70d492dcd6946a5eae54eeb92ae9e7b35840e8e06beb7805efaae9b0fd95dd3e

Analysis

max time kernel
150s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
30/10/2022, 12:48

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

70d492dcd6946a5eae54eeb92ae9e7b35840e8e06beb7805efaae9b0fd95dd3e.exe
Size

222KB
MD5

93512d7449fb89e230db853ed6d2ca40
SHA1

c44df91c2b6b6eab639cd7da1d12e6567401e015
SHA256

70d492dcd6946a5eae54eeb92ae9e7b35840e8e06beb7805efaae9b0fd95dd3e
SHA512

5ec1494c2edf5a40dba01e325e6d9bc0025ece397a29801414cfc6013b2c54eb19e28e53cab595e6208cfcf7d68cfed78f238b32f62ee27e66253ef83ad4512c
SSDEEP

3072:ozC7MKza/YnXbvr+yNEjGS8isZ4HukP8YVqsZVcDvOmzn1aDGrXP:oe7rZTh2G/iw4HuNYAsZ+RZrXP

Score

8^/10

persistence

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
5012	fabyope.exe

Modifies AppInit DLL entries 2 TTPs
persistence

Registry Run Keys / Startup Folder
T1060

Modify Registry
T1112

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\PROGRA~3\Mozilla\fabyope.exe	70d492dcd6946a5eae54eeb92ae9e7b35840e8e06beb7805efaae9b0fd95dd3e.exe
File created	C:\PROGRA~3\Mozilla\kybuain.dll	fabyope.exe

C:\Users\Admin\AppData\Local\Temp\70d492dcd6946a5eae54eeb92ae9e7b35840e8e06beb7805efaae9b0fd95dd3e.exe
"C:\Users\Admin\AppData\Local\Temp\70d492dcd6946a5eae54eeb92ae9e7b35840e8e06beb7805efaae9b0fd95dd3e.exe"
1⤵
- Drops file in Program Files directory
PID:1264

C:\PROGRA~3\Mozilla\fabyope.exe
C:\PROGRA~3\Mozilla\fabyope.exe -pbtetmh
1⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:5012

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\PROGRA~3\Mozilla\fabyope.exe

Filesize
222KB

MD5
b51a375d44e98ac4e3c7dabfe88574ed

SHA1
41472422240d7a8eea9830c369b76405881da3e2

SHA256
d15429a6a2ebc2df674d472896c889bb5eb2066777d2dde42bca950e20457887

SHA512
fb17fcdd2d761d92eaf63a3d26225b4d305703dd30f5c5476ee5871cd5a407dbb8c38743f719c0c4550325289e7c7bd7c109dee4e968060a7e2863a25d204265

Download Submit
C:\ProgramData\Mozilla\fabyope.exe

Filesize
222KB

MD5
b51a375d44e98ac4e3c7dabfe88574ed

SHA1
41472422240d7a8eea9830c369b76405881da3e2

SHA256
d15429a6a2ebc2df674d472896c889bb5eb2066777d2dde42bca950e20457887

SHA512
fb17fcdd2d761d92eaf63a3d26225b4d305703dd30f5c5476ee5871cd5a407dbb8c38743f719c0c4550325289e7c7bd7c109dee4e968060a7e2863a25d204265

Download Submit
memory/1264-132-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/1264-133-0x0000000002210000-0x000000000226B000-memory.dmp

Filesize
364KB

Download
memory/1264-136-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/5012-137-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/5012-138-0x0000000000C40000-0x0000000000C9B000-memory.dmp

Filesize
364KB

Download
memory/5012-139-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download