Analysis
-
max time kernel
107s -
max time network
128s -
platform
windows10-2004_x64 -
resource
win10v2004-20220721-en -
submitted
01-08-2022 05:02
General
-
Target
5ce27f724cff5f6f4558ec61f2f328df7fbe8905ac032e461358b9a4a1acb34b.exe
-
Size
1.8MB
-
MD5
e101086987595cde7a1439641814d5cf
-
SHA1
f7b1b3bd0a933be4adbca78d6938d6dfac90de77
-
SHA256
5ce27f724cff5f6f4558ec61f2f328df7fbe8905ac032e461358b9a4a1acb34b
-
SHA512
216b33d61872fe0ae7c93e1329fa55e369edcffc49be54b7e079edc09ccfd7d7c680c5a2bfdf81008bae666e44b62a3aeca5884ea4d4ea49afc470b8da5f71cd
-
SSDEEP
49152:oiVOqL26YVweCqo0oKPB803g0Bk+QqX0NmXqxq:ocfrqo5KPB203XgM
Score
10/10
Malware Config
Extracted
Family
ffdroider
C2
http://152.32.228.19
Signatures
-
FFDroider
Stealer targeting social media platform users first seen in April 2022.
-
FFDroider payload 6 IoCs
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Checks whether UAC is enabled 1 TTPs 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 27 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\5ce27f724cff5f6f4558ec61f2f328df7fbe8905ac032e461358b9a4a1acb34b.exe"C:\Users\Admin\AppData\Local\Temp\5ce27f724cff5f6f4558ec61f2f328df7fbe8905ac032e461358b9a4a1acb34b.exe"1⤵
- Checks whether UAC is enabled
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4.2MB
-
Filesize
4.2MB
-
Filesize
4.2MB
-
Filesize
4.2MB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
4.2MB
-
Filesize
4.2MB