Analysis

  • max time kernel
    119s
  • max time network
    120s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    15/01/2025, 21:58

General

  • Target

    FM4ffx.exe

  • Size

    319KB

  • MD5

    fe768a6b82ed2a59c58254eae67b8cf9

  • SHA1

    3dad9bf5011fb73b9be2fe6c601bb6281a3ceaf6

  • SHA256

    3ac3c700060a0487060724f3fd22faf70d5f633e69401641964d7ba4d6e6e570

  • SHA512

    3d8caadc61ea127bd0e3d01f35274a2ebfa34a0ac12b0932988300d011347f74a09c2bf3c85e58bfbe5200288c6e6f100b4f08916d23e56d7b52a70130aad14b

  • SSDEEP

    6144:Ve34G2ct7JdUwA2UL4iCPfAHfWpR+0BmiBEaiXLoyX:Et9BHjAupYMmyk7R

Malware Config

Signatures

  • Loads dropped DLL 64 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

Processes

  • C:\Users\Admin\AppData\Local\Temp\FM4ffx.exe
    "C:\Users\Admin\AppData\Local\Temp\FM4ffx.exe"
    1⤵
    • Loads dropped DLL
    • System Location Discovery: System Language Discovery
    PID:1508

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\Local\Temp\nseE571.tmp

          Filesize

          181B

          MD5

          1a7a3b52353b537bbbf25cf0cf709951

          SHA1

          9a14fd2d6df7dbff429efa831bf7f0cd7883da65

          SHA256

          2a2352944453ffd7aa99669dd91beee870aa8ed6447bdbf154c309eb15b1b88e

          SHA512

          2ec6aa8f407b77652583909a00cae8b610284196ea6d15bc4f154ec2592abad03a9e34e2f3b89ba2fb6c4dc934f8f803d626c44e2e50104ec2cdcece77985616

        • C:\Users\Admin\AppData\Local\Temp\nsoE4BB.tmp

          Filesize

          597B

          MD5

          4d9ca359d2433d722459f4c04535390e

          SHA1

          9f228f3525d5b49889cfa9039e4628c1b9b93ebd

          SHA256

          075e0e547d11df00c9c1c3979549a042cf4d8b2431d40ae8d96f7b080e4f5038

          SHA512

          445de25d936fa35c869424dc6f09fb92967806ece3952989eb231c9c5e50595719fcc3dd7f033daacceac96a90124f23399ce69d13c71cc9d9554d928effc547

        • C:\Users\Admin\AppData\Local\Temp\nstE4DE.tmp

          Filesize

          825B

          MD5

          5934ad41b31ab2a73fe56d4fd206c4e7

          SHA1

          71dd06c0e1259cf373f660d1ff63d02b1efb16b5

          SHA256

          411ab50f95d211810b919d7be759de73430231a84f7af57c88cd6ad77087e2c7

          SHA512

          4b08a604004f285d8e90a427aa8dec1c6c1527135bbd478f784f6fd26cb36188843cf75f71bd336ebf9562380888e6b30608f090b3eba3ad4b100647ccc8a1a7

        • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\o97f221x.Admin\user.js

          Filesize

          1KB

          MD5

          b7c8d66fa734c9b791a0bd1d5c8672a1

          SHA1

          3dcd68ebe76bacee206549de181dc1ea31698616

          SHA256

          519e094f11444030b74edfce59a981a620ea9023f41099ceadcd8fea4f1d0fdf

          SHA512

          dc3ff69add26e8403a0a4fa4a6390cc289a9ee660aba31cbd7a26f3b01820c2029538085aee7cf091335076d73d091be52a34e61dce7b052aef7a680ab3a4397

        • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\o97f221x.default-release\user.js

          Filesize

          831B

          MD5

          f70d70cdac652e0591079898fb9a1e88

          SHA1

          0915c42098be407bb39a47eee31490bfd49983c9

          SHA256

          2c372507c81cc723c6618ba77c1c6a43d9ae38c5f200ed27d0b821c660fb399c

          SHA512

          7ba585348f2964a22eaf513049ad5d08eca8b83ff056f403e10e2e114533f9e4cc799409d168bf6d750d8bbe0ed8b67d287753eb51c9e2a57c482f1b7f353aaf

        • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\o97f221x.default-release\user.js

          Filesize

          412B

          MD5

          202b8785e686d1b7dd7e5f7f6c9d601c

          SHA1

          a9b76c74dc7f5b16de8125f93e9a442ea175507c

          SHA256

          9fc8cdaf6d081c1abda07b1ad11a8f1d6df0177bf037054db33a422ff6127cd3

          SHA512

          94ddf0628b6c9029fc7ef3758f20e1efa445ed250c970b240d8d54fd7156721dc744f2aac8019b14d2d93caf0c33b00d5332317f07ef16c414d8ee336483664f

        • \Users\Admin\AppData\Local\Temp\nsyE457.tmp\System.dll

          Filesize

          11KB

          MD5

          c17103ae9072a06da581dec998343fc1

          SHA1

          b72148c6bdfaada8b8c3f950e610ee7cf1da1f8d

          SHA256

          dc58d8ad81cacb0c1ed72e33bff8f23ea40b5252b5bb55d393a0903e6819ae2f

          SHA512

          d32a71aaef18e993f28096d536e41c4d016850721b31171513ce28bbd805a54fd290b7c3e9d935f72e676a1acfb4f0dcc89d95040a0dd29f2b6975855c18986f

        • \Users\Admin\AppData\Local\Temp\nsyE457.tmp\Time.dll

          Filesize

          10KB

          MD5

          38977533750fe69979b2c2ac801f96e6

          SHA1

          74643c30cda909e649722ed0c7f267903558e92a

          SHA256

          b4a95a455e53372c59f91bc1b5fb9e5c8e4a10a506fa04aaf7be27048b30ae35

          SHA512

          e17069395ad4a17e24f7cd3c532670d40244bd5ae3887c82e3b2e4a68c250cd55e2d8b329d6ff0e2d758955ab7470534e6307779e49fe331c1fd2242ea73fd53

        • \Users\Admin\AppData\Local\Temp\nsyE457.tmp\mt.dll

          Filesize

          5KB

          MD5

          aac69f856c4540edd4ef7ce6c8571639

          SHA1

          2860f55ea9774d631219e66604051e90a43258b7

          SHA256

          6dc2644a389feeef9e0ac65e2c8b01fc18ca6e53b253f10efffcb117e0a852dd

          SHA512

          ebacc8117c44d298ae519705510285c576932761b3c7b697eeb91cb7620150ebe551102d1ab83d68f4c78e1496b191a55ad8f78c491f5b4af456c4de6ad72dcd

        • \Users\Admin\AppData\Local\Temp\nsyE457.tmp\nsisos.dll

          Filesize

          5KB

          MD5

          69806691d649ef1c8703fd9e29231d44

          SHA1

          e2193fcf5b4863605eec2a5eb17bf84c7ac00166

          SHA256

          ba79ab7f63f02ed5d5d46b82b11d97dac5b7ef7e9b9a4df926b43ceac18483b6

          SHA512

          5e5e0319e701d15134a01cb6472c624e271e99891058aef4dfe779c29c73899771a5b6f8b1cd61b543a3b3defeaecaa080c9cc4e76e84038ca08e12084f128eb