Analysis
-
max time kernel
23s -
max time network
144s -
platform
windows10-2004_x64 -
resource
win10v2004-20231222-en -
resource tags
-
submitted
26-12-2023 22:54
General
-
Target
943d47d83fd5241dd08f4dacf05436dd.exe
-
Size
950KB
-
MD5
943d47d83fd5241dd08f4dacf05436dd
-
SHA1
1babac86e0a9f8852849a9bf3f281b85fdd86f84
-
SHA256
1108d913b6d546b87ce79dc76886a70311e11dd96f9ebf0e71b4e14022e67f0f
-
SHA512
3e49f4914dbba02bc75818d701202e262917dd29db2ff19c657361a1183ac25d45f864aca4598481e83183a709a124cae72a16d7adab8b24ceb3584ac72f03ac
-
SSDEEP
12288:Pivo6XvOrZfr+oeVcmx+l55/E6kFEREcyaf9bKRJVZVlDB1rjOeMozBtV/fRo:atXYb4jrKMObMrhLdMozBtRfO
Malware Config
Extracted
ffdroider
http://128.1.32.84
Signatures
-
FFDroider
Stealer targeting social media platform users first seen in April 2022.
-
FFDroider payload 1 IoCs
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
VMProtect packed file 4 IoCs
Detects executables packed with VMProtect commercial packer.
-
Checks whether UAC is enabled 1 TTPs 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\943d47d83fd5241dd08f4dacf05436dd.exe"C:\Users\Admin\AppData\Local\Temp\943d47d83fd5241dd08f4dacf05436dd.exe"1⤵
- Checks whether UAC is enabled
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.5MB
-
Filesize
2.5MB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
32KB
-
Filesize
2.5MB
-
Filesize
2.5MB