c2074e7e73c076707b2bd2723f3576cd2e9395de232b0c76c1857b0b6e01e96c

Analysis

max time kernel
117s
max time network
120s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
28-09-2024 02:53

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

FM4ffx.exe
Size

319KB
MD5

fe768a6b82ed2a59c58254eae67b8cf9
SHA1

3dad9bf5011fb73b9be2fe6c601bb6281a3ceaf6
SHA256

3ac3c700060a0487060724f3fd22faf70d5f633e69401641964d7ba4d6e6e570
SHA512

3d8caadc61ea127bd0e3d01f35274a2ebfa34a0ac12b0932988300d011347f74a09c2bf3c85e58bfbe5200288c6e6f100b4f08916d23e56d7b52a70130aad14b
SSDEEP

6144:Ve34G2ct7JdUwA2UL4iCPfAHfWpR+0BmiBEaiXLoyX:Et9BHjAupYMmyk7R

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Loads dropped DLL 64 IoCs

pid	Process
2644	FM4ffx.exe
2644	FM4ffx.exe
2644	FM4ffx.exe
2644	FM4ffx.exe
2644	FM4ffx.exe
2644	FM4ffx.exe
2644	FM4ffx.exe
2644	FM4ffx.exe
2644	FM4ffx.exe
2644	FM4ffx.exe
2644	FM4ffx.exe
2644	FM4ffx.exe
2644	FM4ffx.exe
2644	FM4ffx.exe
2644	FM4ffx.exe
2644	FM4ffx.exe
2644	FM4ffx.exe
2644	FM4ffx.exe
2644	FM4ffx.exe
2644	FM4ffx.exe
2644	FM4ffx.exe
2644	FM4ffx.exe
2644	FM4ffx.exe
2644	FM4ffx.exe
2644	FM4ffx.exe
2644	FM4ffx.exe
2644	FM4ffx.exe
2644	FM4ffx.exe
2644	FM4ffx.exe
2644	FM4ffx.exe
2644	FM4ffx.exe
2644	FM4ffx.exe
2644	FM4ffx.exe
2644	FM4ffx.exe
2644	FM4ffx.exe
2644	FM4ffx.exe
2644	FM4ffx.exe
2644	FM4ffx.exe
2644	FM4ffx.exe
2644	FM4ffx.exe
2644	FM4ffx.exe
2644	FM4ffx.exe
2644	FM4ffx.exe
2644	FM4ffx.exe
2644	FM4ffx.exe
2644	FM4ffx.exe
2644	FM4ffx.exe
2644	FM4ffx.exe
2644	FM4ffx.exe
2644	FM4ffx.exe
2644	FM4ffx.exe
2644	FM4ffx.exe
2644	FM4ffx.exe
2644	FM4ffx.exe
2644	FM4ffx.exe
2644	FM4ffx.exe
2644	FM4ffx.exe
2644	FM4ffx.exe
2644	FM4ffx.exe
2644	FM4ffx.exe
2644	FM4ffx.exe
2644	FM4ffx.exe
2644	FM4ffx.exe
2644	FM4ffx.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	FM4ffx.exe

C:\Users\Admin\AppData\Local\Temp\FM4ffx.exe
"C:\Users\Admin\AppData\Local\Temp\FM4ffx.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:2644

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\nsoF705.tmp

Filesize
718B

MD5
918a313c90f72dc3641319c325300aae

SHA1
5cc2c810a384db02ea82eea7374e9f5ccdb40429

SHA256
b61fb885eb5c347c7ae61d4c765bdf2af62a16eb8d4881caaff456acdebca53c

SHA512
dd8801f02ad1b97c343b9c221d7d7249dbb583b04e508ac8badcd5a705d8c7d1aa473e36a82f71f3820c81ec471f45f12078163442acc96d6058a7ff59caf5b2

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1009pdhg.Admin\user.js

Filesize
877B

MD5
9c6053e33fb9c0cb3f11a19e532b91c5

SHA1
772320669f42928ba3bc3ae9e501715fb1ae1a1f

SHA256
694de615c00dfd82f1911782a3ffbfa6da466d4a895350ccccd0ff2e2c5f8e37

SHA512
b66f497b4ea0041fb95b06d945cdaddfa51a25a68f5610d9084d4735a93057931b03cc6bb71fcfe35fd829b6e06dfd1a5f76611f7106c74e26f4bede6d004b0c

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1009pdhg.Admin\user.js

Filesize
979B

MD5
162c8d0456619c7c6d14496202087f87

SHA1
760696b10e47d6e6593b246faf7913bc5566030e

SHA256
cc8f74269e439f554dbcd5cc1b30f6a5a27286cc3898b7f75f76e72bb7e4b1bd

SHA512
fd747dec2d8f54a8c43088e7e7071f4be47837c71c4e9cf3deb8c8cb1d397f57c0f692e061adc28bcc016a89cd094c364dcb354f33dc71fe514fb66ade85b8d5

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\1009pdhg.Admin\user.js

Filesize
1KB

MD5
b13b7436fc16ea4ff303fa7c9eb6e6f0

SHA1
87232f352ace763569ae44250582dcbe71a665c8

SHA256
47b8bc4c156093329a0269bf24ead9861c9ee6433ee929f8e7e9647a7cb5a589

SHA512
b62506c56eb423cbe16fc161c2cd0a10d8da2868429d1b37abe196dd7a1e621381653186855eddb0ecdef83c032102e347a5b159c7faab44fda7d15404d2ee4d

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4k8o8gx5.default-release\user.js

Filesize
778B

MD5
87b79da8d5b75dce1795a850de20800c

SHA1
0beb63f073e191a293e585acc163dbdcf3413605

SHA256
d2aa492920396519f74b1338654ab5b7094819ba645ac7417468064e6cb9edd1

SHA512
420b64f9f4580c2d7749976243215aea85189329e5111459663b290b09be9e36aa97d15a676c7ec2ebf8426604cb6073052a93e082f0f1960501eb68057572f4

Download Submit
\Users\Admin\AppData\Local\Temp\nsjF690.tmp\System.dll

Filesize
11KB

MD5
c17103ae9072a06da581dec998343fc1

SHA1
b72148c6bdfaada8b8c3f950e610ee7cf1da1f8d

SHA256
dc58d8ad81cacb0c1ed72e33bff8f23ea40b5252b5bb55d393a0903e6819ae2f

SHA512
d32a71aaef18e993f28096d536e41c4d016850721b31171513ce28bbd805a54fd290b7c3e9d935f72e676a1acfb4f0dcc89d95040a0dd29f2b6975855c18986f

Download Submit
\Users\Admin\AppData\Local\Temp\nsjF690.tmp\Time.dll

Filesize
10KB

MD5
38977533750fe69979b2c2ac801f96e6

SHA1
74643c30cda909e649722ed0c7f267903558e92a

SHA256
b4a95a455e53372c59f91bc1b5fb9e5c8e4a10a506fa04aaf7be27048b30ae35

SHA512
e17069395ad4a17e24f7cd3c532670d40244bd5ae3887c82e3b2e4a68c250cd55e2d8b329d6ff0e2d758955ab7470534e6307779e49fe331c1fd2242ea73fd53

Download Submit
\Users\Admin\AppData\Local\Temp\nsjF690.tmp\mt.dll

Filesize
5KB

MD5
aac69f856c4540edd4ef7ce6c8571639

SHA1
2860f55ea9774d631219e66604051e90a43258b7

SHA256
6dc2644a389feeef9e0ac65e2c8b01fc18ca6e53b253f10efffcb117e0a852dd

SHA512
ebacc8117c44d298ae519705510285c576932761b3c7b697eeb91cb7620150ebe551102d1ab83d68f4c78e1496b191a55ad8f78c491f5b4af456c4de6ad72dcd

Download Submit
\Users\Admin\AppData\Local\Temp\nsjF690.tmp\nsisos.dll

Filesize
5KB

MD5
69806691d649ef1c8703fd9e29231d44

SHA1
e2193fcf5b4863605eec2a5eb17bf84c7ac00166

SHA256
ba79ab7f63f02ed5d5d46b82b11d97dac5b7ef7e9b9a4df926b43ceac18483b6

SHA512
5e5e0319e701d15134a01cb6472c624e271e99891058aef4dfe779c29c73899771a5b6f8b1cd61b543a3b3defeaecaa080c9cc4e76e84038ca08e12084f128eb

Download Submit