Analysis
-
max time kernel
142s -
max time network
147s -
platform
windows10-2004_x64 -
resource
win10v2004-20230915-en -
resource tags
-
submitted
04/10/2023, 20:20
General
-
Target
c957aa07aa1dd6d58aff2431b56b2139a0c2d5d6b34d20a978767e0daab58829.exe
-
Size
933KB
-
MD5
6e45986a505bed78232a8867b5860ea6
-
SHA1
51b142a7e60eecd73c3eaa143eadda4b7e64ac4c
-
SHA256
c957aa07aa1dd6d58aff2431b56b2139a0c2d5d6b34d20a978767e0daab58829
-
SHA512
d2d8bc6179795c1c255ec5ac16817f83ff97fcd90481dbe2325a351b448c48a83af03f22ff6dda0cb6ad2401c20b81d2871068aa9e32d2747cc2f5669b440fde
-
SSDEEP
12288:K72HTp/D0DpEE3M51qvii3mmm6AV5Cqylkg5ZQnXlV5Za5Za5Zj:GA4JM5kRhAVdcpmt44F
Score
10/10
Malware Config
Extracted
Family
fabookie
C2
http://app.nnnaajjjgc.com/check/safe
Signatures
-
Detect Fabookie payload 2 IoCs
-
Fabookie
Fabookie is facebook account info stealer.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\c957aa07aa1dd6d58aff2431b56b2139a0c2d5d6b34d20a978767e0daab58829.exe"C:\Users\Admin\AppData\Local\Temp\c957aa07aa1dd6d58aff2431b56b2139a0c2d5d6b34d20a978767e0daab58829.exe"1⤵
-
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" "C:\Windows\SYSTEM32\EDGEHTML.dll",#141 Microsoft.VCLibs.140.00_8wekyb3d8bbwe1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k UnistackSvcGroup1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
944KB
-
Filesize
1.4MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB