ffdroider | 2b17c337ad2d287c611eab817028aad228501deda1ff49599eccd5e0b6a2e07b | Triage

Analysis

max time kernel
40s
max time network
46s
platform
windows7_x64
resource
win7-20220414-en
submitted
15-06-2022 03:23

Sharing

Report Analysis Logs

General

Target

2b17c337ad2d287c611eab817028aad228501deda1ff49599eccd5e0b6a2e07b.exe
Size

4.2MB
MD5

b79ee649d8daf87220a0f4953a5253c1
SHA1

30c4d8afbc77afeeebd4067678d7bd8e33b8e5b9
SHA256

2b17c337ad2d287c611eab817028aad228501deda1ff49599eccd5e0b6a2e07b
SHA512

0967348abd73bfcbdf354dcf018d15570462e3f5810468a0547ef2f6086dac8a6e22dd4747fa519504b6dbcca5bdfaee766878c30606299530725ebf9ed04f38

Score

10^/10

ffdroider stealer

Malware Config

Signatures

FFDroider
Stealer targeting social media platform users first seen in April 2022.
stealer ffdroider

FFDroider Payload 1 IoCs

resource	yara_rule
behavioral1/memory/1272-55-0x0000000001140000-0x000000000157F000-memory.dmp	family_ffdroider

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1700	1272	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1272 wrote to memory of 1700	1272	2b17c337ad2d287c611eab817028aad228501deda1ff49599eccd5e0b6a2e07b.exe	28
PID 1272 wrote to memory of 1700	1272	2b17c337ad2d287c611eab817028aad228501deda1ff49599eccd5e0b6a2e07b.exe	28
PID 1272 wrote to memory of 1700	1272	2b17c337ad2d287c611eab817028aad228501deda1ff49599eccd5e0b6a2e07b.exe	28
PID 1272 wrote to memory of 1700	1272	2b17c337ad2d287c611eab817028aad228501deda1ff49599eccd5e0b6a2e07b.exe	28

C:\Users\Admin\AppData\Local\Temp\2b17c337ad2d287c611eab817028aad228501deda1ff49599eccd5e0b6a2e07b.exe
"C:\Users\Admin\AppData\Local\Temp\2b17c337ad2d287c611eab817028aad228501deda1ff49599eccd5e0b6a2e07b.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1272
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1272 -s 236
  2⤵
  - Program crash
  PID:1700

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1272-54-0x0000000076171000-0x0000000076173000-memory.dmp

Filesize
8KB

Download
memory/1272-55-0x0000000001140000-0x000000000157F000-memory.dmp

Filesize
4.2MB

Download