Analysis
- max time kernel
149s - max time network
142s - platform
windows10-2004_x64 - resource
win10v2004-20251211-en - resource tags
- submitted
16/12/2025, 04:41
General
- Target 79ee44e4a98e4eca37e01189bc4364de652df82532dcb1181796028108910738.exe
- Size 5.6MB
- Sample251216-fa5zvae19e
- SHA256 79ee44e4a98e4eca37e01189bc4364de652df82532dcb1181796028108910738
Malware Config
Extracted
-
ffdroider
-
http://111.90.158.95
Signatures
- FFDroider
Stealer targeting social media platform users first seen in April 2022.
- FFDroider payload 1 IoCs
- Ffdroider family
- Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Checks whether UAC is enabled 1 TTPs 1 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\79ee44e4a98e4eca37e01189bc4364de652df82532dcb1181796028108910738.exe"C:\Users\Admin\AppData\Local\Temp\79ee44e4a98e4eca37e01189bc4364de652df82532dcb1181796028108910738.exe"1⤵
- Checks whether UAC is enabled
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
d
d.jfm
d.jfm
d.jfm
d.jfm
d.jfm
d.jfm
d.jfm
d.jfm
d.jfm
d.jfm
d.jfm
d.jfm
d.jfm
memory/4480-125-0x0000000004C50000-0x0000000004C58000-memory.dmp
memory/4480-162-0x0000000004970000-0x0000000004978000-memory.dmp
memory/4480-27-0x0000000004F20000-0x0000000004F28000-memory.dmp
memory/4480-40-0x0000000004A90000-0x0000000004A98000-memory.dmp
memory/4480-48-0x0000000004F20000-0x0000000004F28000-memory.dmp
memory/4480-50-0x0000000005050000-0x0000000005058000-memory.dmp
memory/4480-63-0x0000000004A90000-0x0000000004A98000-memory.dmp
memory/4480-71-0x0000000005050000-0x0000000005058000-memory.dmp
memory/4480-25-0x00000000051C0000-0x00000000051C8000-memory.dmp
memory/4480-73-0x0000000004F20000-0x0000000004F28000-memory.dmp
memory/4480-111-0x0000000004950000-0x0000000004958000-memory.dmp
memory/4480-112-0x0000000004970000-0x0000000004978000-memory.dmp
memory/4480-119-0x0000000004A10000-0x0000000004A18000-memory.dmp
memory/4480-122-0x0000000004A20000-0x0000000004A28000-memory.dmp
memory/4480-123-0x0000000004BA0000-0x0000000004BA8000-memory.dmp
memory/4480-124-0x0000000004C40000-0x0000000004C48000-memory.dmp
memory/4480-24-0x0000000004C90000-0x0000000004C98000-memory.dmp
memory/4480-126-0x0000000004BB0000-0x0000000004BB8000-memory.dmp
memory/4480-23-0x0000000004C70000-0x0000000004C78000-memory.dmp
memory/4480-139-0x0000000004970000-0x0000000004978000-memory.dmp
memory/4480-147-0x0000000004BB0000-0x0000000004BB8000-memory.dmp
memory/4480-149-0x0000000004BE0000-0x0000000004BE8000-memory.dmp
memory/4480-20-0x0000000004B30000-0x0000000004B38000-memory.dmp
memory/4480-26-0x00000000050C0000-0x00000000050C8000-memory.dmp
memory/4480-170-0x0000000004BE0000-0x0000000004BE8000-memory.dmp
memory/4480-172-0x0000000004BB0000-0x0000000004BB8000-memory.dmp
memory/4480-18-0x0000000004A90000-0x0000000004A98000-memory.dmp
memory/4480-210-0x0000000004950000-0x0000000004958000-memory.dmp
memory/4480-211-0x0000000004970000-0x0000000004978000-memory.dmp
memory/4480-218-0x0000000004A10000-0x0000000004A18000-memory.dmp
memory/4480-221-0x0000000004A10000-0x0000000004A18000-memory.dmp
memory/4480-222-0x0000000004B90000-0x0000000004B98000-memory.dmp
memory/4480-223-0x0000000004C40000-0x0000000004C48000-memory.dmp
memory/4480-224-0x0000000004C50000-0x0000000004C58000-memory.dmp
memory/4480-225-0x0000000004BB0000-0x0000000004BB8000-memory.dmp
memory/4480-17-0x0000000004A70000-0x0000000004A78000-memory.dmp
memory/4480-238-0x0000000004970000-0x0000000004978000-memory.dmp
memory/4480-10-0x0000000003F90000-0x0000000003FA0000-memory.dmp
memory/4480-246-0x0000000004BB0000-0x0000000004BB8000-memory.dmp
memory/4480-248-0x0000000004BE0000-0x0000000004BE8000-memory.dmp
memory/4480-4-0x0000000003DF0000-0x0000000003E00000-memory.dmp
memory/4480-261-0x0000000004970000-0x0000000004978000-memory.dmp
memory/4480-0-0x0000000000220000-0x00000000007B7000-memory.dmp
memory/4480-269-0x0000000004BE0000-0x0000000004BE8000-memory.dmp
memory/4480-271-0x0000000004BB0000-0x0000000004BB8000-memory.dmp
memory/4480-1-0x00000000001D0000-0x00000000001D3000-memory.dmp
memory/4480-295-0x0000000000220000-0x00000000007B7000-memory.dmp