b1690d26daad3ac88748f86b27c8c12a10d474668383d287af216d57cd59082e

Analysis

max time kernel
184s
max time network
191s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
07/11/2022, 11:04

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b1690d26daad3ac88748f86b27c8c12a10d474668383d287af216d57cd59082e.exe
Size

213KB
MD5

027c6ebe8c862cf372e87a1e6164fe20
SHA1

4e3ebcf41518611d1cc3e1ae57c190bcd7f91261
SHA256

b1690d26daad3ac88748f86b27c8c12a10d474668383d287af216d57cd59082e
SHA512

d1ce392a6ebb7dc3efac92c820f764bd0e5f61b89250859afede771939ad3d78a57ae3451aa17aef38c3ca33fb2b51cc71ee2a0c8798f5b41a48b78a962df99c
SSDEEP

6144:pEjpvYc3YJ/HvD9hTKCyI7TwmdMlL992VKmH33KeJxah2:aVe/v5hGCyB3R2rBm4

Score

8^/10

persistence

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
1900	fabyope.exe

Modifies AppInit DLL entries 2 TTPs
persistence

Registry Run Keys / Startup Folder
T1060

Modify Registry
T1112

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\PROGRA~3\Mozilla\fabyope.exe	b1690d26daad3ac88748f86b27c8c12a10d474668383d287af216d57cd59082e.exe
File created	C:\PROGRA~3\Mozilla\kybuain.dll	fabyope.exe

C:\Users\Admin\AppData\Local\Temp\b1690d26daad3ac88748f86b27c8c12a10d474668383d287af216d57cd59082e.exe
"C:\Users\Admin\AppData\Local\Temp\b1690d26daad3ac88748f86b27c8c12a10d474668383d287af216d57cd59082e.exe"
1⤵
- Drops file in Program Files directory
PID:2192

C:\PROGRA~3\Mozilla\fabyope.exe
C:\PROGRA~3\Mozilla\fabyope.exe -pbtetmh
1⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:1900

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\PROGRA~3\Mozilla\fabyope.exe

Filesize
213KB

MD5
8b05dbeab8e9d16814dd18d2ec0dde2a

SHA1
6af3f566163c6716666814bae7b5f75f44f0295d

SHA256
95dda805d14d682b7f4f519e6f2f604177c99363824ef3ea58720e06f8951584

SHA512
861d7bfcedfac448fb18c45ff1d0e7d754478a7a9ce4d7bce6e8e9f4545712106e2f231fbf54d2360e4a2030881ec50b7121eb0f91e3d06467cd997b4836b115

Download Submit
C:\ProgramData\Mozilla\fabyope.exe

Filesize
213KB

MD5
8b05dbeab8e9d16814dd18d2ec0dde2a

SHA1
6af3f566163c6716666814bae7b5f75f44f0295d

SHA256
95dda805d14d682b7f4f519e6f2f604177c99363824ef3ea58720e06f8951584

SHA512
861d7bfcedfac448fb18c45ff1d0e7d754478a7a9ce4d7bce6e8e9f4545712106e2f231fbf54d2360e4a2030881ec50b7121eb0f91e3d06467cd997b4836b115

Download Submit
memory/1900-140-0x0000000000400000-0x0000000000427000-memory.dmp

Filesize
156KB

Download
memory/1900-141-0x0000000000780000-0x00000000007DB000-memory.dmp

Filesize
364KB

Download
memory/2192-132-0x0000000000400000-0x0000000000427000-memory.dmp

Filesize
156KB

Download
memory/2192-133-0x0000000002580000-0x00000000025DB000-memory.dmp

Filesize
364KB

Download