8edfe257ebea934a557ccc0b93067c9848ecaf296f2867360f8b2c9dbc88605f

Analysis

max time kernel
152s
max time network
158s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
03/10/2022, 00:58

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

8edfe257ebea934a557ccc0b93067c9848ecaf296f2867360f8b2c9dbc88605f.exe
Size

133KB
MD5

6b185bda544097b7aaf8478f4093cc03
SHA1

971aa147124566f0c329ab3e13818ed564be5a82
SHA256

8edfe257ebea934a557ccc0b93067c9848ecaf296f2867360f8b2c9dbc88605f
SHA512

4ac633e24b41199c516ed7e950b79e394dffa51fafa565915e7acfadce171a8f57a51e36aa6789b0ec9bfad40e0b3da16c6ddba846c8e92dffc7676f1f0dba61
SSDEEP

3072:HAwEvRRdqcqpaiVPfGHO4xATzlypxd7CQn3pi+:TcRWcslXWRpjCS5R

Score

8^/10

persistence

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
4844	fabyope.exe

Modifies AppInit DLL entries 2 TTPs
persistence

Registry Run Keys / Startup Folder
T1060

Modify Registry
T1112

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\PROGRA~3\Mozilla\fabyope.exe	8edfe257ebea934a557ccc0b93067c9848ecaf296f2867360f8b2c9dbc88605f.exe
File created	C:\PROGRA~3\Mozilla\kybuain.dll	fabyope.exe

C:\Users\Admin\AppData\Local\Temp\8edfe257ebea934a557ccc0b93067c9848ecaf296f2867360f8b2c9dbc88605f.exe
"C:\Users\Admin\AppData\Local\Temp\8edfe257ebea934a557ccc0b93067c9848ecaf296f2867360f8b2c9dbc88605f.exe"
1⤵
- Drops file in Program Files directory
PID:1440

C:\PROGRA~3\Mozilla\fabyope.exe
C:\PROGRA~3\Mozilla\fabyope.exe -pbtetmh
1⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:4844

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\PROGRA~3\Mozilla\fabyope.exe

Filesize
133KB

MD5
776b13df3b974b66ea059f1bf479480a

SHA1
82db9751d30477408add246afc19e5e0c20e0ad4

SHA256
b31d9eded985cf5c35ed0e6af309e5a60a123066aac8e58a9fd4304b02a2fb12

SHA512
5469043ef04d7dffc6c8e690072c9aafc465518b044d3f7d8e834219ab99ab15a958c8bcbbabd0f5adfda269b3e216ae253d3a668a4b9acdd2180f1a0c81a60a

Download Submit
C:\ProgramData\Mozilla\fabyope.exe

Filesize
133KB

MD5
776b13df3b974b66ea059f1bf479480a

SHA1
82db9751d30477408add246afc19e5e0c20e0ad4

SHA256
b31d9eded985cf5c35ed0e6af309e5a60a123066aac8e58a9fd4304b02a2fb12

SHA512
5469043ef04d7dffc6c8e690072c9aafc465518b044d3f7d8e834219ab99ab15a958c8bcbbabd0f5adfda269b3e216ae253d3a668a4b9acdd2180f1a0c81a60a

Download Submit
memory/1440-132-0x0000000000400000-0x0000000000461000-memory.dmp

Filesize
388KB

Download
memory/1440-133-0x0000000000400000-0x0000000000461000-memory.dmp

Filesize
388KB

Download
memory/4844-138-0x0000000000400000-0x0000000000461000-memory.dmp

Filesize
388KB

Download
memory/4844-139-0x0000000000400000-0x0000000000461000-memory.dmp

Filesize
388KB

Download