ffdroider | 89609c41c0c13302695dec877a6863737243e22b414740e0595f62a0c4d1362a

Analysis

max time kernel
143s
max time network
68s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
08-10-2022 09:26

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0b7d3217ae50a0433b3a96494d089e05.exe
Size

1.1MB
MD5

0b7d3217ae50a0433b3a96494d089e05
SHA1

012822d29e1ec200b9cf23e10cb0d8a380ec4da6
SHA256

89609c41c0c13302695dec877a6863737243e22b414740e0595f62a0c4d1362a
SHA512

14a2558b3b56fa9f0f1c31dfe2d65cb5b2574c72f16240b94a642be738d1df49d212ebd94a2440aa8c32ba99d2c5876b632a69027615021f2a5bcc552b8d0888
SSDEEP

24576:6AbXH84DRnKCwyElWCAMmKix1x1IDStOX2cBZ8umx7QgbcxWsG2Emy:DL8uokzK6DxcD8uqzbcxWX/my

Score

10^/10

ffdroider neshta aspackv2 persistence spyware stealer

Malware Config

Extracted

Family

ffdroider

http://103.136.42.153

Signatures

FFDroider
Stealer targeting social media platform users first seen in April 2022.
stealer ffdroider

Modifies system executable filetype association 2 TTPs 1 IoCs

persistence

Modify Registry

T1112

Change Default File Association

T1042

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*"	0b7d3217ae50a0433b3a96494d089e05.exe

Neshta
Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.
persistence spyware neshta

ASPack v2.12-2.42 5 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

resource	yara_rule
behavioral1/files/0x000a0000000133ab-55.dat	aspack_v212_v242
behavioral1/files/0x000a0000000133ab-57.dat	aspack_v212_v242
behavioral1/files/0x000a0000000133ab-64.dat	aspack_v212_v242
behavioral1/files/0x00070000000139e4-79.dat	aspack_v212_v242
behavioral1/files/0x00070000000139e4-78.dat	aspack_v212_v242

Executes dropped EXE 1 IoCs

pid	Process
1472	0b7d3217ae50a0433b3a96494d089e05.exe

Loads dropped DLL 3 IoCs

pid	Process
1504	0b7d3217ae50a0433b3a96494d089e05.exe
1504	0b7d3217ae50a0433b3a96494d089e05.exe
1504	0b7d3217ae50a0433b3a96494d089e05.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\MyStart = "C:\\Users\\Admin\\AppData\\Local\\Temp\\0b7d3217ae50a0433b3a96494d089e05.exe"	0b7d3217ae50a0433b3a96494d089e05.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\DW\DWTRIG20.EXE	0b7d3217ae50a0433b3a96494d089e05.exe
File opened for modification	C:\PROGRA~2\Google\Update\1336~1.71\GOOGLE~4.EXE	0b7d3217ae50a0433b3a96494d089e05.exe
File opened for modification	C:\PROGRA~2\INTERN~1\iexplore.exe	0b7d3217ae50a0433b3a96494d089e05.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\INFOPATH.EXE	0b7d3217ae50a0433b3a96494d089e05.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\MSOSYNC.EXE	0b7d3217ae50a0433b3a96494d089e05.exe
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\OFFICE~1\ODeploy.exe	0b7d3217ae50a0433b3a96494d089e05.exe
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\TextConv\WksConv\Wkconv.exe	0b7d3217ae50a0433b3a96494d089e05.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\NAMECO~1.EXE	0b7d3217ae50a0433b3a96494d089e05.exe
File opened for modification	C:\PROGRA~3\PACKAG~1\{61087~1\VCREDI~1.EXE	0b7d3217ae50a0433b3a96494d089e05.exe
File opened for modification	C:\PROGRA~2\Adobe\READER~1.0\Resource\Icons\SC_REA~1.EXE	0b7d3217ae50a0433b3a96494d089e05.exe
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\MSInfo\msinfo32.exe	0b7d3217ae50a0433b3a96494d089e05.exe
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\Oarpmany.exe	0b7d3217ae50a0433b3a96494d089e05.exe
File opened for modification	C:\PROGRA~2\Google\Update\1336~1.71\GOF5E2~1.EXE	0b7d3217ae50a0433b3a96494d089e05.exe
File opened for modification	C:\PROGRA~2\INTERN~1\ielowutil.exe	0b7d3217ae50a0433b3a96494d089e05.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\ONENOTEM.EXE	0b7d3217ae50a0433b3a96494d089e05.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\POWERPNT.EXE	0b7d3217ae50a0433b3a96494d089e05.exe
File opened for modification	C:\PROGRA~2\Adobe\READER~1.0\Reader\ADOBEC~1.EXE	0b7d3217ae50a0433b3a96494d089e05.exe
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\DW\DW20.EXE	0b7d3217ae50a0433b3a96494d089e05.exe
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\MSOXMLED.EXE	0b7d3217ae50a0433b3a96494d089e05.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\IECONT~1.EXE	0b7d3217ae50a0433b3a96494d089e05.exe
File opened for modification	C:\PROGRA~2\WINDOW~1\WinMail.exe	0b7d3217ae50a0433b3a96494d089e05.exe
File opened for modification	C:\PROGRA~2\WI54FB~1\setup_wm.exe	0b7d3217ae50a0433b3a96494d089e05.exe
File opened for modification	C:\PROGRA~2\WI4223~1\sidebar.exe	0b7d3217ae50a0433b3a96494d089e05.exe
File opened for modification	C:\PROGRA~2\Adobe\READER~1.0\Reader\LOGTRA~1.EXE	0b7d3217ae50a0433b3a96494d089e05.exe
File opened for modification	C:\PROGRA~2\MOZILL~1\UNINST~1.EXE	0b7d3217ae50a0433b3a96494d089e05.exe
File opened for modification	C:\PROGRA~2\Google\Update\DISABL~1.EXE	0b7d3217ae50a0433b3a96494d089e05.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\MSTORE.EXE	0b7d3217ae50a0433b3a96494d089e05.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\OIS.EXE	0b7d3217ae50a0433b3a96494d089e05.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\BCSSync.exe	0b7d3217ae50a0433b3a96494d089e05.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\ONENOTE.EXE	0b7d3217ae50a0433b3a96494d089e05.exe
File opened for modification	C:\PROGRA~2\WI54FB~1\wmplayer.exe	0b7d3217ae50a0433b3a96494d089e05.exe
File opened for modification	C:\PROGRA~3\PACKAG~1\{CA675~1\VCREDI~1.EXE	0b7d3217ae50a0433b3a96494d089e05.exe
File opened for modification	C:\PROGRA~2\Adobe\READER~1.0\Reader\ACROBR~1.EXE	0b7d3217ae50a0433b3a96494d089e05.exe
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\FLTLDR.EXE	0b7d3217ae50a0433b3a96494d089e05.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\CNFNOT32.EXE	0b7d3217ae50a0433b3a96494d089e05.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\GRAPH.EXE	0b7d3217ae50a0433b3a96494d089e05.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\MSOUC.EXE	0b7d3217ae50a0433b3a96494d089e05.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\WINWORD.EXE	0b7d3217ae50a0433b3a96494d089e05.exe
File opened for modification	C:\PROGRA~2\MOZILL~1\MAINTE~1.EXE	0b7d3217ae50a0433b3a96494d089e05.exe
File opened for modification	C:\PROGRA~3\PACKAG~1\{57A73~1\VC_RED~1.EXE	0b7d3217ae50a0433b3a96494d089e05.exe
File opened for modification	C:\PROGRA~2\Google\Update\1336~1.71\GO664E~1.EXE	0b7d3217ae50a0433b3a96494d089e05.exe
File opened for modification	C:\PROGRA~2\WI54FB~1\wmpshare.exe	0b7d3217ae50a0433b3a96494d089e05.exe
File opened for modification	C:\PROGRA~3\PACKAG~1\{33D1F~1\VCREDI~1.EXE	0b7d3217ae50a0433b3a96494d089e05.exe
File opened for modification	C:\PROGRA~2\Adobe\READER~1.0\SETUPF~1\{AC76B~1\Setup.exe	0b7d3217ae50a0433b3a96494d089e05.exe
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\OFFICE~1\Setup.exe	0b7d3217ae50a0433b3a96494d089e05.exe
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\SOURCE~1\OSE.EXE	0b7d3217ae50a0433b3a96494d089e05.exe
File opened for modification	C:\PROGRA~2\Google\Update\1336~1.71\GOOGLE~3.EXE	0b7d3217ae50a0433b3a96494d089e05.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\VPREVIEW.EXE	0b7d3217ae50a0433b3a96494d089e05.exe
File opened for modification	C:\PROGRA~2\WINDOW~2\ACCESS~1\wordpad.exe	0b7d3217ae50a0433b3a96494d089e05.exe
File opened for modification	C:\PROGRA~2\Adobe\READER~1.0\Reader\A3DUTI~1.EXE	0b7d3217ae50a0433b3a96494d089e05.exe
File opened for modification	C:\PROGRA~2\Adobe\READER~1.0\Reader\Eula.exe	0b7d3217ae50a0433b3a96494d089e05.exe
File opened for modification	C:\PROGRA~2\COMMON~1\Adobe\Updater6\ADOBEU~1.EXE	0b7d3217ae50a0433b3a96494d089e05.exe
File opened for modification	C:\PROGRA~2\INTERN~1\ieinstal.exe	0b7d3217ae50a0433b3a96494d089e05.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\CLVIEW.EXE	0b7d3217ae50a0433b3a96494d089e05.exe
File opened for modification	C:\PROGRA~2\WINDOW~1\wabmig.exe	0b7d3217ae50a0433b3a96494d089e05.exe
File opened for modification	C:\PROGRA~2\WI54FB~1\WMPDMC.exe	0b7d3217ae50a0433b3a96494d089e05.exe
File opened for modification	C:\PROGRA~2\Adobe\READER~1.0\Reader\AcroRd32.exe	0b7d3217ae50a0433b3a96494d089e05.exe
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\MSOICONS.EXE	0b7d3217ae50a0433b3a96494d089e05.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\GROOVEMN.EXE	0b7d3217ae50a0433b3a96494d089e05.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\MSOHTMED.EXE	0b7d3217ae50a0433b3a96494d089e05.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\WORDICON.EXE	0b7d3217ae50a0433b3a96494d089e05.exe
File opened for modification	C:\PROGRA~2\WINDOW~1\wab.exe	0b7d3217ae50a0433b3a96494d089e05.exe
File opened for modification	C:\PROGRA~2\WI54FB~1\wmlaunch.exe	0b7d3217ae50a0433b3a96494d089e05.exe
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\LICLUA.EXE	0b7d3217ae50a0433b3a96494d089e05.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\svchost.com	0b7d3217ae50a0433b3a96494d089e05.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies registry class 1 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*"	0b7d3217ae50a0433b3a96494d089e05.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeManageVolumePrivilege	1472	0b7d3217ae50a0433b3a96494d089e05.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1504 wrote to memory of 1472	1504	0b7d3217ae50a0433b3a96494d089e05.exe	26
PID 1504 wrote to memory of 1472	1504	0b7d3217ae50a0433b3a96494d089e05.exe	26
PID 1504 wrote to memory of 1472	1504	0b7d3217ae50a0433b3a96494d089e05.exe	26
PID 1504 wrote to memory of 1472	1504	0b7d3217ae50a0433b3a96494d089e05.exe	26

C:\Users\Admin\AppData\Local\Temp\0b7d3217ae50a0433b3a96494d089e05.exe
"C:\Users\Admin\AppData\Local\Temp\0b7d3217ae50a0433b3a96494d089e05.exe"
1⤵
- Modifies system executable filetype association
- Loads dropped DLL
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1504
- C:\Users\Admin\AppData\Local\Temp\3582-490\0b7d3217ae50a0433b3a96494d089e05.exe
  "C:\Users\Admin\AppData\Local\Temp\3582-490\0b7d3217ae50a0433b3a96494d089e05.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of AdjustPrivilegeToken
  PID:1472

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Change Default File Association

T1042

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials in Files

T1081

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\3582-490\0b7d3217ae50a0433b3a96494d089e05.exe

Filesize
1.1MB

MD5
78c42d6817af1ad96cabdf6ff2f7f3da

SHA1
abeadcee8d9f00c6ccdb0f9d33edd1006a079384

SHA256
38b2c7a1af454d382927f81543d86055886bc028634575050367d052efd26434

SHA512
76a3b3e6ae0ea0f17661314fe391ec8b9b580a7ecfee0ebe2d830db3843d5d929d6bf3adb8cb03f6b87212a607ce001700ea3dc305828c817ff017dd3b766811

Download Submit
C:\Users\Admin\AppData\Local\Temp\3582-490\0b7d3217ae50a0433b3a96494d089e05.exe

Filesize
1.1MB

MD5
78c42d6817af1ad96cabdf6ff2f7f3da

SHA1
abeadcee8d9f00c6ccdb0f9d33edd1006a079384

SHA256
38b2c7a1af454d382927f81543d86055886bc028634575050367d052efd26434

SHA512
76a3b3e6ae0ea0f17661314fe391ec8b9b580a7ecfee0ebe2d830db3843d5d929d6bf3adb8cb03f6b87212a607ce001700ea3dc305828c817ff017dd3b766811

Download Submit
C:\Users\Admin\DOCUME~1\VLCPVI~1.1\0B7D32~1.EXE

Filesize
1.1MB

MD5
78c42d6817af1ad96cabdf6ff2f7f3da

SHA1
abeadcee8d9f00c6ccdb0f9d33edd1006a079384

SHA256
38b2c7a1af454d382927f81543d86055886bc028634575050367d052efd26434

SHA512
76a3b3e6ae0ea0f17661314fe391ec8b9b580a7ecfee0ebe2d830db3843d5d929d6bf3adb8cb03f6b87212a607ce001700ea3dc305828c817ff017dd3b766811

Download Submit
\PROGRA~2\Adobe\READER~1.0\Reader\LOGTRA~1.EXE

Filesize
252KB

MD5
9e2b9928c89a9d0da1d3e8f4bd96afa7

SHA1
ec66cda99f44b62470c6930e5afda061579cde35

SHA256
8899b4ed3446b7d55b54defbc1acb7c5392a4b3bc8ec2cdc7c31171708965043

SHA512
2ca5ad1d0e12a8049de885b90b7f56fe77c868e0d6dae4ec4b6f3bc0bf7b2e73295cc9b1328c2b45357ffb0d7804622ab3f91a56140b098e93b691032d508156

Download Submit
\Users\Admin\AppData\Local\Temp\3582-490\0b7d3217ae50a0433b3a96494d089e05.exe

Filesize
1.1MB

MD5
78c42d6817af1ad96cabdf6ff2f7f3da

SHA1
abeadcee8d9f00c6ccdb0f9d33edd1006a079384

SHA256
38b2c7a1af454d382927f81543d86055886bc028634575050367d052efd26434

SHA512
76a3b3e6ae0ea0f17661314fe391ec8b9b580a7ecfee0ebe2d830db3843d5d929d6bf3adb8cb03f6b87212a607ce001700ea3dc305828c817ff017dd3b766811

Download Submit
\Users\Admin\DOCUME~1\VLCPVI~1.1\0B7D32~1.EXE

Filesize
1.1MB

MD5
78c42d6817af1ad96cabdf6ff2f7f3da

SHA1
abeadcee8d9f00c6ccdb0f9d33edd1006a079384

SHA256
38b2c7a1af454d382927f81543d86055886bc028634575050367d052efd26434

SHA512
76a3b3e6ae0ea0f17661314fe391ec8b9b580a7ecfee0ebe2d830db3843d5d929d6bf3adb8cb03f6b87212a607ce001700ea3dc305828c817ff017dd3b766811

Download Submit
memory/1472-63-0x0000000000870000-0x0000000000B0E000-memory.dmp

Filesize
2.6MB

Download
memory/1472-60-0x0000000000870000-0x0000000000B0E000-memory.dmp

Filesize
2.6MB

Download
memory/1472-59-0x0000000000870000-0x0000000000B0E000-memory.dmp

Filesize
2.6MB

Download
memory/1472-66-0x00000000022B0000-0x00000000022C0000-memory.dmp

Filesize
64KB

Download
memory/1472-72-0x00000000023C0000-0x00000000023D0000-memory.dmp

Filesize
64KB

Download
memory/1472-81-0x0000000000870000-0x0000000000B0E000-memory.dmp

Filesize
2.6MB

Download
memory/1504-61-0x0000000002620000-0x00000000028BE000-memory.dmp

Filesize
2.6MB

Download
memory/1504-54-0x00000000768A1000-0x00000000768A3000-memory.dmp

Filesize
8KB

Download
memory/1504-80-0x0000000002620000-0x00000000028BE000-memory.dmp

Filesize
2.6MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads