ffdroider | 1108d913b6d546b87ce79dc76886a70311e11dd96f9ebf0e71b4e14022e67f0f

Analysis

max time kernel
117s
max time network
123s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
26-12-2023 22:54

Target

943d47d83fd5241dd08f4dacf05436dd.exe
Size

950KB
MD5

943d47d83fd5241dd08f4dacf05436dd
SHA1

1babac86e0a9f8852849a9bf3f281b85fdd86f84
SHA256

1108d913b6d546b87ce79dc76886a70311e11dd96f9ebf0e71b4e14022e67f0f
SHA512

3e49f4914dbba02bc75818d701202e262917dd29db2ff19c657361a1183ac25d45f864aca4598481e83183a709a124cae72a16d7adab8b24ceb3584ac72f03ac
SSDEEP

12288:Pivo6XvOrZfr+oeVcmx+l55/E6kFEREcyaf9bKRJVZVlDB1rjOeMozBtV/fRo:atXYb4jrKMObMrhLdMozBtRfO

Score

10^/10

Family

ffdroider

http://128.1.32.84

FFDroider
Stealer targeting social media platform users first seen in April 2022.
stealer ffdroider

FFDroider payload 2 IoCs

resource	yara_rule
behavioral1/memory/2992-1-0x0000000000400000-0x0000000000684000-memory.dmp	family_ffdroider
behavioral1/memory/2992-3-0x0000000000400000-0x0000000000684000-memory.dmp	family_ffdroider

VMProtect packed file 3 IoCs

Detects executables packed with VMProtect commercial packer.

resource	yara_rule
behavioral1/memory/2992-0-0x0000000000400000-0x0000000000684000-memory.dmp	vmprotect
behavioral1/memory/2992-1-0x0000000000400000-0x0000000000684000-memory.dmp	vmprotect
behavioral1/memory/2992-3-0x0000000000400000-0x0000000000684000-memory.dmp	vmprotect

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1912	2992	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2992 wrote to memory of 1912	2992	943d47d83fd5241dd08f4dacf05436dd.exe	28
PID 2992 wrote to memory of 1912	2992	943d47d83fd5241dd08f4dacf05436dd.exe	28
PID 2992 wrote to memory of 1912	2992	943d47d83fd5241dd08f4dacf05436dd.exe	28
PID 2992 wrote to memory of 1912	2992	943d47d83fd5241dd08f4dacf05436dd.exe	28

C:\Users\Admin\AppData\Local\Temp\943d47d83fd5241dd08f4dacf05436dd.exe
"C:\Users\Admin\AppData\Local\Temp\943d47d83fd5241dd08f4dacf05436dd.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2992
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2992 -s 184
  2⤵
  - Program crash
  PID:1912

memory/2992-0-0x0000000000400000-0x0000000000684000-memory.dmp

Filesize
2.5MB

Download
memory/2992-1-0x0000000000400000-0x0000000000684000-memory.dmp

Filesize
2.5MB

Download
memory/2992-3-0x0000000000400000-0x0000000000684000-memory.dmp

Filesize
2.5MB

Download