Analysis

  • max time kernel
    122s
  • max time network
    123s
  • platform
    windows7_x64
  • resource
    win7-20240508-en
  • resource tags

    arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
  • submitted
    20-06-2024 07:17

General

  • Target

    FM4ffx.exe

  • Size

    319KB

  • MD5

    fe768a6b82ed2a59c58254eae67b8cf9

  • SHA1

    3dad9bf5011fb73b9be2fe6c601bb6281a3ceaf6

  • SHA256

    3ac3c700060a0487060724f3fd22faf70d5f633e69401641964d7ba4d6e6e570

  • SHA512

    3d8caadc61ea127bd0e3d01f35274a2ebfa34a0ac12b0932988300d011347f74a09c2bf3c85e58bfbe5200288c6e6f100b4f08916d23e56d7b52a70130aad14b

  • SSDEEP

    6144:Ve34G2ct7JdUwA2UL4iCPfAHfWpR+0BmiBEaiXLoyX:Et9BHjAupYMmyk7R

Score
7/10

Malware Config

Signatures

  • Loads dropped DLL 64 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

Processes

  • C:\Users\Admin\AppData\Local\Temp\FM4ffx.exe
    "C:\Users\Admin\AppData\Local\Temp\FM4ffx.exe"
    1⤵
    • Loads dropped DLL
    PID:2408

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\nsi2286.tmp

    Filesize

    661B

    MD5

    7271c630d76fe24bfc601cff33cf57aa

    SHA1

    bbd75d10939954b941e961ddc65a170188447fb6

    SHA256

    817bf925e8f3c9dfece5e8b93830ea514061a19b73eb9b2c2479e0281ee364ce

    SHA512

    258038719917524c04f2455065480d24e2ff57f0390cd0145fe1d631dff9f34f1a96167a615ffb9ff70387c3d9699fcaac29a531e71ea55a9a8d35d05475f081

  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nfhvy4wu.Admin\user.js

    Filesize

    824B

    MD5

    5bf11ab21587410e09af8c60e5dc3f68

    SHA1

    2b89c6da5e1e292ecc4fb8022a9cb9274ed31aa2

    SHA256

    7d96d78547040e33057b28277627221a7cf22c6bbe158ca44a85bba2d7a0f803

    SHA512

    30a8a910af021c806143bdfd031e50bdf5be9d25497be19179e23b6509d07c0df87e9b0db5619ff233a058a33638ce892983ca0dffa334a700cae242cd60f65a

  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nfhvy4wu.Admin\user.js

    Filesize

    1KB

    MD5

    07cc08b68bd244e4e75f8ac66c7f8d3e

    SHA1

    ddde5cbd3698cc42a21721f5217a64f085933c0a

    SHA256

    6707adbc39be1a879f1a6fe28b6079817a8d26ec61fe3984ef3316b4b5f1841d

    SHA512

    7d486a084acb39718a3b1cba64d252013e8d009dae56a924873d550057e8edbf3063a2caf3fa290494a85f2c02fbec1869a593fbbc8eac77c69d1263cfd5b5c5

  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nfhvy4wu.default-release\user.js

    Filesize

    830B

    MD5

    d0ccd3c503994fe886e23e0a665432ba

    SHA1

    f56992656070e9e01c78d2f4345cedc68c00b654

    SHA256

    5bcbec1d25e852db70ad6136f0cfb4c5d17acfa4b745abc36790064522b0eb71

    SHA512

    610699de7dfdc66966f36efda78dab847fcc9e84ad227090471166b43145573038cf8926d5245884c4bfe16139e4695993e12864a2ef5d1570ab8503dd9769be

  • \Users\Admin\AppData\Local\Temp\nst2222.tmp\System.dll

    Filesize

    11KB

    MD5

    c17103ae9072a06da581dec998343fc1

    SHA1

    b72148c6bdfaada8b8c3f950e610ee7cf1da1f8d

    SHA256

    dc58d8ad81cacb0c1ed72e33bff8f23ea40b5252b5bb55d393a0903e6819ae2f

    SHA512

    d32a71aaef18e993f28096d536e41c4d016850721b31171513ce28bbd805a54fd290b7c3e9d935f72e676a1acfb4f0dcc89d95040a0dd29f2b6975855c18986f

  • \Users\Admin\AppData\Local\Temp\nst2222.tmp\Time.dll

    Filesize

    10KB

    MD5

    38977533750fe69979b2c2ac801f96e6

    SHA1

    74643c30cda909e649722ed0c7f267903558e92a

    SHA256

    b4a95a455e53372c59f91bc1b5fb9e5c8e4a10a506fa04aaf7be27048b30ae35

    SHA512

    e17069395ad4a17e24f7cd3c532670d40244bd5ae3887c82e3b2e4a68c250cd55e2d8b329d6ff0e2d758955ab7470534e6307779e49fe331c1fd2242ea73fd53

  • \Users\Admin\AppData\Local\Temp\nst2222.tmp\mt.dll

    Filesize

    5KB

    MD5

    aac69f856c4540edd4ef7ce6c8571639

    SHA1

    2860f55ea9774d631219e66604051e90a43258b7

    SHA256

    6dc2644a389feeef9e0ac65e2c8b01fc18ca6e53b253f10efffcb117e0a852dd

    SHA512

    ebacc8117c44d298ae519705510285c576932761b3c7b697eeb91cb7620150ebe551102d1ab83d68f4c78e1496b191a55ad8f78c491f5b4af456c4de6ad72dcd

  • \Users\Admin\AppData\Local\Temp\nst2222.tmp\nsisos.dll

    Filesize

    5KB

    MD5

    69806691d649ef1c8703fd9e29231d44

    SHA1

    e2193fcf5b4863605eec2a5eb17bf84c7ac00166

    SHA256

    ba79ab7f63f02ed5d5d46b82b11d97dac5b7ef7e9b9a4df926b43ceac18483b6

    SHA512

    5e5e0319e701d15134a01cb6472c624e271e99891058aef4dfe779c29c73899771a5b6f8b1cd61b543a3b3defeaecaa080c9cc4e76e84038ca08e12084f128eb