ffdroider | 2ec6c6341ff83005a6515d942976d2092549312d419a29e59d0efb15d65749bf

General

Target

15fd29325e11aa1777bdde1e09829784.exe
Size

3.2MB
MD5

15fd29325e11aa1777bdde1e09829784
SHA1

276c234a544054072593fb3b87e2a37f81e4f3c5
SHA256

2ec6c6341ff83005a6515d942976d2092549312d419a29e59d0efb15d65749bf
SHA512

53a1d60c2e6b679b89effb81da0cc0bce4d26644d5ce190258ce6d9821802bb8aa1f349a61567d4806f19acbcdb34e6a3cb66d72a4a8169223165c7396eda02d
SSDEEP

98304:UbvDpNv9xyFximcWtxL4iZ1XxDLv6BFe6:UoxHcCLn3pLiBFe6

Score

10^/10

ffdroider smokeloader pub2 backdoor stealer trojan vmprotect

Malware Config

Extracted

Family

ffdroider

C2

http://101.36.107.74

Extracted

Family

smokeloader

Botnet

pub2

Extracted

Family

smokeloader

Version

2020

C2

http://conceitosseg.com/upload/

http://integrasidata.com/upload/

http://ozentekstil.com/upload/

http://finbelportal.com/upload/

http://telanganadigital.com/upload/

rc4.i32

Signatures

FFDroider
Stealer targeting social media platform users first seen in April 2022.
stealer ffdroider

Process spawned unexpected child process 1 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2272	912	rUNdlL32.eXe	23

SmokeLoader
Modular backdoor trojan in use since 2014.
trojan backdoor smokeloader

Executes dropped EXE 1 IoCs

pid	Process
2812	Files.exe

Loads dropped DLL 3 IoCs

pid	Process
816	15fd29325e11aa1777bdde1e09829784.exe
816	15fd29325e11aa1777bdde1e09829784.exe
816	15fd29325e11aa1777bdde1e09829784.exe

Unexpected DNS network traffic destination 5 IoCs

Network traffic to other servers than the configured DNS servers was detected on the DNS port.

description	ioc
Destination IP	185.116.193.219
Destination IP	185.116.193.219
Destination IP	185.116.193.219
Destination IP	185.116.193.219
Destination IP	185.116.193.219

VMProtect packed file 2 IoCs

Detects executables packed with VMProtect commercial packer.

vmprotect

resource	yara_rule
behavioral1/memory/1696-142-0x0000000000400000-0x00000000005DB000-memory.dmp	vmprotect
behavioral1/memory/1696-201-0x0000000000400000-0x00000000005DB000-memory.dmp	vmprotect

Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102

Looks up external IP address via web service 4 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
55	api.db-ip.com
56	api.db-ip.com
8	ipinfo.io
13	ipinfo.io

Looks up geolocation information via web service
Uses a legitimate geolocation service to find the infected system's geolocation info.

AutoIT Executable 2 IoCs

AutoIT scripts compiled to PE executables.

resource	yara_rule
behavioral1/files/0x0007000000015f92-38.dat	autoit_exe
behavioral1/files/0x0007000000015f92-36.dat	autoit_exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2864	1696	WerFault.exe	22

Kills process with taskkill 1 IoCs

evasion

pid	Process
2704	taskkill.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 816 wrote to memory of 2812	816	15fd29325e11aa1777bdde1e09829784.exe	38
PID 816 wrote to memory of 2812	816	15fd29325e11aa1777bdde1e09829784.exe	38
PID 816 wrote to memory of 2812	816	15fd29325e11aa1777bdde1e09829784.exe	38
PID 816 wrote to memory of 2812	816	15fd29325e11aa1777bdde1e09829784.exe	38

C:\Users\Admin\AppData\Local\Temp\15fd29325e11aa1777bdde1e09829784.exe
"C:\Users\Admin\AppData\Local\Temp\15fd29325e11aa1777bdde1e09829784.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:816
- C:\Users\Admin\AppData\Local\Temp\KRSetp.exe
  "C:\Users\Admin\AppData\Local\Temp\KRSetp.exe"
  2⤵
  PID:2152
- C:\Users\Admin\AppData\Local\Temp\jg3_3uag.exe
  "C:\Users\Admin\AppData\Local\Temp\jg3_3uag.exe"
  2⤵
  PID:1696
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1696 -s 176
    3⤵
    - Program crash
    PID:2864
- C:\Users\Admin\AppData\Local\Temp\pub2.exe
  "C:\Users\Admin\AppData\Local\Temp\pub2.exe"
  2⤵
  PID:1492
- C:\Users\Admin\AppData\Local\Temp\Install.exe
  "C:\Users\Admin\AppData\Local\Temp\Install.exe"
  2⤵
  PID:2508
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c taskkill /f /im chrome.exe
    3⤵
    PID:2204
- C:\Users\Admin\AppData\Local\Temp\Info.exe
  "C:\Users\Admin\AppData\Local\Temp\Info.exe"
  2⤵
  PID:1912
- C:\Users\Admin\AppData\Local\Temp\Folder.exe
  "C:\Users\Admin\AppData\Local\Temp\Folder.exe"
  2⤵
  PID:396
- C:\Users\Admin\AppData\Local\Temp\Files.exe
  "C:\Users\Admin\AppData\Local\Temp\Files.exe"
  2⤵
  - Executes dropped EXE
  PID:2812

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding
1⤵
PID:2860
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2860 CREDAT:275457 /prefetch:2
  2⤵
  PID:2564
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2860 CREDAT:734214 /prefetch:2
  2⤵
  PID:2032

C:\Windows\SysWOW64\rundll32.exe
rUNdlL32.eXe "C:\Users\Admin\AppData\Local\Temp\axhub.dll",main
1⤵
PID:2104

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k SystemNetworkService
1⤵
PID:1652

C:\Windows\system32\rUNdlL32.eXe
rUNdlL32.eXe "C:\Users\Admin\AppData\Local\Temp\axhub.dll",main
1⤵
- Process spawned unexpected child process
PID:2272

C:\Users\Admin\AppData\Local\Temp\Folder.exe
"C:\Users\Admin\AppData\Local\Temp\Folder.exe" -a
1⤵
PID:1772

C:\Users\Admin\AppData\Local\Temp\RarSFX0\File.exe
"C:\Users\Admin\AppData\Local\Temp\RarSFX0\File.exe"
1⤵
PID:2732

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im chrome.exe
1⤵
- Kills process with taskkill
PID:2704

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Web Service

1

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Files.exe

Filesize
92KB

MD5
acbc324f271a5dbbedb0db736aedc1e3

SHA1
c60de09b67e293a94f8640d6331f359744ed1a06

SHA256
1541fab233526350f11f6b33104e22943b71d345e9d513b7f6696e0c3c3d4e29

SHA512
e8c9d2fa746f6ecf0eafffb243f69d58126b8361d35c5c6bb15ce042807086be8724409e84e6e420109103267212d73504e7899c8b4aaa818294f7a53da9d8ca

Download Submit
C:\Users\Admin\AppData\Local\Temp\Files.exe

Filesize
685KB

MD5
19f074f48ece071572117ad39abfdd0e

SHA1
80e9cef55ad3fdba8eb8620794592679d4fa9426

SHA256
6b7dc5c636e83b8c49b5c0f3fb189511ba1d17d774d8cf309cc2d805a987655b

SHA512
7e719e5dd3db9b346b85f33e626ba353243080a8b23265781108b093f1666dec8294dd142a9fc1337dc78323f685c527dc81cb917c891e7aa77cdaa610f3cd28

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX0\File.exe

Filesize
846KB

MD5
09e9036e720556b90849d55a19e5c7dd

SHA1
862b2f14e945e4bf24f19ad3f1eb8f7e290a8d89

SHA256
5ec2d9b70fc901925c7bb7aed5af4e760732b5f56df34b9dafba5655c68b4ce5

SHA512
ba6abbbc1157b3b699369acf91e2e42e1afbe0e82073f654831eeb38938c1b772eb095dd31c0e9c81bd717b8d6027e0bfa8771b172ad4ea9a8ad48e752c56cda

Download Submit
memory/816-47-0x0000000003670000-0x0000000003672000-memory.dmp

Filesize
8KB

Download
memory/816-94-0x00000000046C0000-0x000000000489B000-memory.dmp

Filesize
1.9MB

Download
memory/860-180-0x0000000000E60000-0x0000000000EAC000-memory.dmp

Filesize
304KB

Download
memory/860-193-0x0000000001BB0000-0x0000000001C21000-memory.dmp

Filesize
452KB

Download
memory/860-224-0x0000000000E60000-0x0000000000EAC000-memory.dmp

Filesize
304KB

Download
memory/860-159-0x0000000000E60000-0x0000000000EAC000-memory.dmp

Filesize
304KB

Download
memory/860-981-0x0000000000E60000-0x0000000000EAC000-memory.dmp

Filesize
304KB

Download
memory/860-169-0x0000000001BB0000-0x0000000001C21000-memory.dmp

Filesize
452KB

Download
memory/1208-338-0x0000000003DA0000-0x0000000003DB5000-memory.dmp

Filesize
84KB

Download
memory/1492-339-0x0000000000400000-0x00000000009B1000-memory.dmp

Filesize
5.7MB

Download
memory/1492-226-0x0000000000400000-0x00000000009B1000-memory.dmp

Filesize
5.7MB

Download
memory/1492-222-0x00000000001B0000-0x00000000001B9000-memory.dmp

Filesize
36KB

Download
memory/1492-221-0x0000000000250000-0x0000000000350000-memory.dmp

Filesize
1024KB

Download
memory/1652-1444-0x0000000000450000-0x00000000004C1000-memory.dmp

Filesize
452KB

Download
memory/1652-1590-0x0000000000450000-0x00000000004C1000-memory.dmp

Filesize
452KB

Download
memory/1652-1592-0x0000000000450000-0x00000000004C1000-memory.dmp

Filesize
452KB

Download
memory/1652-227-0x0000000000450000-0x00000000004C1000-memory.dmp

Filesize
452KB

Download
memory/1652-184-0x00000000000E0000-0x000000000012C000-memory.dmp

Filesize
304KB

Download
memory/1652-223-0x0000000000450000-0x00000000004C1000-memory.dmp

Filesize
452KB

Download
memory/1652-982-0x0000000000450000-0x00000000004C1000-memory.dmp

Filesize
452KB

Download
memory/1652-980-0x0000000000450000-0x00000000004C1000-memory.dmp

Filesize
452KB

Download
memory/1652-186-0x0000000000450000-0x00000000004C1000-memory.dmp

Filesize
452KB

Download
memory/1696-201-0x0000000000400000-0x00000000005DB000-memory.dmp

Filesize
1.9MB

Download
memory/1696-142-0x0000000000400000-0x00000000005DB000-memory.dmp

Filesize
1.9MB

Download
memory/2104-182-0x00000000007F0000-0x000000000084D000-memory.dmp

Filesize
372KB

Download
memory/2104-181-0x00000000021F0000-0x00000000022F1000-memory.dmp

Filesize
1.0MB

Download
memory/2152-151-0x0000000000260000-0x0000000000286000-memory.dmp

Filesize
152KB

Download
memory/2152-971-0x000007FEF5900000-0x000007FEF62EC000-memory.dmp

Filesize
9.9MB

Download
memory/2152-979-0x000000001AFA0000-0x000000001B020000-memory.dmp

Filesize
512KB

Download
memory/2152-126-0x00000000011F0000-0x0000000001222000-memory.dmp

Filesize
200KB

Download
memory/2152-149-0x0000000000250000-0x0000000000256000-memory.dmp

Filesize
24KB

Download
memory/2152-158-0x0000000000470000-0x0000000000476000-memory.dmp

Filesize
24KB

Download
memory/2152-1589-0x000007FEF5900000-0x000007FEF62EC000-memory.dmp

Filesize
9.9MB

Download
memory/2152-189-0x000007FEF5900000-0x000007FEF62EC000-memory.dmp

Filesize
9.9MB

Download
memory/2152-211-0x000000001AFA0000-0x000000001B020000-memory.dmp

Filesize
512KB

Download
memory/2812-344-0x00000000026D0000-0x00000000026D2000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Extracted

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads