Overview

overview

7

Static

static

7

JaffaCakes...48.exe

windows7-x64

7

JaffaCakes...48.exe

windows10-2004-x64

7

$LOCALAPPD...ds.exe

windows7-x64

7

$LOCALAPPD...ds.exe

windows10-2004-x64

7

$PLUGINSDI...Ex.dll

windows7-x64

3

$PLUGINSDI...Ex.dll

windows10-2004-x64

3

$PLUGINSDI...ns.dll

windows7-x64

3

$PLUGINSDI...ns.dll

windows10-2004-x64

3

$PLUGINSDI...ad.dll

windows7-x64

3

$PLUGINSDI...ad.dll

windows10-2004-x64

3

$PLUGINSDI...dl.dll

windows7-x64

3

$PLUGINSDI...dl.dll

windows10-2004-x64

3

$PLUGINSDI...es.dll

windows7-x64

3

$PLUGINSDI...es.dll

windows10-2004-x64

3

$PLUGINSDI...em.dll

windows7-x64

3

$PLUGINSDI...em.dll

windows10-2004-x64

3

$PLUGINSDIR/Time.dll

windows7-x64

3

$PLUGINSDIR/Time.dll

windows10-2004-x64

3

$PLUGINSDI...fo.dll

windows7-x64

3

$PLUGINSDI...fo.dll

windows10-2004-x64

3

$PLUGINSDI...ef.dll

windows7-x64

3

$PLUGINSDI...ef.dll

windows10-2004-x64

3

$PLUGINSDIR/mt.dll

windows7-x64

3

$PLUGINSDIR/mt.dll

windows10-2004-x64

3

$PLUGINSDI...os.dll

windows7-x64

3

$PLUGINSDI...os.dll

windows10-2004-x64

3

FM4ffx.exe

windows7-x64

7

FM4ffx.exe

windows10-2004-x64

7

$PLUGINSDI...dl.dll

windows7-x64

3

$PLUGINSDI...dl.dll

windows10-2004-x64

3

$PLUGINSDI...em.dll

windows7-x64

3

$PLUGINSDI...em.dll

windows10-2004-x64

3

Analysis

  • max time kernel
    93s
  • max time network
    143s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    19/01/2025, 10:15

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    $LOCALAPPDATA/funmoods.exe
  • Size 1.6MB
  • Sample250119-maf42strgj
  • SHA256 73db5f6b89963d6692e3c43c8f3e5265ec4512ce87fe652e9ec3a4a0bb036db8
  • MD5 SHA1 SHA512 SSDEEP
Score
7/10
adwarediscoveryspywarestealer

Malware Config

Signatures

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 3 IoCs
  • Loads dropped DLL 64 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Installs/modifies Browser Helper Object 2 TTPs 4 IoCs

    BHOs are DLL modules which act as plugins for Internet Explorer.

    stealeradware
  • Drops file in Program Files directory 7 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • NSIS installer 4 IoCs
    installer
  • Modifies Internet Explorer settings 1 TTPs 6 IoCs
    adwarespyware
  • Modifies registry class 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 10 IoCs
  • Suspicious use of WriteProcessMemory 9 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\$LOCALAPPDATA\funmoods.exe
    "C:\Users\Admin\AppData\Local\Temp\$LOCALAPPDATA\funmoods.exe"
    1⤵
    • Checks computer location settings
    • Loads dropped DLL
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:4272
    • C:\Users\Admin\AppData\Local\Temp\FNMD\FM\1.5.11.16\FM4ie.exe
      "C:\Users\Admin\AppData\Local\Temp\FNMD\FM\1.5.11.16\FM4ie.exe"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Installs/modifies Browser Helper Object
      • Drops file in Program Files directory
      • System Location Discovery: System Language Discovery
      • Modifies Internet Explorer settings
      • Modifies registry class
      • Suspicious use of WriteProcessMemory
      PID:3320
      • C:\Program Files (x86)\Funmoods\funmoods\1.5.11.16\funmoodssrv.exe
        "C:\Program Files (x86)\Funmoods\funmoods\1.5.11.16\funmoodssrv.exe" /RegServer
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Modifies registry class
        PID:3180
    • C:\Users\Admin\AppData\Local\Temp\FNMD\FM\1.5.11.16\FM4ffx.exe
      C:\Users\Admin\AppData\Local\Temp\FNMD\FM\1.5.11.16\FM4ffx.exe
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      PID:1828

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        funmoods.dll
        • Path C:\Program Files (x86)\Funmoods\funmoods\1.5.11.16\bh\funmoods.dll
        • Size 236KB
        • SHA256 ba6870cd06e5700f918c30ee92391d8a77c99b3fda06372c42b35983ee88253c
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        funmoodsApp.dll
        • Path C:\Program Files (x86)\Funmoods\funmoods\1.5.11.16\funmoodsApp.dll
        • Size 329KB
        • SHA256 e4b3df5ead761fe83da367d5e2ae1d416d0f89a572480deecc20c4b4295f17eb
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        funmoodsEng.dll
        • Path C:\Program Files (x86)\Funmoods\funmoods\1.5.11.16\funmoodsEng.dll
        • Size 535KB
        • SHA256 3d1b55bbb46e5788ca3e8ce68e515f52bdf63c0f53ceaad7236964eedf97f281
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        funmoodsTlbr.dll
        • Path C:\Program Files (x86)\Funmoods\funmoods\1.5.11.16\funmoodsTlbr.dll
        • Size 245KB
        • SHA256 b1fa4dacf9656e31588eebeca1f831c72a33d9affca07ede0d5f5d113ec14aaf
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        funmoodssrv.exe
        • Path C:\Program Files (x86)\Funmoods\funmoods\1.5.11.16\funmoodssrv.exe
        • Size 398KB
        • SHA256 93587b81f4e717b25a6e5fd2fb7158d7fb825f79af1c02ed0a61d5de15b6327b
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        FM4ffx.exe
        • Path C:\Users\Admin\AppData\Local\Temp\FNMD\FM\1.5.11.16\FM4ffx.exe
        • Size 319KB
        • SHA256 3ac3c700060a0487060724f3fd22faf70d5f633e69401641964d7ba4d6e6e570
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        FM4ie.exe
        • Path C:\Users\Admin\AppData\Local\Temp\FNMD\FM\1.5.11.16\FM4ie.exe
        • Size 1.1MB
        • SHA256 abcde03656f4c6f51d4d4c788ece555581b8c7b52bfe1c18ef70678cb3a2e872
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        nshFCD8.tmp
        • Path C:\Users\Admin\AppData\Local\Temp\FNMD\FM\1.5.11.16\nshFCD8.tmp
        • Size 770B
        • SHA256 cc2afb8699bd1a7c7c4e51abbe49bc1a4dca114773f3145593322fbe12606b5d
        • MD5 SHA1 SHA512
        Submit Download

        nsrFD19.tmp
        • Path C:\Users\Admin\AppData\Local\Temp\FNMD\FM\1.5.11.16\nsrFD19.tmp
        • Size 929B
        • SHA256 e720f4523171da15edfd4cb00e80c6cea3d79dd93a2e3439c6dc6c97499ff4a7
        • MD5 SHA1 SHA512
        Submit Download

        nssFFE8.tmp
        • Path C:\Users\Admin\AppData\Local\Temp\FNMD\FM\1.5.11.16\nssFFE8.tmp
        • Size 781B
        • SHA256 cf83a951959eea99b9ff530f1bbbe77300301b55b82ea92534e40b250a59f227
        • MD5 SHA1 SHA512
        Submit Download

        nssFFE9.tmp
        • Path C:\Users\Admin\AppData\Local\Temp\FNMD\FM\1.5.11.16\nssFFE9.tmp
        • Size 830B
        • SHA256 87b2ecb982f1d005579a8eba0decdb163f9bbbb74873b6dac1b06d7c66b2e8d0
        • MD5 SHA1 SHA512
        Submit Download

        nswFCE8.tmp
        • Path C:\Users\Admin\AppData\Local\Temp\FNMD\FM\1.5.11.16\nswFCE8.tmp
        • Size 825B
        • SHA256 a1dd0c560e181f4a481e22f4518e9b6a4c0e5da2659c748cfd4a0a3c866e00ea
        • MD5 SHA1 SHA512
        Submit Download

        ExtractDLLEx.dll
        • Path C:\Users\Admin\AppData\Local\Temp\nszF7CE.tmp\ExtractDLLEx.dll
        • Size 7KB
        • SHA256 73acba7dd477dfd6cf4249911f4e3c781196c7cf6b28425761dcb2d4f90c36c5
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        InetLoad.dll
        • Path C:\Users\Admin\AppData\Local\Temp\nszF7CE.tmp\InetLoad.dll
        • Size 18KB
        • SHA256 bf01a1f272e0daf82df3407690b646e0ff6b2c562e36e47cf177eda71ccb6f6c
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        NSISdl.dll
        • Path C:\Users\Admin\AppData\Local\Temp\nszF7CE.tmp\NSISdl.dll
        • Size 14KB
        • SHA256 dacc88a12d3ba438fdae3535dc7a5a1d389bce13adc993706424874a782e51c9
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        Processes.dll
        • Path C:\Users\Admin\AppData\Local\Temp\nszF7CE.tmp\Processes.dll
        • Size 56KB
        • SHA256 3b5388e13dab53d53e08791f492ed7d3094a0cee51e9841af83ce02534e0621c
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        System.dll
        • Path C:\Users\Admin\AppData\Local\Temp\nszF7CE.tmp\System.dll
        • Size 11KB
        • SHA256 dc58d8ad81cacb0c1ed72e33bff8f23ea40b5252b5bb55d393a0903e6819ae2f
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        Time.dll
        • Path C:\Users\Admin\AppData\Local\Temp\nszF7CE.tmp\Time.dll
        • Size 10KB
        • SHA256 b4a95a455e53372c59f91bc1b5fb9e5c8e4a10a506fa04aaf7be27048b30ae35
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        UserInfo.dll
        • Path C:\Users\Admin\AppData\Local\Temp\nszF7CE.tmp\UserInfo.dll
        • Size 4KB
        • SHA256 564c80dec62d76c53497c40094db360ff8a36e0dc1bda8383d0f9583138997f5
        • MD5 SHA1 SHA512
        Submit Download

        chrmPref.dll
        • Path C:\Users\Admin\AppData\Local\Temp\nszF7CE.tmp\chrmPref.dll
        • Size 194KB
        • SHA256 c9ccc486c3353bad0d2819a42203c0db7ba98b4826b6a2b8d4deee832e4d3d8e
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        mt.dll
        • Path C:\Users\Admin\AppData\Local\Temp\nszF7CE.tmp\mt.dll
        • Size 5KB
        • SHA256 6dc2644a389feeef9e0ac65e2c8b01fc18ca6e53b253f10efffcb117e0a852dd
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        nsisos.dll
        • Path C:\Users\Admin\AppData\Local\Temp\nszF7CE.tmp\nsisos.dll
        • Size 5KB
        • SHA256 ba79ab7f63f02ed5d5d46b82b11d97dac5b7ef7e9b9a4df926b43ceac18483b6
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        user.js
        • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\dxh7hykm.Admin\user.js
        • Size 301B
        • SHA256 0eebe6ecb1c7f74a5175dd6aef7ea4a605741a54104f26b08f29ed0b763ae7db
        • MD5 SHA1 SHA512
        Submit Download

        user.js
        • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\dxh7hykm.Admin\user.js
        • Size 1KB
        • SHA256 e08d8c628c43109c105e5636cf2fd83cdb98c2c87cf71586fd89f3e9209edf51
        • MD5 SHA1 SHA512
        Submit Download

        user.js
        • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\dxh7hykm.Admin\user.js
        • Size 981B
        • SHA256 1d995d63e87a9c7dbb52bb0d9af5595f449c0f186443cd4e38d8ef94d0453894
        • MD5 SHA1 SHA512
        Submit Download

        user.js
        • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\g9per00b.default-release\user.js
        • Size 882B
        • SHA256 18f55d8b3174e09eeb3b445cb3cae35b8c54b0aecd7d3072e8bb05c6e633a050
        • MD5 SHA1 SHA512
        Submit Download

        memory/4272-84-0x0000000002430000-0x0000000002442000-memory.dmp
        Download

        memory/4272-1600-0x0000000003B50000-0x0000000003B62000-memory.dmp
        Download