ffdroider | 893a2003f1dc43aeea8aaef945e20044b2442e1a2aecdd0bf260e30a6b472689

Analysis

max time kernel
143s
max time network
68s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
05/10/2022, 15:07

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

5b85f622184aaff248a1cf1a3c8fdecd.exe
Size

1.8MB
MD5

5b85f622184aaff248a1cf1a3c8fdecd
SHA1

cad52050a0892303d857e2bb7d2324783e4d996d
SHA256

893a2003f1dc43aeea8aaef945e20044b2442e1a2aecdd0bf260e30a6b472689
SHA512

c7af49d20623e988b742002e9c60ec791f94c4794d73ada36e8956677dde4bbe0a6efcdee374dfaa3739814432b3bae3fce814f7190f92fecb75031320c87dc0
SSDEEP

24576:bYon2pir16WrJrDVNPLDRBh6EMII/QhGY9fIkRcD4R3ugA+IChSAD/v1XGCD2C65:ZzJrDVNPtq4hj9tRcu3uPKSqzX

Score

10^/10

ffdroider persistence spyware stealer

Malware Config

Extracted

Family

ffdroider

http://103.106.202.174

Signatures

FFDroider
Stealer targeting social media platform users first seen in April 2022.
stealer ffdroider

FFDroider payload 5 IoCs

resource	yara_rule
behavioral1/memory/576-55-0x0000000001020000-0x0000000001499000-memory.dmp	family_ffdroider
behavioral1/memory/576-57-0x0000000001020000-0x0000000001499000-memory.dmp	family_ffdroider
behavioral1/memory/576-56-0x0000000001020000-0x0000000001499000-memory.dmp	family_ffdroider
behavioral1/memory/576-58-0x0000000001020000-0x0000000001499000-memory.dmp	family_ffdroider
behavioral1/memory/576-71-0x0000000001020000-0x0000000001499000-memory.dmp	family_ffdroider

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\MyStart = "C:\\Users\\Admin\\AppData\\Local\\Temp\\5b85f622184aaff248a1cf1a3c8fdecd.exe"	5b85f622184aaff248a1cf1a3c8fdecd.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeManageVolumePrivilege	576	5b85f622184aaff248a1cf1a3c8fdecd.exe

C:\Users\Admin\AppData\Local\Temp\5b85f622184aaff248a1cf1a3c8fdecd.exe
"C:\Users\Admin\AppData\Local\Temp\5b85f622184aaff248a1cf1a3c8fdecd.exe"
1⤵
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
PID:576

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials in Files

T1081

Discovery

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/576-54-0x0000000075911000-0x0000000075913000-memory.dmp

Filesize
8KB

Download
memory/576-55-0x0000000001020000-0x0000000001499000-memory.dmp

Filesize
4.5MB

Download
memory/576-57-0x0000000001020000-0x0000000001499000-memory.dmp

Filesize
4.5MB

Download
memory/576-56-0x0000000001020000-0x0000000001499000-memory.dmp

Filesize
4.5MB

Download
memory/576-58-0x0000000001020000-0x0000000001499000-memory.dmp

Filesize
4.5MB

Download
memory/576-59-0x0000000000940000-0x0000000000950000-memory.dmp

Filesize
64KB

Download
memory/576-65-0x0000000000C10000-0x0000000000C20000-memory.dmp

Filesize
64KB

Download
memory/576-71-0x0000000001020000-0x0000000001499000-memory.dmp

Filesize
4.5MB

Download