Analysis
- max time kernel
142s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-20231025-en - resource tags
- submitted
26/11/2023, 14:04
General
- Target 8e3d48148237679d6cdce75b7956121029723aefd3474dea2dd85185fe46ade5.exe
- Size 1.7MB
- Sample231126-rdsdpshg87
- SHA256 8e3d48148237679d6cdce75b7956121029723aefd3474dea2dd85185fe46ade5
Malware Config
Extracted
-
ffdroider
-
http://45.43.62.216
Signatures
- FFDroider
Stealer targeting social media platform users first seen in April 2022.
- FFDroider payload 2 IoCs
- Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 1 IoCs
- Checks whether UAC is enabled 1 TTPs 1 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\8e3d48148237679d6cdce75b7956121029723aefd3474dea2dd85185fe46ade5.exe"C:\Users\Admin\AppData\Local\Temp\8e3d48148237679d6cdce75b7956121029723aefd3474dea2dd85185fe46ade5.exe"1⤵
- Adds Run key to start application
- Checks whether UAC is enabled
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
d.jfm
d.jfm
d.jfm
d.jfm
d.jfm
memory/4392-22-0x0000000004960000-0x0000000004968000-memory.dmp
memory/4392-44-0x0000000004960000-0x0000000004968000-memory.dmp
memory/4392-24-0x0000000004A00000-0x0000000004A08000-memory.dmp
memory/4392-27-0x0000000004B40000-0x0000000004B48000-memory.dmp
memory/4392-28-0x0000000004B60000-0x0000000004B68000-memory.dmp
memory/4392-29-0x0000000004E00000-0x0000000004E08000-memory.dmp
memory/4392-30-0x0000000004D00000-0x0000000004D08000-memory.dmp
memory/4392-31-0x0000000004B70000-0x0000000004B78000-memory.dmp
memory/4392-21-0x0000000004940000-0x0000000004948000-memory.dmp
memory/4392-0-0x0000000000400000-0x000000000086D000-memory.dmp
memory/4392-14-0x0000000003E80000-0x0000000003E90000-memory.dmp
memory/4392-52-0x0000000004B70000-0x0000000004B78000-memory.dmp
memory/4392-54-0x0000000004CA0000-0x0000000004CA8000-memory.dmp
memory/4392-8-0x0000000003CE0000-0x0000000003CF0000-memory.dmp
memory/4392-67-0x0000000004960000-0x0000000004968000-memory.dmp
memory/4392-3-0x0000000000400000-0x000000000086D000-memory.dmp
memory/4392-75-0x0000000004CA0000-0x0000000004CA8000-memory.dmp
memory/4392-77-0x0000000004B70000-0x0000000004B78000-memory.dmp
memory/4392-1-0x00000000001D0000-0x00000000001D3000-memory.dmp
memory/4392-101-0x0000000000400000-0x000000000086D000-memory.dmp