Analysis
-
max time kernel
141s -
max time network
125s -
platform
windows7_x64 -
resource
win7-20231023-en -
resource tags
-
submitted
26-11-2023 14:04
General
-
Target
8e3d48148237679d6cdce75b7956121029723aefd3474dea2dd85185fe46ade5.exe
-
Size
1.7MB
-
MD5
7e2ccd4dc2823dd85c12a5f85724f2cd
-
SHA1
c0be781d4f6b537ba955395bf2240d90ef9759a1
-
SHA256
8e3d48148237679d6cdce75b7956121029723aefd3474dea2dd85185fe46ade5
-
SHA512
92ad3e178c3eef1772c5dc92a65908f6db2aaa602080153c0e5272391a5ebfbbe4608374c5196fa674fe1b60c287f2217a8907e9a23aa2629b26fc9963093851
-
SSDEEP
24576:dYianUR2jR97bUyvK3H1S0vfs2tPwHtnKCKKITko7kGuap0D93MwjBiUNDI4rL:XaXR97bEVSsfsfHtnKCKJz7vRkXjBv
Score
10/10
Malware Config
Extracted
Family
ffdroider
C2
http://45.43.62.216
Signatures
-
FFDroider
Stealer targeting social media platform users first seen in April 2022.
-
FFDroider payload 2 IoCs
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\8e3d48148237679d6cdce75b7956121029723aefd3474dea2dd85185fe46ade5.exe"C:\Users\Admin\AppData\Local\Temp\8e3d48148237679d6cdce75b7956121029723aefd3474dea2dd85185fe46ade5.exe"1⤵
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4.4MB
-
Filesize
12KB
-
Filesize
4.4MB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
4.4MB