9e67f6ea2ea9992ac36f731434e92e6771151e879710b66f9b85179d4ee48da0

Analysis

max time kernel
152s
max time network
158s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
05/12/2022, 10:56

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

9e67f6ea2ea9992ac36f731434e92e6771151e879710b66f9b85179d4ee48da0.exe
Size

453KB
MD5

23688f1a40c658e9ea5de69855b928d0
SHA1

4b035737859338bb891a239a64d71c45918c2426
SHA256

9e67f6ea2ea9992ac36f731434e92e6771151e879710b66f9b85179d4ee48da0
SHA512

d3a2a7033582343b6dce2904405ec79c8ab5d1169345458ff92a81f184045c714f77931ae1ea3f3968e895ad4bca1a5c2c2f44a91e7b66acebd63e75322dfe96
SSDEEP

12288:Gf048mOK64VKHlxKInfZXjU9b7VU+S6hMI+Cw:Gc4sCViKog9b7e+SqMIE

Score

8^/10

persistence

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
3040	fabyope.exe

Modifies AppInit DLL entries 2 TTPs
persistence

Registry Run Keys / Startup Folder
T1060

Modify Registry
T1112

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\PROGRA~3\Mozilla\fabyope.exe	9e67f6ea2ea9992ac36f731434e92e6771151e879710b66f9b85179d4ee48da0.exe
File created	C:\PROGRA~3\Mozilla\kybuain.dll	fabyope.exe

C:\Users\Admin\AppData\Local\Temp\9e67f6ea2ea9992ac36f731434e92e6771151e879710b66f9b85179d4ee48da0.exe
"C:\Users\Admin\AppData\Local\Temp\9e67f6ea2ea9992ac36f731434e92e6771151e879710b66f9b85179d4ee48da0.exe"
1⤵
- Drops file in Program Files directory
PID:4736

C:\PROGRA~3\Mozilla\fabyope.exe
C:\PROGRA~3\Mozilla\fabyope.exe -pbtetmh
1⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:3040

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\PROGRA~3\Mozilla\fabyope.exe

Filesize
453KB

MD5
1f42eea7906e8ad7d4ac4b35e5be5989

SHA1
53aff1807389ad0cc9d603bd8ef8095e5ea0b7c6

SHA256
d416b11cd11ee9337e556e8ac6ef2a02e8eed847f11f535ab7539cfe0c293744

SHA512
bd9d6764fa462ca31bc0d569d61ed878de684d44eed53925e22b3f973093c1b09c4915af58e5a4f90bc0800195cccbf81ec55e4dfe66b3d9002dcd338db5c30c

Download Submit
C:\ProgramData\Mozilla\fabyope.exe

Filesize
453KB

MD5
1f42eea7906e8ad7d4ac4b35e5be5989

SHA1
53aff1807389ad0cc9d603bd8ef8095e5ea0b7c6

SHA256
d416b11cd11ee9337e556e8ac6ef2a02e8eed847f11f535ab7539cfe0c293744

SHA512
bd9d6764fa462ca31bc0d569d61ed878de684d44eed53925e22b3f973093c1b09c4915af58e5a4f90bc0800195cccbf81ec55e4dfe66b3d9002dcd338db5c30c

Download Submit
memory/3040-137-0x0000000000D80000-0x0000000000DDB000-memory.dmp

Filesize
364KB

Download
memory/3040-138-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/3040-139-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/4736-132-0x0000000002200000-0x000000000225B000-memory.dmp

Filesize
364KB

Download
memory/4736-133-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download
memory/4736-136-0x0000000000400000-0x000000000045B000-memory.dmp

Filesize
364KB

Download