Analysis

  • max time kernel
    149s
  • max time network
    156s
  • platform
    windows7_x64
  • resource
    win7-20220414-en
  • submitted
    24-05-2022 01:54

General

  • Target

    e4b23ebeb82594979325357ce20f14f70143d98ff49a9d5a2e6258fbfb33e555.exe

  • Size

    9.1MB

  • MD5

    93e23e5bed552c0500856641d19729a8

  • SHA1

    7e14cdf808dcd21d766a4054935c87c89c037445

  • SHA256

    e4b23ebeb82594979325357ce20f14f70143d98ff49a9d5a2e6258fbfb33e555

  • SHA512

    3996d6144bd7dab401df7f95d4623ba91502619446d7c877c2ecb601f23433c9447168e959a90458e0fae3d9d39a03c25642f611dbc3114917cad48aca2594ff

Malware Config

Signatures

  • FFDroider

    Stealer targeting social media platform users first seen in April 2022.

  • FFDroider Payload 1 IoCs
  • Process spawned unexpected child process 1 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs
  • suricata: ET MALWARE Win32/FFDroider CnC Activity M2

    suricata: ET MALWARE Win32/FFDroider CnC Activity M2

  • Executes dropped EXE 4 IoCs
  • Loads dropped DLL 22 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Modifies registry class 8 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 38 IoCs
  • Suspicious use of WriteProcessMemory 32 IoCs

Processes

  • C:\Windows\system32\services.exe
    C:\Windows\system32\services.exe
    1⤵
      PID:464
      • C:\Windows\system32\svchost.exe
        C:\Windows\system32\svchost.exe -k netsvcs
        2⤵
        • Suspicious use of NtCreateUserProcessOtherParentProcess
        • Suspicious use of SetThreadContext
        • Modifies registry class
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:864
      • C:\Windows\system32\svchost.exe
        C:\Windows\system32\svchost.exe -k SystemNetworkService
        2⤵
        • Modifies registry class
        PID:1752
    • C:\Users\Admin\AppData\Local\Temp\e4b23ebeb82594979325357ce20f14f70143d98ff49a9d5a2e6258fbfb33e555.exe
      "C:\Users\Admin\AppData\Local\Temp\e4b23ebeb82594979325357ce20f14f70143d98ff49a9d5a2e6258fbfb33e555.exe"
      1⤵
      • Loads dropped DLL
      • Suspicious use of WriteProcessMemory
      PID:1044
      • C:\Users\Admin\AppData\Local\Temp\md9_1sjm.exe
        "C:\Users\Admin\AppData\Local\Temp\md9_1sjm.exe"
        2⤵
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        PID:1116
      • C:\Users\Admin\AppData\Local\Temp\FoxSBrowser.exe
        "C:\Users\Admin\AppData\Local\Temp\FoxSBrowser.exe"
        2⤵
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        PID:1620
      • C:\Users\Admin\AppData\Local\Temp\Folder.exe
        "C:\Users\Admin\AppData\Local\Temp\Folder.exe"
        2⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Suspicious use of WriteProcessMemory
        PID:1544
        • C:\Users\Admin\AppData\Local\Temp\Folder.exe
          "C:\Users\Admin\AppData\Local\Temp\Folder.exe" -a
          3⤵
          • Executes dropped EXE
          PID:1424
      • C:\Users\Admin\AppData\Local\Temp\Graphics.exe
        "C:\Users\Admin\AppData\Local\Temp\Graphics.exe"
        2⤵
          PID:1700
      • C:\Windows\system32\rUNdlL32.eXe
        rUNdlL32.eXe "C:\Users\Admin\AppData\Local\Temp\axhub.dll",main
        1⤵
        • Process spawned unexpected child process
        • Suspicious use of WriteProcessMemory
        PID:1368
        • C:\Windows\SysWOW64\rundll32.exe
          rUNdlL32.eXe "C:\Users\Admin\AppData\Local\Temp\axhub.dll",main
          2⤵
          • Loads dropped DLL
          • Modifies registry class
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:320

      Network

      MITRE ATT&CK Enterprise v6

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Users\Admin\AppData\Local\Temp\Folder.exe

        Filesize

        712KB

        MD5

        b89068659ca07ab9b39f1c580a6f9d39

        SHA1

        7e3e246fcf920d1ada06900889d099784fe06aa5

        SHA256

        9d225182e9a8f073e8cf1d60a8258369a394bcae5fbc52d845d71a0fa440539c

        SHA512

        940690b0844e678e45ead2e7639407ffac43ab45265d2682a4c2e6400ac8fa2188c50a3b17dad241517dd4624ee92d159c7e6d59c8d069b9edd1445115255d52

      • C:\Users\Admin\AppData\Local\Temp\Folder.exe

        Filesize

        712KB

        MD5

        b89068659ca07ab9b39f1c580a6f9d39

        SHA1

        7e3e246fcf920d1ada06900889d099784fe06aa5

        SHA256

        9d225182e9a8f073e8cf1d60a8258369a394bcae5fbc52d845d71a0fa440539c

        SHA512

        940690b0844e678e45ead2e7639407ffac43ab45265d2682a4c2e6400ac8fa2188c50a3b17dad241517dd4624ee92d159c7e6d59c8d069b9edd1445115255d52

      • C:\Users\Admin\AppData\Local\Temp\Folder.exe

        Filesize

        712KB

        MD5

        b89068659ca07ab9b39f1c580a6f9d39

        SHA1

        7e3e246fcf920d1ada06900889d099784fe06aa5

        SHA256

        9d225182e9a8f073e8cf1d60a8258369a394bcae5fbc52d845d71a0fa440539c

        SHA512

        940690b0844e678e45ead2e7639407ffac43ab45265d2682a4c2e6400ac8fa2188c50a3b17dad241517dd4624ee92d159c7e6d59c8d069b9edd1445115255d52

      • C:\Users\Admin\AppData\Local\Temp\FoxSBrowser.exe

        Filesize

        153KB

        MD5

        849b899acdc4478c116340b86683a493

        SHA1

        e43f78a9b9b884e4230d009fafceb46711125534

        SHA256

        5f5eed76da09dc92090a6501de1f2a6cc7fb0c92e32053163b28f380f3b06631

        SHA512

        bdff9dbac1de6e1af7807a233c4e8c36ae8c45e0b277d78b636124b6ffe0df6ed16c78f2f3222eeb383501b2f3eec90c8736da540017b8b35592fa49eb3f720c

      • C:\Users\Admin\AppData\Local\Temp\FoxSBrowser.exe

        Filesize

        153KB

        MD5

        849b899acdc4478c116340b86683a493

        SHA1

        e43f78a9b9b884e4230d009fafceb46711125534

        SHA256

        5f5eed76da09dc92090a6501de1f2a6cc7fb0c92e32053163b28f380f3b06631

        SHA512

        bdff9dbac1de6e1af7807a233c4e8c36ae8c45e0b277d78b636124b6ffe0df6ed16c78f2f3222eeb383501b2f3eec90c8736da540017b8b35592fa49eb3f720c

      • C:\Users\Admin\AppData\Local\Temp\axhub.dat

        Filesize

        552KB

        MD5

        5fd2eba6df44d23c9e662763009d7f84

        SHA1

        43530574f8ac455ae263c70cc99550bc60bfa4f1

        SHA256

        2991e2231855661e94ef80a4202487a9d7dc7bebccab9a0b2a786cf0783a051f

        SHA512

        321a86725e533dedb5b74e17218e6e53a49fa6ffc87d7f7da0f0b8441a081fe785f7846a76f67ef03ec3abddacbe8906b20a2f3ce8178896ec57090ef7ab0eb7

      • C:\Users\Admin\AppData\Local\Temp\axhub.dll

        Filesize

        73KB

        MD5

        1c7be730bdc4833afb7117d48c3fd513

        SHA1

        dc7e38cfe2ae4a117922306aead5a7544af646b8

        SHA256

        8206b4b3897ca45b9e083273f616902966e57091516844906e6ae2aefe63cef1

        SHA512

        7936c862a06b7ecdb6710a1bb62cbea149f75504b580c2f100945674c987f3eec53e9aa5915e32b4f74bcf46f2df9468f68a454400faebd909f933e8072e0f2e

      • C:\Users\Admin\AppData\Local\Temp\md9_1sjm.exe

        Filesize

        2.1MB

        MD5

        3b3d48102a0d45a941f98d8aabe2dc43

        SHA1

        0dae4fd9d74f24452b2544e0f166bf7db2365240

        SHA256

        f4fdf9842d2221eb8910e6829b8467d867e346b7f73e2c3040f16eb77630b8f0

        SHA512

        65ae273b5ea434b268bbd8d38fe325cf62ed3316950796fa90defbc8a74c55fba0a99100f2ae674206335a08e8ea827d01eeccf26adf84ebfeebb0f17cfb7ba8

      • C:\Users\Admin\AppData\Local\Temp\md9_1sjm.exe

        Filesize

        2.1MB

        MD5

        3b3d48102a0d45a941f98d8aabe2dc43

        SHA1

        0dae4fd9d74f24452b2544e0f166bf7db2365240

        SHA256

        f4fdf9842d2221eb8910e6829b8467d867e346b7f73e2c3040f16eb77630b8f0

        SHA512

        65ae273b5ea434b268bbd8d38fe325cf62ed3316950796fa90defbc8a74c55fba0a99100f2ae674206335a08e8ea827d01eeccf26adf84ebfeebb0f17cfb7ba8

      • \Users\Admin\AppData\Local\Temp\Folder.exe

        Filesize

        712KB

        MD5

        b89068659ca07ab9b39f1c580a6f9d39

        SHA1

        7e3e246fcf920d1ada06900889d099784fe06aa5

        SHA256

        9d225182e9a8f073e8cf1d60a8258369a394bcae5fbc52d845d71a0fa440539c

        SHA512

        940690b0844e678e45ead2e7639407ffac43ab45265d2682a4c2e6400ac8fa2188c50a3b17dad241517dd4624ee92d159c7e6d59c8d069b9edd1445115255d52

      • \Users\Admin\AppData\Local\Temp\Folder.exe

        Filesize

        712KB

        MD5

        b89068659ca07ab9b39f1c580a6f9d39

        SHA1

        7e3e246fcf920d1ada06900889d099784fe06aa5

        SHA256

        9d225182e9a8f073e8cf1d60a8258369a394bcae5fbc52d845d71a0fa440539c

        SHA512

        940690b0844e678e45ead2e7639407ffac43ab45265d2682a4c2e6400ac8fa2188c50a3b17dad241517dd4624ee92d159c7e6d59c8d069b9edd1445115255d52

      • \Users\Admin\AppData\Local\Temp\Folder.exe

        Filesize

        712KB

        MD5

        b89068659ca07ab9b39f1c580a6f9d39

        SHA1

        7e3e246fcf920d1ada06900889d099784fe06aa5

        SHA256

        9d225182e9a8f073e8cf1d60a8258369a394bcae5fbc52d845d71a0fa440539c

        SHA512

        940690b0844e678e45ead2e7639407ffac43ab45265d2682a4c2e6400ac8fa2188c50a3b17dad241517dd4624ee92d159c7e6d59c8d069b9edd1445115255d52

      • \Users\Admin\AppData\Local\Temp\Folder.exe

        Filesize

        712KB

        MD5

        b89068659ca07ab9b39f1c580a6f9d39

        SHA1

        7e3e246fcf920d1ada06900889d099784fe06aa5

        SHA256

        9d225182e9a8f073e8cf1d60a8258369a394bcae5fbc52d845d71a0fa440539c

        SHA512

        940690b0844e678e45ead2e7639407ffac43ab45265d2682a4c2e6400ac8fa2188c50a3b17dad241517dd4624ee92d159c7e6d59c8d069b9edd1445115255d52

      • \Users\Admin\AppData\Local\Temp\Folder.exe

        Filesize

        712KB

        MD5

        b89068659ca07ab9b39f1c580a6f9d39

        SHA1

        7e3e246fcf920d1ada06900889d099784fe06aa5

        SHA256

        9d225182e9a8f073e8cf1d60a8258369a394bcae5fbc52d845d71a0fa440539c

        SHA512

        940690b0844e678e45ead2e7639407ffac43ab45265d2682a4c2e6400ac8fa2188c50a3b17dad241517dd4624ee92d159c7e6d59c8d069b9edd1445115255d52

      • \Users\Admin\AppData\Local\Temp\Folder.exe

        Filesize

        712KB

        MD5

        b89068659ca07ab9b39f1c580a6f9d39

        SHA1

        7e3e246fcf920d1ada06900889d099784fe06aa5

        SHA256

        9d225182e9a8f073e8cf1d60a8258369a394bcae5fbc52d845d71a0fa440539c

        SHA512

        940690b0844e678e45ead2e7639407ffac43ab45265d2682a4c2e6400ac8fa2188c50a3b17dad241517dd4624ee92d159c7e6d59c8d069b9edd1445115255d52

      • \Users\Admin\AppData\Local\Temp\FoxSBrowser.exe

        Filesize

        153KB

        MD5

        849b899acdc4478c116340b86683a493

        SHA1

        e43f78a9b9b884e4230d009fafceb46711125534

        SHA256

        5f5eed76da09dc92090a6501de1f2a6cc7fb0c92e32053163b28f380f3b06631

        SHA512

        bdff9dbac1de6e1af7807a233c4e8c36ae8c45e0b277d78b636124b6ffe0df6ed16c78f2f3222eeb383501b2f3eec90c8736da540017b8b35592fa49eb3f720c

      • \Users\Admin\AppData\Local\Temp\FoxSBrowser.exe

        Filesize

        153KB

        MD5

        849b899acdc4478c116340b86683a493

        SHA1

        e43f78a9b9b884e4230d009fafceb46711125534

        SHA256

        5f5eed76da09dc92090a6501de1f2a6cc7fb0c92e32053163b28f380f3b06631

        SHA512

        bdff9dbac1de6e1af7807a233c4e8c36ae8c45e0b277d78b636124b6ffe0df6ed16c78f2f3222eeb383501b2f3eec90c8736da540017b8b35592fa49eb3f720c

      • \Users\Admin\AppData\Local\Temp\FoxSBrowser.exe

        Filesize

        153KB

        MD5

        849b899acdc4478c116340b86683a493

        SHA1

        e43f78a9b9b884e4230d009fafceb46711125534

        SHA256

        5f5eed76da09dc92090a6501de1f2a6cc7fb0c92e32053163b28f380f3b06631

        SHA512

        bdff9dbac1de6e1af7807a233c4e8c36ae8c45e0b277d78b636124b6ffe0df6ed16c78f2f3222eeb383501b2f3eec90c8736da540017b8b35592fa49eb3f720c

      • \Users\Admin\AppData\Local\Temp\FoxSBrowser.exe

        Filesize

        153KB

        MD5

        849b899acdc4478c116340b86683a493

        SHA1

        e43f78a9b9b884e4230d009fafceb46711125534

        SHA256

        5f5eed76da09dc92090a6501de1f2a6cc7fb0c92e32053163b28f380f3b06631

        SHA512

        bdff9dbac1de6e1af7807a233c4e8c36ae8c45e0b277d78b636124b6ffe0df6ed16c78f2f3222eeb383501b2f3eec90c8736da540017b8b35592fa49eb3f720c

      • \Users\Admin\AppData\Local\Temp\Graphics.exe

        Filesize

        4.5MB

        MD5

        7c20b40b1abca9c0c50111529f4a06fa

        SHA1

        5a367dbc0473e6f9f412fe52d219525a5ff0d8d2

        SHA256

        5caae6f11abc0a10481f56f9e598f98332b6144e24bf6efa67b63becc7debd36

        SHA512

        f1afdb5d0c396e4929dfc22f205079cdbea2eccbd19c90c20cc87990c0cb11f29f392eb62e9218341965c4358e79b5d7f8ee216eba915f712a6d3578e1818473

      • \Users\Admin\AppData\Local\Temp\Graphics.exe

        Filesize

        4.5MB

        MD5

        7c20b40b1abca9c0c50111529f4a06fa

        SHA1

        5a367dbc0473e6f9f412fe52d219525a5ff0d8d2

        SHA256

        5caae6f11abc0a10481f56f9e598f98332b6144e24bf6efa67b63becc7debd36

        SHA512

        f1afdb5d0c396e4929dfc22f205079cdbea2eccbd19c90c20cc87990c0cb11f29f392eb62e9218341965c4358e79b5d7f8ee216eba915f712a6d3578e1818473

      • \Users\Admin\AppData\Local\Temp\Graphics.exe

        Filesize

        4.5MB

        MD5

        7c20b40b1abca9c0c50111529f4a06fa

        SHA1

        5a367dbc0473e6f9f412fe52d219525a5ff0d8d2

        SHA256

        5caae6f11abc0a10481f56f9e598f98332b6144e24bf6efa67b63becc7debd36

        SHA512

        f1afdb5d0c396e4929dfc22f205079cdbea2eccbd19c90c20cc87990c0cb11f29f392eb62e9218341965c4358e79b5d7f8ee216eba915f712a6d3578e1818473

      • \Users\Admin\AppData\Local\Temp\Graphics.exe

        Filesize

        4.5MB

        MD5

        7c20b40b1abca9c0c50111529f4a06fa

        SHA1

        5a367dbc0473e6f9f412fe52d219525a5ff0d8d2

        SHA256

        5caae6f11abc0a10481f56f9e598f98332b6144e24bf6efa67b63becc7debd36

        SHA512

        f1afdb5d0c396e4929dfc22f205079cdbea2eccbd19c90c20cc87990c0cb11f29f392eb62e9218341965c4358e79b5d7f8ee216eba915f712a6d3578e1818473

      • \Users\Admin\AppData\Local\Temp\axhub.dll

        Filesize

        73KB

        MD5

        1c7be730bdc4833afb7117d48c3fd513

        SHA1

        dc7e38cfe2ae4a117922306aead5a7544af646b8

        SHA256

        8206b4b3897ca45b9e083273f616902966e57091516844906e6ae2aefe63cef1

        SHA512

        7936c862a06b7ecdb6710a1bb62cbea149f75504b580c2f100945674c987f3eec53e9aa5915e32b4f74bcf46f2df9468f68a454400faebd909f933e8072e0f2e

      • \Users\Admin\AppData\Local\Temp\axhub.dll

        Filesize

        73KB

        MD5

        1c7be730bdc4833afb7117d48c3fd513

        SHA1

        dc7e38cfe2ae4a117922306aead5a7544af646b8

        SHA256

        8206b4b3897ca45b9e083273f616902966e57091516844906e6ae2aefe63cef1

        SHA512

        7936c862a06b7ecdb6710a1bb62cbea149f75504b580c2f100945674c987f3eec53e9aa5915e32b4f74bcf46f2df9468f68a454400faebd909f933e8072e0f2e

      • \Users\Admin\AppData\Local\Temp\axhub.dll

        Filesize

        73KB

        MD5

        1c7be730bdc4833afb7117d48c3fd513

        SHA1

        dc7e38cfe2ae4a117922306aead5a7544af646b8

        SHA256

        8206b4b3897ca45b9e083273f616902966e57091516844906e6ae2aefe63cef1

        SHA512

        7936c862a06b7ecdb6710a1bb62cbea149f75504b580c2f100945674c987f3eec53e9aa5915e32b4f74bcf46f2df9468f68a454400faebd909f933e8072e0f2e

      • \Users\Admin\AppData\Local\Temp\axhub.dll

        Filesize

        73KB

        MD5

        1c7be730bdc4833afb7117d48c3fd513

        SHA1

        dc7e38cfe2ae4a117922306aead5a7544af646b8

        SHA256

        8206b4b3897ca45b9e083273f616902966e57091516844906e6ae2aefe63cef1

        SHA512

        7936c862a06b7ecdb6710a1bb62cbea149f75504b580c2f100945674c987f3eec53e9aa5915e32b4f74bcf46f2df9468f68a454400faebd909f933e8072e0f2e

      • \Users\Admin\AppData\Local\Temp\md9_1sjm.exe

        Filesize

        2.1MB

        MD5

        3b3d48102a0d45a941f98d8aabe2dc43

        SHA1

        0dae4fd9d74f24452b2544e0f166bf7db2365240

        SHA256

        f4fdf9842d2221eb8910e6829b8467d867e346b7f73e2c3040f16eb77630b8f0

        SHA512

        65ae273b5ea434b268bbd8d38fe325cf62ed3316950796fa90defbc8a74c55fba0a99100f2ae674206335a08e8ea827d01eeccf26adf84ebfeebb0f17cfb7ba8

      • \Users\Admin\AppData\Local\Temp\md9_1sjm.exe

        Filesize

        2.1MB

        MD5

        3b3d48102a0d45a941f98d8aabe2dc43

        SHA1

        0dae4fd9d74f24452b2544e0f166bf7db2365240

        SHA256

        f4fdf9842d2221eb8910e6829b8467d867e346b7f73e2c3040f16eb77630b8f0

        SHA512

        65ae273b5ea434b268bbd8d38fe325cf62ed3316950796fa90defbc8a74c55fba0a99100f2ae674206335a08e8ea827d01eeccf26adf84ebfeebb0f17cfb7ba8

      • \Users\Admin\AppData\Local\Temp\md9_1sjm.exe

        Filesize

        2.1MB

        MD5

        3b3d48102a0d45a941f98d8aabe2dc43

        SHA1

        0dae4fd9d74f24452b2544e0f166bf7db2365240

        SHA256

        f4fdf9842d2221eb8910e6829b8467d867e346b7f73e2c3040f16eb77630b8f0

        SHA512

        65ae273b5ea434b268bbd8d38fe325cf62ed3316950796fa90defbc8a74c55fba0a99100f2ae674206335a08e8ea827d01eeccf26adf84ebfeebb0f17cfb7ba8

      • \Users\Admin\AppData\Local\Temp\md9_1sjm.exe

        Filesize

        2.1MB

        MD5

        3b3d48102a0d45a941f98d8aabe2dc43

        SHA1

        0dae4fd9d74f24452b2544e0f166bf7db2365240

        SHA256

        f4fdf9842d2221eb8910e6829b8467d867e346b7f73e2c3040f16eb77630b8f0

        SHA512

        65ae273b5ea434b268bbd8d38fe325cf62ed3316950796fa90defbc8a74c55fba0a99100f2ae674206335a08e8ea827d01eeccf26adf84ebfeebb0f17cfb7ba8

      • memory/320-110-0x0000000000A10000-0x0000000000A6D000-memory.dmp

        Filesize

        372KB

      • memory/320-109-0x0000000000900000-0x0000000000A01000-memory.dmp

        Filesize

        1.0MB

      • memory/1044-121-0x0000000003320000-0x00000000038CC000-memory.dmp

        Filesize

        5.7MB

      • memory/1044-54-0x0000000075441000-0x0000000075443000-memory.dmp

        Filesize

        8KB

      • memory/1116-92-0x0000000000A50000-0x0000000000A60000-memory.dmp

        Filesize

        64KB

      • memory/1116-102-0x0000000000E90000-0x0000000000EA0000-memory.dmp

        Filesize

        64KB

      • memory/1116-120-0x0000000001120000-0x00000000016CC000-memory.dmp

        Filesize

        5.7MB

      • memory/1620-88-0x0000000000150000-0x0000000000156000-memory.dmp

        Filesize

        24KB

      • memory/1620-82-0x0000000000F20000-0x0000000000F4E000-memory.dmp

        Filesize

        184KB

      • memory/1620-119-0x000007FEFBB11000-0x000007FEFBB13000-memory.dmp

        Filesize

        8KB

      • memory/1752-111-0x0000000000060000-0x00000000000AC000-memory.dmp

        Filesize

        304KB