06:46
General
-
Target
5c21cca8d79a5c46f7f1bd78b222c47a.exe
-
Size
3.9MB
-
MD5
5c21cca8d79a5c46f7f1bd78b222c47a
-
SHA1
bd249dea8ceb0a4bde6ee336ed2063696b821767
-
SHA256
5b60d2cb0b63bcd9c7df5873496d119de3f5364ba6eeea8548f20b2940a73ffa
-
SHA512
1f63c24f59d5508a81e371e8c4ab8f11ce1c61a31fb78ecefdbe3d59d5e62eb281bda61e507642b92f3a897b11b0a3b0dcee3369cb78686097c91c91b08108d7
Malware Config
Signatures
-
FFDroider
Stealer targeting social media platform users first seen in April 2022.
-
FFDroider Payload 4 IoCs
-
suricata: ET MALWARE Win32/FFDroider CnC Activity
suricata: ET MALWARE Win32/FFDroider CnC Activity
-
suricata: ET MALWARE Win32/FFDroider CnC Activity M2
suricata: ET MALWARE Win32/FFDroider CnC Activity M2
-
Downloads MZ/PE file
-
Executes dropped EXE 1 IoCs
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Checks whether UAC is enabled 1 TTPs 2 IoCs
-
Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious use of AdjustPrivilegeToken 50 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\5c21cca8d79a5c46f7f1bd78b222c47a.exe"C:\Users\Admin\AppData\Local\Temp\5c21cca8d79a5c46f7f1bd78b222c47a.exe"1⤵
- Checks computer location settings
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\Documents\VlcpVideoV1.0.1\da_1648136254601.exe"C:\Users\Admin\Documents\VlcpVideoV1.0.1\da_1648136254601.exe"2⤵
- Executes dropped EXE
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3.3MB
MD5dfb6e366186969c7265e5602a4b85335
SHA1f20c75e427ef43b853b4a053e98cd301cae331c1
SHA256d77bea86bd4c36acae410d6dec8e012439e36d6226d99f1fd7de29827fca3835
SHA5125420980743bb7772ffd1cda00acbbe921ec3746c20db17b653fc8cd4c795db33d516ea82604f43b61dc94ca6a949d21338f3d3528b3ac0f168bdae4676af9019
-
Filesize
3.3MB
MD5dfb6e366186969c7265e5602a4b85335
SHA1f20c75e427ef43b853b4a053e98cd301cae331c1
SHA256d77bea86bd4c36acae410d6dec8e012439e36d6226d99f1fd7de29827fca3835
SHA5125420980743bb7772ffd1cda00acbbe921ec3746c20db17b653fc8cd4c795db33d516ea82604f43b61dc94ca6a949d21338f3d3528b3ac0f168bdae4676af9019
-
Filesize
32KB
-
Filesize
64KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
5.7MB
-
Filesize
32KB
-
Filesize
64KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
4.8MB