Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

10

fb3bc18401...c2.exe

windows7-x64

10

fb3bc18401...c2.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    143s
  • max time network
    157s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231215-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
  • submitted
    20/12/2023, 17:43

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    fb3bc18401f7cc5a5b426209cbf968c2.exe

  • Size

    5.3MB

  • MD5

    fb3bc18401f7cc5a5b426209cbf968c2

  • SHA1

    670d97d270669c2e721d9940fe83fb0db9431edf

  • SHA256

    40d7ead8c2b3f512f490edf1c2ac207bafca3bbc1def3bbda44fe855ef1fb9f3

  • SHA512

    cd5b4502baf74556b7e6cfb7348e2af1537f7296ae343bb9b005748c51cd78764fd02036621565e655e58a67fb78b6cee55419b90ab68fb2011543ba2be2d931

  • SSDEEP

    98304:brbMvQuxQBQe4dbR0zWRLFphiHvQ/qpyr0k88suiO+QahI+iZ7q1zPPXNAjtVa/u:X+fei5suiO+QCI+7NAjtVa/u

Score
10/10
ffdroiderstealer

Malware Config

Extracted

Family

ffdroider

C2

http://186.2.171.3

Signatures

  • FFDroider

    Stealer targeting social media platform users first seen in April 2022.

    stealerffdroider
  • FFDroider payload 2 IoCs
  • Program crash 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\fb3bc18401f7cc5a5b426209cbf968c2.exe
    "C:\Users\Admin\AppData\Local\Temp\fb3bc18401f7cc5a5b426209cbf968c2.exe"
    1⤵
      PID:4680
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 4680 -s 660
        2⤵
        • Program crash
        PID:2256
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 4680 -ip 4680
      1⤵
        PID:2776

      Network

      MITRE ATT&CK Matrix

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • memory/4680-0-0x0000000000400000-0x0000000000945000-memory.dmp

        Filesize

        5.3MB

        Download

      • memory/4680-1-0x0000000000400000-0x0000000000945000-memory.dmp

        Filesize

        5.3MB

        Download