8d2566fb5d72f9ab8848d6cd852bb9ff6d9e2d73d149b2f96e9fe5ff92885820

Analysis

max time kernel
157s
max time network
184s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
01/12/2022, 01:05

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

8d2566fb5d72f9ab8848d6cd852bb9ff6d9e2d73d149b2f96e9fe5ff92885820.exe
Size

221KB
MD5

1ad0ca209f067b504eb97667bf3fe260
SHA1

05fbfa374b2abd4c351861783e56adc3e950e9c7
SHA256

8d2566fb5d72f9ab8848d6cd852bb9ff6d9e2d73d149b2f96e9fe5ff92885820
SHA512

f7ec84bf7d4a359f317ecb66f7518fc5f20db02ebe9f39ae07a99b2804087e121caf8f46c77ba4a76a370da3157a30da4af5321c9e13dd4fbddab83f98b401a7
SSDEEP

6144:IiV3M7tydyE7ztsY4yTr8bjeJwj2EItHpk:Iu3URWtsYf8PemjE2

Score

8^/10

persistence

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
4556	fabyope.exe

Modifies AppInit DLL entries 2 TTPs
persistence

Registry Run Keys / Startup Folder
T1060

Modify Registry
T1112

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\PROGRA~3\Mozilla\fabyope.exe	8d2566fb5d72f9ab8848d6cd852bb9ff6d9e2d73d149b2f96e9fe5ff92885820.exe
File created	C:\PROGRA~3\Mozilla\kybuain.dll	fabyope.exe

C:\Users\Admin\AppData\Local\Temp\8d2566fb5d72f9ab8848d6cd852bb9ff6d9e2d73d149b2f96e9fe5ff92885820.exe
"C:\Users\Admin\AppData\Local\Temp\8d2566fb5d72f9ab8848d6cd852bb9ff6d9e2d73d149b2f96e9fe5ff92885820.exe"
1⤵
- Drops file in Program Files directory
PID:4824

C:\PROGRA~3\Mozilla\fabyope.exe
C:\PROGRA~3\Mozilla\fabyope.exe -pbtetmh
1⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:4556

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\PROGRA~3\Mozilla\fabyope.exe

Filesize
221KB

MD5
964ea2d7c0958c4b8bc757c3a0243a63

SHA1
9c39e61b660f2c87250d0f95b6d2ae04d9af8775

SHA256
8e51be17e166f057102ba4807281a06da4335ac3fe61b1cd37fb2edc9d1fa107

SHA512
8a7d378a1341ee82994f9d9d9da2b9dc210a093f49f726428332663ecb4725ba30ff388c16a504bc96fa1c22d67e976b829558ac371e02047ce180dbbc272756

Download Submit
C:\ProgramData\Mozilla\fabyope.exe

Filesize
221KB

MD5
964ea2d7c0958c4b8bc757c3a0243a63

SHA1
9c39e61b660f2c87250d0f95b6d2ae04d9af8775

SHA256
8e51be17e166f057102ba4807281a06da4335ac3fe61b1cd37fb2edc9d1fa107

SHA512
8a7d378a1341ee82994f9d9d9da2b9dc210a093f49f726428332663ecb4725ba30ff388c16a504bc96fa1c22d67e976b829558ac371e02047ce180dbbc272756

Download Submit
memory/4556-137-0x0000000000DB0000-0x0000000000E0B000-memory.dmp

Filesize
364KB

Download
memory/4556-138-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/4556-139-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/4824-132-0x00000000005F0000-0x000000000064B000-memory.dmp

Filesize
364KB

Download
memory/4824-133-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/4824-136-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download