Analysis
- max time kernel
114s - max time network
144s - platform
windows10-2004_x64 - resource
win10v2004-20220812-en - resource tags
- submitted
02/10/2022, 15:21
General
- Target file.exe
- Size 1.8MB
- Sample221002-srbhsacce2
- SHA256 a4c1df15712b32ba96bfd375ee306f67fa29751007774d06b08cd092e7feeb9a
Malware Config
Extracted
-
ffdroider
-
http://103.106.202.174
Signatures
- FFDroider
Stealer targeting social media platform users first seen in April 2022.
- FFDroider payload 4 IoCs
- Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 1 IoCs
- Checks whether UAC is enabled 1 TTPs 1 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\file.exe"C:\Users\Admin\AppData\Local\Temp\file.exe"1⤵
- Adds Run key to start application
- Checks whether UAC is enabled
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
memory/740-132-0x0000000000520000-0x000000000099A000-memory.dmp
memory/740-133-0x0000000000520000-0x000000000099A000-memory.dmp
memory/740-134-0x0000000000520000-0x000000000099A000-memory.dmp
memory/740-135-0x0000000000520000-0x000000000099A000-memory.dmp
memory/740-136-0x00000000040E0000-0x00000000040F0000-memory.dmp
memory/740-142-0x0000000004280000-0x0000000004290000-memory.dmp
memory/740-148-0x0000000004EA0000-0x0000000004EA8000-memory.dmp
memory/740-149-0x0000000004EC0000-0x0000000004EC8000-memory.dmp
memory/740-150-0x00000000050A0000-0x00000000050A8000-memory.dmp
memory/740-151-0x00000000050B0000-0x00000000050B8000-memory.dmp
memory/740-152-0x00000000050D0000-0x00000000050D8000-memory.dmp
memory/740-153-0x0000000005370000-0x0000000005378000-memory.dmp
memory/740-154-0x00000000055C0000-0x00000000055C8000-memory.dmp
memory/740-155-0x00000000053B0000-0x00000000053B8000-memory.dmp
memory/740-156-0x00000000053B0000-0x00000000053B8000-memory.dmp
memory/740-157-0x00000000050E0000-0x00000000050E8000-memory.dmp
memory/740-158-0x0000000004EC0000-0x0000000004EC8000-memory.dmp
memory/740-159-0x00000000050E0000-0x00000000050E8000-memory.dmp
memory/740-160-0x0000000005210000-0x0000000005218000-memory.dmp
memory/740-161-0x0000000004EC0000-0x0000000004EC8000-memory.dmp
memory/740-162-0x0000000005210000-0x0000000005218000-memory.dmp
memory/740-163-0x00000000050E0000-0x00000000050E8000-memory.dmp
memory/740-176-0x0000000000520000-0x000000000099A000-memory.dmp