b7d055d0c041ff3815b649fd766b92e90d566fc52069f40cf7f9f08abc326cb5

General

Target

FabFilter_KeyGen.exe
Size

754KB
MD5

e65aadf62d68a0c553e8d03f83b1ffa3
SHA1

7d02ba4357dda1360b1b3682cd544450888b6b8c
SHA256

b7d055d0c041ff3815b649fd766b92e90d566fc52069f40cf7f9f08abc326cb5
SHA512

5c2074e302b8730ee28f565603b876ab9f27d87975f52c60f7863a9820a2efc0af2401b802c15ec5997a4f1e8c48fab97c9e7d3e3d451d4abf97d542975e6948
SSDEEP

12288:4c9t2Sllu12Cd0coupii4Ueb1EDrz7e4pmYJktpwjAS2VtEnrEoqJtk:4cLY3X0i4Ueb1qz7e7txS2VtEnrE6

Score

7^/10

upx

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
1524	keygen.exe

Loads dropped DLL 3 IoCs

pid	Process
1524	keygen.exe
1524	keygen.exe
1524	keygen.exe

UPX packed file 6 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral3/files/0x00060000000230c7-5.dat	upx
behavioral3/files/0x00060000000230c7-7.dat	upx
behavioral3/memory/1524-6-0x0000000000400000-0x000000000043C000-memory.dmp	upx
behavioral3/memory/1524-17-0x0000000000400000-0x000000000043C000-memory.dmp	upx
behavioral3/memory/1524-23-0x0000000000400000-0x000000000043C000-memory.dmp	upx
behavioral3/memory/1524-40-0x0000000000400000-0x000000000043C000-memory.dmp	upx

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1524	keygen.exe
1524	keygen.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: 33	4896	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	4896	AUDIODG.EXE

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3800 wrote to memory of 1524	3800	FabFilter_KeyGen.exe	86
PID 3800 wrote to memory of 1524	3800	FabFilter_KeyGen.exe	86
PID 3800 wrote to memory of 1524	3800	FabFilter_KeyGen.exe	86

C:\Users\Admin\AppData\Local\Temp\FabFilter_KeyGen.exe
"C:\Users\Admin\AppData\Local\Temp\FabFilter_KeyGen.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3800
- C:\Users\Admin\AppData\Local\Temp\keygen.exe
  C:\Users\Admin\AppData\Local\Temp\keygen.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  PID:1524

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x4f0 0x294
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4896

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\BASSMOD.DLL

Filesize
33KB

MD5
e4ec57e8508c5c4040383ebe6d367928

SHA1
b22bcce36d9fdeae8ab7a7ecc0b01c8176648d06

SHA256
8ad9e47693e292f381da42ddc13724a3063040e51c26f4ca8e1f8e2f1ddd547f

SHA512
77d5cf66caf06e192e668fae2b2594e60a498e8e0ccef5b09b9710721a4cdb0c852d00c446fd32c5b5c85e739de2e73cb1f1f6044879fe7d237341bbb6f27822

Download Submit
C:\Users\Admin\AppData\Local\Temp\BASSMOD.dll

Filesize
33KB

MD5
e4ec57e8508c5c4040383ebe6d367928

SHA1
b22bcce36d9fdeae8ab7a7ecc0b01c8176648d06

SHA256
8ad9e47693e292f381da42ddc13724a3063040e51c26f4ca8e1f8e2f1ddd547f

SHA512
77d5cf66caf06e192e668fae2b2594e60a498e8e0ccef5b09b9710721a4cdb0c852d00c446fd32c5b5c85e739de2e73cb1f1f6044879fe7d237341bbb6f27822

Download Submit
C:\Users\Admin\AppData\Local\Temp\R2RFBFKG.dll

Filesize
233KB

MD5
098c88aa084267d7e53b3fa4093e20cb

SHA1
ef0e6f63c79da0f144431deb972068fbe0e223e7

SHA256
638193931a8e47a7a3e595efd25e410aca85de03ebf38b0cd730bcba7e6ee78d

SHA512
64512a98987d4a942979c1686ccfd537e1130d656779dba1fd432e55c1e9ec49d811b958f47bd347e9f01b030c87c91b70de3a8124ead3b87598ec2b49451731

Download Submit
C:\Users\Admin\AppData\Local\Temp\R2RFBFKG.dll

Filesize
233KB

MD5
098c88aa084267d7e53b3fa4093e20cb

SHA1
ef0e6f63c79da0f144431deb972068fbe0e223e7

SHA256
638193931a8e47a7a3e595efd25e410aca85de03ebf38b0cd730bcba7e6ee78d

SHA512
64512a98987d4a942979c1686ccfd537e1130d656779dba1fd432e55c1e9ec49d811b958f47bd347e9f01b030c87c91b70de3a8124ead3b87598ec2b49451731

Download Submit
C:\Users\Admin\AppData\Local\Temp\R2RFBFKG.dll

Filesize
233KB

MD5
098c88aa084267d7e53b3fa4093e20cb

SHA1
ef0e6f63c79da0f144431deb972068fbe0e223e7

SHA256
638193931a8e47a7a3e595efd25e410aca85de03ebf38b0cd730bcba7e6ee78d

SHA512
64512a98987d4a942979c1686ccfd537e1130d656779dba1fd432e55c1e9ec49d811b958f47bd347e9f01b030c87c91b70de3a8124ead3b87598ec2b49451731

Download Submit
C:\Users\Admin\AppData\Local\Temp\bgm.it

Filesize
80KB

MD5
5e3c083251880c635f5ea6a0a6ed8e76

SHA1
e7fb44133e223140057243493159bdce01c5f080

SHA256
9d460a48d7f7f461967c9065182456871606eef1c27f21767335b7d81384e141

SHA512
b4a6a5ad71a13f51989e1fccedb542ab528f6ab9bc3d60a4c93c59e544b8eaa06ca7b9fe79c1d9a5c92b61345c18e38736561cd21426bc9e43ae3a4c59424284

Download Submit
C:\Users\Admin\AppData\Local\Temp\keygen.exe

Filesize
293KB

MD5
a655d4207e5b42e0b0eeb875797bce38

SHA1
4d9a325ca6935eb8bdf11587633c6024c4bc9b01

SHA256
0af1b4444133af5b5e5ccfb6c3fdfa2ecd5a08cf138e1dd6507b1fc98a568546

SHA512
76df239f0a0573fb75a2624b32061b85ee3cccb44a7d8e5bec5da5acdf51cd8045654eaf0b1d694041397fcefc76666d090f51eb859a4fff880fb0910e33e3a0

Download Submit
C:\Users\Admin\AppData\Local\Temp\keygen.exe

Filesize
293KB

MD5
a655d4207e5b42e0b0eeb875797bce38

SHA1
4d9a325ca6935eb8bdf11587633c6024c4bc9b01

SHA256
0af1b4444133af5b5e5ccfb6c3fdfa2ecd5a08cf138e1dd6507b1fc98a568546

SHA512
76df239f0a0573fb75a2624b32061b85ee3cccb44a7d8e5bec5da5acdf51cd8045654eaf0b1d694041397fcefc76666d090f51eb859a4fff880fb0910e33e3a0

Download Submit
memory/1524-23-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/1524-31-0x0000000002430000-0x00000000024CD000-memory.dmp

Filesize
628KB

Download
memory/1524-15-0x0000000002430000-0x00000000024CD000-memory.dmp

Filesize
628KB

Download
memory/1524-11-0x0000000010000000-0x0000000010013000-memory.dmp

Filesize
76KB

Download
memory/1524-17-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/1524-18-0x0000000010000000-0x0000000010013000-memory.dmp

Filesize
76KB

Download
memory/1524-19-0x0000000002430000-0x00000000024CD000-memory.dmp

Filesize
628KB

Download
memory/1524-21-0x0000000010000000-0x0000000010013000-memory.dmp

Filesize
76KB

Download
memory/1524-6-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/1524-24-0x0000000010000000-0x0000000010013000-memory.dmp

Filesize
76KB

Download
memory/1524-25-0x0000000002430000-0x00000000024CD000-memory.dmp

Filesize
628KB

Download
memory/1524-27-0x0000000010000000-0x0000000010013000-memory.dmp

Filesize
76KB

Download
memory/1524-30-0x0000000010000000-0x0000000010013000-memory.dmp

Filesize
76KB

Download
memory/1524-14-0x0000000002430000-0x00000000024CD000-memory.dmp

Filesize
628KB

Download
memory/1524-33-0x0000000010000000-0x0000000010013000-memory.dmp

Filesize
76KB

Download
memory/1524-36-0x0000000010000000-0x0000000010013000-memory.dmp

Filesize
76KB

Download
memory/1524-40-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/1524-41-0x0000000010000000-0x0000000010013000-memory.dmp

Filesize
76KB

Download
memory/1524-44-0x0000000010000000-0x0000000010013000-memory.dmp

Filesize
76KB

Download
memory/1524-47-0x0000000010000000-0x0000000010013000-memory.dmp

Filesize
76KB

Download
memory/1524-50-0x0000000010000000-0x0000000010013000-memory.dmp

Filesize
76KB

Download
memory/1524-53-0x0000000010000000-0x0000000010013000-memory.dmp

Filesize
76KB

Download
memory/1524-56-0x0000000010000000-0x0000000010013000-memory.dmp

Filesize
76KB

Download
memory/1524-59-0x0000000010000000-0x0000000010013000-memory.dmp

Filesize
76KB

Download
memory/1524-60-0x0000000002430000-0x00000000024CD000-memory.dmp

Filesize
628KB

Download
memory/1524-62-0x0000000010000000-0x0000000010013000-memory.dmp

Filesize
76KB

Download
memory/1524-63-0x0000000002430000-0x00000000024CD000-memory.dmp

Filesize
628KB

Download

Analysis

Sharing