36afc75ad063a08c2fbe7a9bba2475595eddbf3c0e7b1f6dd9a24443ce78ff2c

Analysis

max time kernel
117s
max time network
118s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
25/08/2024, 18:45

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

FM4ffx.exe
Size

319KB
MD5

fe768a6b82ed2a59c58254eae67b8cf9
SHA1

3dad9bf5011fb73b9be2fe6c601bb6281a3ceaf6
SHA256

3ac3c700060a0487060724f3fd22faf70d5f633e69401641964d7ba4d6e6e570
SHA512

3d8caadc61ea127bd0e3d01f35274a2ebfa34a0ac12b0932988300d011347f74a09c2bf3c85e58bfbe5200288c6e6f100b4f08916d23e56d7b52a70130aad14b
SSDEEP

6144:Ve34G2ct7JdUwA2UL4iCPfAHfWpR+0BmiBEaiXLoyX:Et9BHjAupYMmyk7R

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Loads dropped DLL 64 IoCs

pid	Process
1944	FM4ffx.exe
1944	FM4ffx.exe
1944	FM4ffx.exe
1944	FM4ffx.exe
1944	FM4ffx.exe
1944	FM4ffx.exe
1944	FM4ffx.exe
1944	FM4ffx.exe
1944	FM4ffx.exe
1944	FM4ffx.exe
1944	FM4ffx.exe
1944	FM4ffx.exe
1944	FM4ffx.exe
1944	FM4ffx.exe
1944	FM4ffx.exe
1944	FM4ffx.exe
1944	FM4ffx.exe
1944	FM4ffx.exe
1944	FM4ffx.exe
1944	FM4ffx.exe
1944	FM4ffx.exe
1944	FM4ffx.exe
1944	FM4ffx.exe
1944	FM4ffx.exe
1944	FM4ffx.exe
1944	FM4ffx.exe
1944	FM4ffx.exe
1944	FM4ffx.exe
1944	FM4ffx.exe
1944	FM4ffx.exe
1944	FM4ffx.exe
1944	FM4ffx.exe
1944	FM4ffx.exe
1944	FM4ffx.exe
1944	FM4ffx.exe
1944	FM4ffx.exe
1944	FM4ffx.exe
1944	FM4ffx.exe
1944	FM4ffx.exe
1944	FM4ffx.exe
1944	FM4ffx.exe
1944	FM4ffx.exe
1944	FM4ffx.exe
1944	FM4ffx.exe
1944	FM4ffx.exe
1944	FM4ffx.exe
1944	FM4ffx.exe
1944	FM4ffx.exe
1944	FM4ffx.exe
1944	FM4ffx.exe
1944	FM4ffx.exe
1944	FM4ffx.exe
1944	FM4ffx.exe
1944	FM4ffx.exe
1944	FM4ffx.exe
1944	FM4ffx.exe
1944	FM4ffx.exe
1944	FM4ffx.exe
1944	FM4ffx.exe
1944	FM4ffx.exe
1944	FM4ffx.exe
1944	FM4ffx.exe
1944	FM4ffx.exe
1944	FM4ffx.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	FM4ffx.exe

C:\Users\Admin\AppData\Local\Temp\FM4ffx.exe
"C:\Users\Admin\AppData\Local\Temp\FM4ffx.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:1944

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\nsjE1E8.tmp

Filesize
181B

MD5
cdd33c24da229ece38c4f4bafafb8f74

SHA1
d8b5261a9a1431fc8a2ad5a7b9ab4dc8bce2ce9b

SHA256
c9ecf40aae794b4ec66d5dff1a5dcaee54159c8656d80a7309d6296d4ab5c471

SHA512
6c8f40f1c95c64570c27e4f16f5206402e6e8a932cbff2a2288c822f2e29380104932645a1b513595c74f994417a929afac4637f0c4ca54401cdc129c82770d3

Download Submit
C:\Users\Admin\AppData\Local\Temp\nstE131.tmp

Filesize
541B

MD5
5b2cccc9df7aab0da9e20b33821ade90

SHA1
23f9902f9c375bde624dae979cb49ea4d0196c61

SHA256
c32fabe9bb3e9bbf09259f1b7f2986679455924800a559a6fb38384edb367868

SHA512
f13cfd1b24c11a997846820da2071ee386a2597839dc7c41c78acb82fe763a2e69c2a021defbbd0777a2efb131481db8830f3ec622d2195fa017dd200b49ea3a

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsyE156.tmp

Filesize
878B

MD5
3a986358ee462e53f740ec1fd11d6a2d

SHA1
734c7a6dab319c91164e4ce44d810cefdf731765

SHA256
eec5a156dd61336b619e9ef820a123a863273a09f0f3f55a6962fc3e8e5d7c94

SHA512
f14d56b975620b248bb8919a5e789eb29e01804eaa77123a84d44ca9bb605939f57ad7d532759615438cace3c49313c5996dff6e2e9b440ee6e6a0e4d9c8e5cd

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\i7f18jmm.Admin\user.js

Filesize
1KB

MD5
cc8aaa26efc13af4cc20fcb01d1ca7f2

SHA1
c8a84695a3e6aedabd0ce10350d6fdee218ff948

SHA256
9471b143b9d340e191640722e39fe4e44643115e34f430320846433e8b711590

SHA512
99cf983e56a917dc50350f3424e924075ea5b924602330c938c02ed004a46e38043dab41b86b0a33bce1e1bf5732daf210179d11454375ebf81025e17bd17953

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\i7f18jmm.default-release\user.js

Filesize
831B

MD5
61f342a7a6373bdaa01eafa9aee0dd01

SHA1
1aafd56bf4f048d57a11104bffdddadf318218f0

SHA256
9c139cc295a9deb436f2aeb0d6cf8134064391a168baf0389a8048ff77837af4

SHA512
7e1ef62021657cf879a19b048f7304dcc783ed401c67c8ace2b8624a9d2ada680ef59958cf69d92f21a6335d79289b6780da73a7383e76486790097981ab734b

Download Submit
\Users\Admin\AppData\Local\Temp\nsoE0BF.tmp\System.dll

Filesize
11KB

MD5
c17103ae9072a06da581dec998343fc1

SHA1
b72148c6bdfaada8b8c3f950e610ee7cf1da1f8d

SHA256
dc58d8ad81cacb0c1ed72e33bff8f23ea40b5252b5bb55d393a0903e6819ae2f

SHA512
d32a71aaef18e993f28096d536e41c4d016850721b31171513ce28bbd805a54fd290b7c3e9d935f72e676a1acfb4f0dcc89d95040a0dd29f2b6975855c18986f

Download Submit
\Users\Admin\AppData\Local\Temp\nsoE0BF.tmp\Time.dll

Filesize
10KB

MD5
38977533750fe69979b2c2ac801f96e6

SHA1
74643c30cda909e649722ed0c7f267903558e92a

SHA256
b4a95a455e53372c59f91bc1b5fb9e5c8e4a10a506fa04aaf7be27048b30ae35

SHA512
e17069395ad4a17e24f7cd3c532670d40244bd5ae3887c82e3b2e4a68c250cd55e2d8b329d6ff0e2d758955ab7470534e6307779e49fe331c1fd2242ea73fd53

Download Submit
\Users\Admin\AppData\Local\Temp\nsoE0BF.tmp\mt.dll

Filesize
5KB

MD5
aac69f856c4540edd4ef7ce6c8571639

SHA1
2860f55ea9774d631219e66604051e90a43258b7

SHA256
6dc2644a389feeef9e0ac65e2c8b01fc18ca6e53b253f10efffcb117e0a852dd

SHA512
ebacc8117c44d298ae519705510285c576932761b3c7b697eeb91cb7620150ebe551102d1ab83d68f4c78e1496b191a55ad8f78c491f5b4af456c4de6ad72dcd

Download Submit
\Users\Admin\AppData\Local\Temp\nsoE0BF.tmp\nsisos.dll

Filesize
5KB

MD5
69806691d649ef1c8703fd9e29231d44

SHA1
e2193fcf5b4863605eec2a5eb17bf84c7ac00166

SHA256
ba79ab7f63f02ed5d5d46b82b11d97dac5b7ef7e9b9a4df926b43ceac18483b6

SHA512
5e5e0319e701d15134a01cb6472c624e271e99891058aef4dfe779c29c73899771a5b6f8b1cd61b543a3b3defeaecaa080c9cc4e76e84038ca08e12084f128eb

Download Submit