Analysis
- max time kernel
106s - max time network
140s - platform
windows10-2004_x64 - resource
win10v2004-20220901-en - resource tags
- submitted
03/10/2022, 19:16
General
- Target B1209191392DE48946828E01F2C44C1FB38C09C894253.exe
- Size 2.1MB
- Sample221003-xyr7bscbd2
- SHA256 b1209191392de48946828e01f2c44c1fb38c09c89425327b29fdcfb1c4dfa566
Malware Config
Extracted
-
ffdroider
-
http://186.2.171.3
Signatures
- FFDroider
Stealer targeting social media platform users first seen in April 2022.
- FFDroider payload 2 IoCs
- Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Checks whether UAC is enabled 1 TTPs 1 IoCs
- Suspicious use of AdjustPrivilegeToken 6 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\B1209191392DE48946828E01F2C44C1FB38C09C894253.exe"C:\Users\Admin\AppData\Local\Temp\B1209191392DE48946828E01F2C44C1FB38C09C894253.exe"1⤵
- Checks whether UAC is enabled
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
memory/2640-132-0x0000000000400000-0x0000000000991000-memory.dmp
memory/2640-133-0x0000000000030000-0x0000000000033000-memory.dmp
memory/2640-134-0x0000000003E00000-0x0000000003E10000-memory.dmp
memory/2640-140-0x0000000003F60000-0x0000000003F70000-memory.dmp
memory/2640-146-0x0000000004A20000-0x0000000004A28000-memory.dmp
memory/2640-147-0x0000000004A40000-0x0000000004A48000-memory.dmp
memory/2640-148-0x0000000004AE0000-0x0000000004AE8000-memory.dmp
memory/2640-149-0x0000000004C20000-0x0000000004C28000-memory.dmp
memory/2640-150-0x0000000004D80000-0x0000000004D88000-memory.dmp
memory/2640-151-0x0000000005030000-0x0000000005038000-memory.dmp
memory/2640-152-0x0000000004F30000-0x0000000004F38000-memory.dmp
memory/2640-153-0x0000000004DA0000-0x0000000004DA8000-memory.dmp
memory/2640-154-0x0000000004A40000-0x0000000004A48000-memory.dmp
memory/2640-155-0x0000000004DA0000-0x0000000004DA8000-memory.dmp
memory/2640-156-0x0000000004A40000-0x0000000004A48000-memory.dmp
memory/2640-157-0x0000000004DA0000-0x0000000004DA8000-memory.dmp
memory/2640-182-0x0000000004900000-0x0000000004908000-memory.dmp
memory/2640-183-0x0000000004920000-0x0000000004928000-memory.dmp
memory/2640-292-0x0000000000400000-0x0000000000991000-memory.dmp