Analysis
-
max time kernel
142s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20230703-en -
resource tags
arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system -
submitted
05-07-2023 08:54
Static task
static1
Behavioral task
behavioral1
Sample
FiddlerAutoUpdater.exe
Resource
win7-20230703-en
Behavioral task
behavioral2
Sample
FiddlerAutoUpdater.exe
Resource
win10v2004-20230703-en
General
-
Target
FiddlerAutoUpdater.exe
-
Size
6.3MB
-
MD5
77a80b10028f9c800c5cbb5a80fde929
-
SHA1
7e8a8ce83bba6bec7b62cca06ae7680ef5c5ddec
-
SHA256
207e1a39c74a03ae535ad04fe74bc435baa777ecefaec95abe78664cd2b34690
-
SHA512
883600cb4d5114cef47dba6d7fde929c02f0f4d2baafa9dbb746fccfee92ebb6bfb02602e64dfb2c93b773abfdf8b49ac780b0c02414107761dd66e6999480bc
-
SSDEEP
98304:mIouszMd5OYRxqFu5rMnb8ELGUHjvYEarhIPAT99taafHOwRcxzv77Nd6fKnCKbX:FqzMSx3oohYTXt5WwREv77cKCKkBbYOY
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
Processes:
FiddlerSetup.exepid process 3784 FiddlerSetup.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
NSIS installer 4 IoCs
Processes:
resource yara_rule C:\Users\Admin\AppData\Local\Temp\nsg8907.tmp\FiddlerSetup.exe nsis_installer_1 C:\Users\Admin\AppData\Local\Temp\nsg8907.tmp\FiddlerSetup.exe nsis_installer_2 C:\Users\Admin\AppData\Local\Temp\nsg8907.tmp\FiddlerSetup.exe nsis_installer_1 C:\Users\Admin\AppData\Local\Temp\nsg8907.tmp\FiddlerSetup.exe nsis_installer_2 -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
FiddlerAutoUpdater.exedescription pid process target process PID 2280 wrote to memory of 3784 2280 FiddlerAutoUpdater.exe FiddlerSetup.exe PID 2280 wrote to memory of 3784 2280 FiddlerAutoUpdater.exe FiddlerSetup.exe PID 2280 wrote to memory of 3784 2280 FiddlerAutoUpdater.exe FiddlerSetup.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\FiddlerAutoUpdater.exe"C:\Users\Admin\AppData\Local\Temp\FiddlerAutoUpdater.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\nsg8907.tmp\FiddlerSetup.exe"C:\Users\Admin\AppData\Local\Temp\nsg8907.tmp\FiddlerSetup.exe" /D=2⤵
- Executes dropped EXE
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\nsg8907.tmp\FiddlerSetup.exeFilesize
3.1MB
MD57e3090e237b9f252efc88d097f71ed47
SHA18a1cae86f421c4c74f7f543609826cfc472e5fa8
SHA25691547aa10f5b4d1be95c7bfa289499ded2b65d1070ec6fce0208e61771df5318
SHA512378d29ca00b73ff5b729d6bc39e63b61f833f7baad9d806db77ee7acab993b3b567f7e533aae2178bf8a9391bc8d205aadd72d75a29a71c0f2827196ff040afa
-
C:\Users\Admin\AppData\Local\Temp\nsg8907.tmp\FiddlerSetup.exeFilesize
3.1MB
MD57e3090e237b9f252efc88d097f71ed47
SHA18a1cae86f421c4c74f7f543609826cfc472e5fa8
SHA25691547aa10f5b4d1be95c7bfa289499ded2b65d1070ec6fce0208e61771df5318
SHA512378d29ca00b73ff5b729d6bc39e63b61f833f7baad9d806db77ee7acab993b3b567f7e533aae2178bf8a9391bc8d205aadd72d75a29a71c0f2827196ff040afa