167b31dddaad4a2424c6067cbaeccd53a9f7b83b4097f548cf1f3eb5ff102953

Analysis

max time kernel
118s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
30/10/2022, 13:29

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

167b31dddaad4a2424c6067cbaeccd53a9f7b83b4097f548cf1f3eb5ff102953.exe
Size

364KB
MD5

a37652739e7f8b041381c90afaad3790
SHA1

d288653963af2551fbe6c32a638425712a44564e
SHA256

167b31dddaad4a2424c6067cbaeccd53a9f7b83b4097f548cf1f3eb5ff102953
SHA512

1d95bc9790a055264438dcce50ab5d2e3802112fcfec42fa8494ae63ef925e920c2d032affdb8b32d43910a9fc9e8c9b04913bdca52f165b5e39c5b90079d72e
SSDEEP

3072:J/IXvD2enVN5UkLVZq5Bi23zKLOJLxHLcSrMXnmujpkxvU84xUa4bjRTItEcmHp:J/IfD2ApVZYiROJtLlMXtpeqJ2jydmHp

Score

8^/10

persistence

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
3028	fabyope.exe

Modifies AppInit DLL entries 2 TTPs
persistence

Registry Run Keys / Startup Folder
T1060

Modify Registry
T1112

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\PROGRA~3\Mozilla\fabyope.exe	167b31dddaad4a2424c6067cbaeccd53a9f7b83b4097f548cf1f3eb5ff102953.exe
File created	C:\PROGRA~3\Mozilla\kybuain.dll	fabyope.exe

C:\Users\Admin\AppData\Local\Temp\167b31dddaad4a2424c6067cbaeccd53a9f7b83b4097f548cf1f3eb5ff102953.exe
"C:\Users\Admin\AppData\Local\Temp\167b31dddaad4a2424c6067cbaeccd53a9f7b83b4097f548cf1f3eb5ff102953.exe"
1⤵
- Drops file in Program Files directory
PID:2604

C:\PROGRA~3\Mozilla\fabyope.exe
C:\PROGRA~3\Mozilla\fabyope.exe -pbtetmh
1⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:3028

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\PROGRA~3\Mozilla\fabyope.exe

Filesize
364KB

MD5
16980b9d3557c99d5ad0a99d151333cd

SHA1
bc1294562380461d45c74e02606146c2900f6777

SHA256
41701739d026d1c7fb12efaf73cea3a0967ba3fa8c60fcb82190094aa8b38524

SHA512
223bc7061ca9ff89e52fa7e1a3e7214008f9f420eeeb23b6014c9900e2080a4a4d3fffe2c30c59024cf63c1449229b681b810d971c21bf2d74e79afb104a42ea

Download Submit
C:\ProgramData\Mozilla\fabyope.exe

Filesize
364KB

MD5
16980b9d3557c99d5ad0a99d151333cd

SHA1
bc1294562380461d45c74e02606146c2900f6777

SHA256
41701739d026d1c7fb12efaf73cea3a0967ba3fa8c60fcb82190094aa8b38524

SHA512
223bc7061ca9ff89e52fa7e1a3e7214008f9f420eeeb23b6014c9900e2080a4a4d3fffe2c30c59024cf63c1449229b681b810d971c21bf2d74e79afb104a42ea

Download Submit
memory/2604-132-0x00000000021E0000-0x000000000223B000-memory.dmp

Filesize
364KB

Download
memory/2604-133-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/2604-136-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/3028-137-0x00000000005B0000-0x000000000060B000-memory.dmp

Filesize
364KB

Download
memory/3028-138-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/3028-139-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download