ffdroider | fd0e9e093b695b66b71910bf84e1196b1123700185521e8b3f27ac98aa1dd507

Analysis

max time kernel
27s
max time network
30s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
03-01-2023 05:44

Target

fd0e9e093b695b66b71910bf84e1196b1123700185521e8b3f27ac98aa1dd507.exe
Size

789KB
MD5

b41472d8b0e9c50205e96d39e427de9e
SHA1

c16a3a63fd20c22fc8da89ab2896d76ca0e724db
SHA256

fd0e9e093b695b66b71910bf84e1196b1123700185521e8b3f27ac98aa1dd507
SHA512

8161e820896be2d6b63291cc4ef74879d2b5cdf87c3a202664eecfd851f279efbe4b624461470672589d082809f00864c029a0a78f2c053ca83c6d1c5e0d3d95
SSDEEP

24576:HH5+AShmB2TZ5jD382ae227uU2JNysPdV2PNa:n59amB2TXjz82aeTuDi

Score

10^/10

Family

ffdroider

http://101.36.107.74

FFDroider
Stealer targeting social media platform users first seen in April 2022.
stealer ffdroider

VMProtect packed file 2 IoCs

Detects executables packed with VMProtect commercial packer.

resource	yara_rule
behavioral1/memory/1532-55-0x0000000000400000-0x0000000000644000-memory.dmp	vmprotect
behavioral1/memory/1532-58-0x0000000000400000-0x0000000000644000-memory.dmp	vmprotect

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1884	1532	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1532 wrote to memory of 1884	1532	fd0e9e093b695b66b71910bf84e1196b1123700185521e8b3f27ac98aa1dd507.exe	28
PID 1532 wrote to memory of 1884	1532	fd0e9e093b695b66b71910bf84e1196b1123700185521e8b3f27ac98aa1dd507.exe	28
PID 1532 wrote to memory of 1884	1532	fd0e9e093b695b66b71910bf84e1196b1123700185521e8b3f27ac98aa1dd507.exe	28
PID 1532 wrote to memory of 1884	1532	fd0e9e093b695b66b71910bf84e1196b1123700185521e8b3f27ac98aa1dd507.exe	28

C:\Users\Admin\AppData\Local\Temp\fd0e9e093b695b66b71910bf84e1196b1123700185521e8b3f27ac98aa1dd507.exe
"C:\Users\Admin\AppData\Local\Temp\fd0e9e093b695b66b71910bf84e1196b1123700185521e8b3f27ac98aa1dd507.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1532
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1532 -s 176
  2⤵
  - Program crash
  PID:1884

memory/1532-54-0x0000000076941000-0x0000000076943000-memory.dmp

Filesize
8KB

Download
memory/1532-55-0x0000000000400000-0x0000000000644000-memory.dmp

Filesize
2.3MB

Download
memory/1532-58-0x0000000000400000-0x0000000000644000-memory.dmp

Filesize
2.3MB

Download