1b62834e351b1d9fbb419cbd2a26fc6b202a9de46b0e821900d8f538881928b4

Analysis

max time kernel
150s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
27-11-2022 16:36

Target

1b62834e351b1d9fbb419cbd2a26fc6b202a9de46b0e821900d8f538881928b4.exe
Size

178KB
MD5

2e8a00eadb1bad304b3fd838e4394065
SHA1

8ca00cccbe760bd45b5c7b64a88a4082d7ec6d41
SHA256

1b62834e351b1d9fbb419cbd2a26fc6b202a9de46b0e821900d8f538881928b4
SHA512

99169d4e41ac9e04ddd8c31140bfc14fb3399f8a172d11ef9ef9c111f11d3e72e131823e1f1be7e95ce6e54a781e8e07c951061d8db0a14a6f06bfe5aa9fa6ba
SSDEEP

3072:ETIw/g8ZIogicblSGPkxNem8sNAZtXGZi5ysdAMvI0ox5HyWTQs5R6bTWXS:ET1/g8+JxNc/VPGHgoyOAqsQ70i

Score

8^/10

persistence

Executes dropped EXE 1 IoCs

Processes:

fabyope.exe

pid process

3992 fabyope.exe
Modifies AppInit DLL entries 2 TTPs
persistence

Registry Run Keys / Startup Folder
T1060

Modify Registry
T1112

pid	process
3992	fabyope.exe

Drops file in Program Files directory 2 IoCs

Processes:

1b62834e351b1d9fbb419cbd2a26fc6b202a9de46b0e821900d8f538881928b4.exefabyope.exe

description	ioc	process
File created	C:\PROGRA~3\Mozilla\fabyope.exe	1b62834e351b1d9fbb419cbd2a26fc6b202a9de46b0e821900d8f538881928b4.exe
File created	C:\PROGRA~3\Mozilla\kybuain.dll	fabyope.exe

C:\Users\Admin\AppData\Local\Temp\1b62834e351b1d9fbb419cbd2a26fc6b202a9de46b0e821900d8f538881928b4.exe
"C:\Users\Admin\AppData\Local\Temp\1b62834e351b1d9fbb419cbd2a26fc6b202a9de46b0e821900d8f538881928b4.exe"
1⤵
- Drops file in Program Files directory
PID:5116

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

Privilege Escalation

Defense Evasion

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

C:\PROGRA~3\Mozilla\fabyope.exe
Filesize
178KB

MD5
974df3b47d92aa75858acbabc6ec65c3

SHA1
2c309de695de701c951eb80a8d58f4e5f20f48f4

SHA256
80218ca1e2195e4ed5dae675d70f864278c637c8daafda3e046821df11614d33

SHA512
0087b4c4bae2daaa957e1da680ffdb0112ffe962695af13869a1df37fa627dcc1af31ac835293934d2c4dad63f3c376f73ce33cdc08888dafb509e4a37b5cb25

Download Submit
C:\ProgramData\Mozilla\fabyope.exe
Filesize
178KB

MD5
974df3b47d92aa75858acbabc6ec65c3

SHA1
2c309de695de701c951eb80a8d58f4e5f20f48f4

SHA256
80218ca1e2195e4ed5dae675d70f864278c637c8daafda3e046821df11614d33

SHA512
0087b4c4bae2daaa957e1da680ffdb0112ffe962695af13869a1df37fa627dcc1af31ac835293934d2c4dad63f3c376f73ce33cdc08888dafb509e4a37b5cb25

Download Submit
memory/3992-140-0x0000000000400000-0x0000000000427000-memory.dmp

Filesize
156KB

Download
memory/3992-141-0x0000000000DE0000-0x0000000000E3B000-memory.dmp

Filesize
364KB

Download
memory/5116-132-0x0000000000400000-0x0000000000427000-memory.dmp

Filesize
156KB

Download
memory/5116-133-0x0000000002360000-0x00000000023BB000-memory.dmp

Filesize
364KB

Download