Analysis
- max time kernel
117s - max time network
121s - platform
windows7_x64 - resource
win7-20240221-en - resource tags
- submitted
26/02/2024, 12:12
General
- Target a651eb4302692615d55758345f634f96.exe
- Size 945KB
- Sample240226-pdcl5sdc39
- SHA256 01b6cc40ce1ce6611be95ae1789fc6cfeef9cd7d1790bec437df56c54e1de42a
Score
10/10
Malware Config
Extracted
Family
-
ffdroider
C2
-
http://186.2.171.3
Signatures
- FFDroider
Stealer targeting social media platform users first seen in April 2022.
- FFDroider payload 2 IoCs
- Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\a651eb4302692615d55758345f634f96.exe"C:\Users\Admin\AppData\Local\Temp\a651eb4302692615d55758345f634f96.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
Cab60D7.tmp
memory/2488-0-0x0000000000400000-0x000000000067E000-memory.dmp
memory/2488-1-0x0000000000020000-0x0000000000023000-memory.dmp
memory/2488-19-0x0000000000400000-0x000000000067E000-memory.dmp
memory/2488-21-0x0000000000020000-0x0000000000023000-memory.dmp
memory/2488-24-0x0000000003380000-0x0000000003390000-memory.dmp
memory/2488-30-0x0000000003520000-0x0000000003530000-memory.dmp
memory/2488-40-0x0000000000400000-0x000000000067E000-memory.dmp