8d337457e0c72f0427006c2944ce634c77ef29b8f5b6f7aaef6cf7836e6f5cba

Analysis

max time kernel
166s
max time network
190s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
06/11/2022, 08:10

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

8d337457e0c72f0427006c2944ce634c77ef29b8f5b6f7aaef6cf7836e6f5cba.exe
Size

177KB
MD5

123cadd796a0152479e4f8e49a219810
SHA1

0b796f605c831edb67fc22547ff2a89008cbfba3
SHA256

8d337457e0c72f0427006c2944ce634c77ef29b8f5b6f7aaef6cf7836e6f5cba
SHA512

49d256aa478821f91b4533c5780846644eef9eac70449c89c986c06d5d94d602a70a588a39d1356e0268c5484c80ffa1ab995058287b12ebf1f26788134c5147
SSDEEP

3072:4CRg3fScL7qmJOXRlU30A7G1mcJ7oygOJdhyjbBv0sBZa0Bv7Ze1l2QUP7czL6:KqcK2wL674ZojOvEtvTZaWv74141zc6

Score

8^/10

persistence

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
4940	fabyope.exe

Modifies AppInit DLL entries 2 TTPs
persistence

Registry Run Keys / Startup Folder
T1060

Modify Registry
T1112

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\PROGRA~3\Mozilla\fabyope.exe	8d337457e0c72f0427006c2944ce634c77ef29b8f5b6f7aaef6cf7836e6f5cba.exe
File created	C:\PROGRA~3\Mozilla\kybuain.dll	fabyope.exe

C:\Users\Admin\AppData\Local\Temp\8d337457e0c72f0427006c2944ce634c77ef29b8f5b6f7aaef6cf7836e6f5cba.exe
"C:\Users\Admin\AppData\Local\Temp\8d337457e0c72f0427006c2944ce634c77ef29b8f5b6f7aaef6cf7836e6f5cba.exe"
1⤵
- Drops file in Program Files directory
PID:728

C:\PROGRA~3\Mozilla\fabyope.exe
C:\PROGRA~3\Mozilla\fabyope.exe -pbtetmh
1⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:4940

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\PROGRA~3\Mozilla\fabyope.exe

Filesize
177KB

MD5
db9b3997682a385598d21d7859b894aa

SHA1
04a1508df64c07dda41b3ba9fe6e6efc888ef716

SHA256
ea0ca917fd3a5f96b36aefa3279a93e45d15f54a6a9c2eac470b5768d4fcaef7

SHA512
c0f9e7bf9b7fdcdbd8b7119c190c3a1e2e3ac452ec452cd71a97feaa19c0db11cb2070b5a489923442d106d9d6fe0d943cf09f10ccd8631c1f8a05078700c30f

Download Submit
C:\ProgramData\Mozilla\fabyope.exe

Filesize
177KB

MD5
db9b3997682a385598d21d7859b894aa

SHA1
04a1508df64c07dda41b3ba9fe6e6efc888ef716

SHA256
ea0ca917fd3a5f96b36aefa3279a93e45d15f54a6a9c2eac470b5768d4fcaef7

SHA512
c0f9e7bf9b7fdcdbd8b7119c190c3a1e2e3ac452ec452cd71a97feaa19c0db11cb2070b5a489923442d106d9d6fe0d943cf09f10ccd8631c1f8a05078700c30f

Download Submit
memory/728-132-0x0000000000400000-0x0000000000425000-memory.dmp

Filesize
148KB

Download
memory/728-133-0x00000000025D0000-0x000000000262B000-memory.dmp

Filesize
364KB

Download
memory/4940-140-0x0000000000670000-0x00000000006CB000-memory.dmp

Filesize
364KB

Download