Analysis

  • max time kernel
    118s
  • max time network
    123s
  • platform
    windows7_x64
  • resource
    win7-20230831-en
  • resource tags

    arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
  • submitted
    23/09/2023, 09:03

General

  • Target

    file.exe

  • Size

    636KB

  • MD5

    c101e54fcffce8ffa74cb00232a8aed2

  • SHA1

    a3a1c6fd8cf090094830a7cf319dad0be666d36c

  • SHA256

    b23319a38a563625b6b6b4ea64d9608882011626aab8f59ff313be46f522278e

  • SHA512

    e43bd7795735f9272af68bd1420eebe391ef7d20221a51ad9f21ed56abd817b466a255dcad4eaa5cbf6070e6572ef0f57ac486bc699d634df02990b6a5f19b21

  • SSDEEP

    6144:JfIJs1RHFDIOFkzJwz9OhcHQU8rATKbGHbI0/tGKP15Vuc7GHbI0/tGKP15Vuc1h:dYmctcH5049Duca049Duc1y6

Malware Config

Extracted

Family

fabookie

C2

http://app.nnnaajjjgc.com/check/safe

Signatures

  • Detect Fabookie payload 2 IoCs
  • Fabookie

    Fabookie is facebook account info stealer.

  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Modifies system certificate store 2 TTPs 6 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\file.exe
    "C:\Users\Admin\AppData\Local\Temp\file.exe"
    1⤵
    • Modifies system certificate store
    PID:1436

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

          Filesize

          344B

          MD5

          3018d3b7a4062d24b9c3851725f6c617

          SHA1

          40963a36633d2807142222aa6584965b19dc485a

          SHA256

          67d67d2b829b2b1cc2329a655695a6c2d40123f982f21bef6cdd724a43f77808

          SHA512

          c64d425c6bbcad0553de9ebec6f61d4ecf202a159cf5327c340815d8e93d1058f8f2cdbc27a27145a9776e34930bff3e2e1bf989e9a611cfe9d73f56be5f3071

        • C:\Users\Admin\AppData\Local\Temp\Cab4BE1.tmp

          Filesize

          61KB

          MD5

          f3441b8572aae8801c04f3060b550443

          SHA1

          4ef0a35436125d6821831ef36c28ffaf196cda15

          SHA256

          6720349e7d82ee0a8e73920d3c2b7cb2912d9fcf2edb6fd98f2f12820158b0bf

          SHA512

          5ba01ba421b50030e380ae6bbcd2f681f2a91947fe7fedb3c8e6b5f24dce9517abf57b1cf26cc6078d4bb53bde6fcfb2561591337c841f8f2cb121a3d71661b9

        • C:\Users\Admin\AppData\Local\Temp\Tar4CBE.tmp

          Filesize

          163KB

          MD5

          9441737383d21192400eca82fda910ec

          SHA1

          725e0d606a4fc9ba44aa8ffde65bed15e65367e4

          SHA256

          bc3a6e84e41faeb57e7c21aa3b60c2a64777107009727c5b7c0ed8fe658909e5

          SHA512

          7608dd653a66cd364392a78d4711b48d1707768d36996e4d38871c6843b5714e1d7da4b4cc6db969e6000cfa182bcb74216ef6823d1063f036fc5c3413fb8dcf

        • memory/1436-0-0x00000000FF480000-0x00000000FF522000-memory.dmp

          Filesize

          648KB

        • memory/1436-90-0x00000000031D0000-0x0000000003341000-memory.dmp

          Filesize

          1.4MB

        • memory/1436-91-0x0000000003350000-0x0000000003481000-memory.dmp

          Filesize

          1.2MB

        • memory/1436-94-0x0000000003350000-0x0000000003481000-memory.dmp

          Filesize

          1.2MB