Overview

overview

8

Static

static

8

FateInjector.exe

windows7_x64

1

FateInjector.exe

windows10_x64

1

Ambrosial ...21.exe

windows7_x64

8

Ambrosial ...21.exe

windows10_x64

8

Ambrosial.exe

windows7_x64

4

Ambrosial.exe

windows10_x64

7

Release_Ve...on.dll

windows7_x64

1

Release_Ve...on.dll

windows10_x64

3

BadManPublic.dll

windows7_x64

1

BadManPublic.dll

windows10_x64

1

HorionInjector.exe

windows7_x64

8

HorionInjector.exe

windows10_x64

8

MetroSet UI.dll

windows7_x64

1

MetroSet UI.dll

windows10_x64

1

Newtonsoft.Json.dll

windows7_x64

1

Newtonsoft.Json.dll

windows10_x64

1

System.Run...fe.dll

windows7_x64

1

System.Run...fe.dll

windows10_x64

1

ure tyjk5_...]_.exe

windows7_x64

1

ure tyjk5_...]_.exe

windows10_x64

1

Coffee (1).exe

windows7_x64

1

Coffee (1).exe

windows10_x64

1

Coffee 1.16.220.exe

windows7_x64

1

Coffee 1.16.220.exe

windows10_x64

1

Coffee NOT...ON.exe

windows7_x64

1

Coffee NOT...ON.exe

windows10_x64

1

Fate.Client.dll

windows7_x64

3

Fate.Client.dll

windows10_x64

3

FateInjector.exe

windows7_x64

1

FateInjector.exe

windows10_x64

1

Fate.Client.dll

windows7_x64

3

Fate.Client.dll

windows10_x64

1

Analysis

  • max time kernel
    167s
  • max time network
    172s
  • platform
    windows10_x64
  • resource
    win10-en-20211104
  • submitted
    17-11-2021 16:43

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    HorionInjector.exe

  • Size

    427KB

  • MD5

    fb3652cc3a387c107714440829ac7264

  • SHA1

    bf1275265b68ac09b54de10be9e0c1f2b48a352e

  • SHA256

    dd22919a17110bb3d20ede3be4c029af8626d1459f50b2b5534ae2a77cc8c39b

  • SHA512

    c5a0082b19e2a0c22b75b3ddf1e487ba6b002f0e7455e3fae2442a02c6e2844f2703d3428fcd63b26bb4edca442ab776ec7ad2856c816ba7610c81fd160b4cc7

Score
8/10

Malware Config

Signatures

  • Downloads MZ/PE file
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Drops file in Windows directory 3 IoCs
  • Modifies Internet Explorer settings 1 TTPs 3 IoCs
    adwarespyware
  • Modifies registry class 64 IoCs
  • Suspicious behavior: MapViewOfSection 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 11 IoCs
  • Suspicious use of SetWindowsHookEx 3 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\HorionInjector.exe
    "C:\Users\Admin\AppData\Local\Temp\HorionInjector.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of AdjustPrivilegeToken
    PID:8
  • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe
    "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca
    1⤵
    • Drops file in Windows directory
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of SetWindowsHookEx
    PID:3616
  • C:\Windows\system32\browser_broker.exe
    C:\Windows\system32\browser_broker.exe -Embedding
    1⤵
    • Modifies Internet Explorer settings
    PID:3684
  • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
    "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
    1⤵
    • Modifies registry class
    • Suspicious behavior: MapViewOfSection
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:2268
  • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
    "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
    1⤵
    • Drops file in Windows directory
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious use of AdjustPrivilegeToken
    PID:432
  • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
    "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
    1⤵
    • Modifies registry class
    • Suspicious use of AdjustPrivilegeToken
    PID:3592

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1
T1112

Credential Access

Discovery

Query Registry

1
T1012

System Information Discovery

1
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\NEQ3W3A4\VC_redist.x64[1].exe
    MD5

    718ab9e7bc181c564abb5a6e3b640fbf

    SHA1

    f19c7f9a5d3c484399c461946c2625cae81694ba

    SHA256

    b4b8ecca52e6e4c9fdb89b7e5be237c85eaffc4795bc169355f1ff6798ceaba2

    SHA512

    b1bc1d9d60bc0a71883da00357c70a3a2dc276b49e98253355a9f012105db19e6c9f53b05b3698a5d8e7f81c2c05990a3fa85d073682b4af5925452c33e2c046

    Download Submit
  • memory/8-118-0x000002B28F9D0000-0x000002B28F9D1000-memory.dmp
    Filesize

    4KB

    Download
  • memory/8-120-0x000002B2A9E00000-0x000002B2A9E01000-memory.dmp
    Filesize

    4KB

    Download
  • memory/8-122-0x000002B2AA050000-0x000002B2AA052000-memory.dmp
    Filesize

    8KB

    Download
  • memory/8-123-0x000002B2AA052000-0x000002B2AA054000-memory.dmp
    Filesize

    8KB

    Download
  • memory/8-124-0x000002B2AECD0000-0x000002B2AECD1000-memory.dmp
    Filesize

    4KB

    Download
  • memory/8-125-0x000002B2AED80000-0x000002B2AED81000-memory.dmp
    Filesize

    4KB

    Download
  • memory/8-126-0x000002B2AEC70000-0x000002B2AEC71000-memory.dmp
    Filesize

    4KB

    Download
  • memory/8-127-0x000002B2AA054000-0x000002B2AA055000-memory.dmp
    Filesize

    4KB

    Download