2b1aeea167b5a914b2f2168400ad6fd49bbf9111d56cf6a483a4dd58ea6947eb

Analysis

max time kernel
100s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
30/10/2022, 13:20

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2b1aeea167b5a914b2f2168400ad6fd49bbf9111d56cf6a483a4dd58ea6947eb.exe
Size

170KB
MD5

a2a50dc44ff32e92b26172d1d3ad67e0
SHA1

7a2dd77e9021580d840cfbcfc61db24cbeb7653e
SHA256

2b1aeea167b5a914b2f2168400ad6fd49bbf9111d56cf6a483a4dd58ea6947eb
SHA512

3194e0fef49a4cfa832b8f8297a04df87247425dd96eaf7e6d77e0b0f2f5306e52a7eeadf035f7674bb66976f086946a6da04e8866d6ee0f15aae2d0428f8805
SSDEEP

3072:ZliwDUWyFcB9fu+JMl2uU82Ws7f9sjboPACTQembG4hY/i1vA+wCmG0:ZldD1Yc7GIBgbzjbfLhRW+30

Score

8^/10

persistence

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
5060	fabyope.exe

Modifies AppInit DLL entries 2 TTPs
persistence

Registry Run Keys / Startup Folder
T1060

Modify Registry
T1112

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\PROGRA~3\Mozilla\fabyope.exe	2b1aeea167b5a914b2f2168400ad6fd49bbf9111d56cf6a483a4dd58ea6947eb.exe
File created	C:\PROGRA~3\Mozilla\kybuain.dll	fabyope.exe

C:\Users\Admin\AppData\Local\Temp\2b1aeea167b5a914b2f2168400ad6fd49bbf9111d56cf6a483a4dd58ea6947eb.exe
"C:\Users\Admin\AppData\Local\Temp\2b1aeea167b5a914b2f2168400ad6fd49bbf9111d56cf6a483a4dd58ea6947eb.exe"
1⤵
- Drops file in Program Files directory
PID:4940

C:\PROGRA~3\Mozilla\fabyope.exe
C:\PROGRA~3\Mozilla\fabyope.exe -pbtetmh
1⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:5060

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\PROGRA~3\Mozilla\fabyope.exe

Filesize
170KB

MD5
a18e3736c692c325ecdfd20fe6a4923d

SHA1
e045b2b8f07175286147f810a03861a8c5ce686d

SHA256
42a2ffd7ad17e87282eaf23e1691f9a640da0dcf1e46ca2647fdca4085ea9b25

SHA512
c46d9340662753f8b9b3495b5c8402cfb240aade30f54d2c1e585a248f07a23a7b8bf3b3f407a8d238dd1f4f4c7c579023c0bc578edbe23655339f1a79ff258b

Download Submit
C:\ProgramData\Mozilla\fabyope.exe

Filesize
170KB

MD5
a18e3736c692c325ecdfd20fe6a4923d

SHA1
e045b2b8f07175286147f810a03861a8c5ce686d

SHA256
42a2ffd7ad17e87282eaf23e1691f9a640da0dcf1e46ca2647fdca4085ea9b25

SHA512
c46d9340662753f8b9b3495b5c8402cfb240aade30f54d2c1e585a248f07a23a7b8bf3b3f407a8d238dd1f4f4c7c579023c0bc578edbe23655339f1a79ff258b

Download Submit
memory/4940-132-0x0000000000400000-0x0000000000463000-memory.dmp

Filesize
396KB

Download
memory/4940-133-0x0000000000400000-0x0000000000463000-memory.dmp

Filesize
396KB

Download
memory/4940-134-0x0000000000400000-0x0000000000463000-memory.dmp

Filesize
396KB

Download
memory/4940-139-0x0000000000400000-0x0000000000463000-memory.dmp

Filesize
396KB

Download
memory/5060-140-0x0000000000400000-0x0000000000463000-memory.dmp

Filesize
396KB

Download
memory/5060-141-0x0000000000400000-0x0000000000463000-memory.dmp

Filesize
396KB

Download
memory/5060-142-0x0000000000400000-0x0000000000463000-memory.dmp

Filesize
396KB

Download
memory/5060-145-0x0000000000400000-0x0000000000463000-memory.dmp

Filesize
396KB

Download