e3893e5c3e05d117f056edd7b3035f640fc0cb9179a579f2bcbc46246f7f0de1

Analysis

max time kernel
146s
max time network
174s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
30/10/2022, 05:32

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

e3893e5c3e05d117f056edd7b3035f640fc0cb9179a579f2bcbc46246f7f0de1.exe
Size

256KB
MD5

92bca542bceeabd1db0a4e5ca6d024e0
SHA1

b1827c7ae14fe16d53985ea6c9fb5b79be6c8122
SHA256

e3893e5c3e05d117f056edd7b3035f640fc0cb9179a579f2bcbc46246f7f0de1
SHA512

f4a592e9a3c0df0bdea1e2a9b59de7f249cbaa12abe3506b17e94da952b12ae68643f2d242096b5a941f0e200f7b4aa970043f27acaab41f98509ef7e6e4c053
SSDEEP

3072:d5+iiVM2EB1GG/66WXrAdyUFVdhxDdiht1wNyY9y74q8Doh4:3FiVdI3S6EabFbiD11R0Xp

Score

8^/10

persistence

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
4032	fabyope.exe

Modifies AppInit DLL entries 2 TTPs
persistence

Registry Run Keys / Startup Folder
T1060

Modify Registry
T1112

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\PROGRA~3\Mozilla\fabyope.exe	e3893e5c3e05d117f056edd7b3035f640fc0cb9179a579f2bcbc46246f7f0de1.exe
File created	C:\PROGRA~3\Mozilla\kybuain.dll	fabyope.exe

C:\Users\Admin\AppData\Local\Temp\e3893e5c3e05d117f056edd7b3035f640fc0cb9179a579f2bcbc46246f7f0de1.exe
"C:\Users\Admin\AppData\Local\Temp\e3893e5c3e05d117f056edd7b3035f640fc0cb9179a579f2bcbc46246f7f0de1.exe"
1⤵
- Drops file in Program Files directory
PID:4860

C:\PROGRA~3\Mozilla\fabyope.exe
C:\PROGRA~3\Mozilla\fabyope.exe -pbtetmh
1⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:4032

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\PROGRA~3\Mozilla\fabyope.exe

Filesize
256KB

MD5
762ae64022dc83668fe3f20189716199

SHA1
0125007f41a72cecd55b303fc7d7fe50b1e444a3

SHA256
808846d48a252517d8f47e739e26493aae7a72c032123188166caf7cd3aa81a2

SHA512
29c2778446007540a7f7095c4a00b451291ac2bb6d8702f2865083bad06f860db9a2f1f80bbd1dda50264eb216233db4cf6efc242d3fa870a93d95ed70c74ec8

Download Submit
C:\ProgramData\Mozilla\fabyope.exe

Filesize
256KB

MD5
762ae64022dc83668fe3f20189716199

SHA1
0125007f41a72cecd55b303fc7d7fe50b1e444a3

SHA256
808846d48a252517d8f47e739e26493aae7a72c032123188166caf7cd3aa81a2

SHA512
29c2778446007540a7f7095c4a00b451291ac2bb6d8702f2865083bad06f860db9a2f1f80bbd1dda50264eb216233db4cf6efc242d3fa870a93d95ed70c74ec8

Download Submit
memory/4032-137-0x0000000000C40000-0x0000000000C9B000-memory.dmp

Filesize
364KB

Download
memory/4032-138-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/4032-139-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/4860-132-0x00000000021E0000-0x000000000223B000-memory.dmp

Filesize
364KB

Download
memory/4860-133-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/4860-135-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download