Overview
overview
9Static
static
3FiddlerSetup.exe
windows7-x64
4FiddlerSetup.exe
windows10-2004-x64
9$PLUGINSDI...up.exe
windows7-x64
3$PLUGINSDI...up.exe
windows10-2004-x64
3$PLUGINSDI...em.dll
windows7-x64
3$PLUGINSDI...em.dll
windows10-2004-x64
3Analytics.dll
windows7-x64
1Analytics.dll
windows10-2004-x64
1Be.Windows...ox.dll
windows7-x64
1Be.Windows...ox.dll
windows10-2004-x64
1EnableLoopback.exe
windows7-x64
1EnableLoopback.exe
windows10-2004-x64
5ExecAction.exe
windows7-x64
1ExecAction.exe
windows10-2004-x64
1FSE2.exe
windows7-x64
3FSE2.exe
windows10-2004-x64
3Fiddler.exe
windows7-x64
1Fiddler.exe
windows10-2004-x64
3ForceCPU.exe
windows7-x64
1ForceCPU.exe
windows10-2004-x64
1GA.Analyti...or.dll
windows7-x64
1GA.Analyti...or.dll
windows10-2004-x64
1ImportExpo...ts.dll
windows7-x64
1ImportExpo...ts.dll
windows10-2004-x64
1ImportExpo...rt.dll
windows7-x64
1ImportExpo...rt.dll
windows10-2004-x64
1Inspectors...on.dll
windows7-x64
1Inspectors...on.dll
windows10-2004-x64
1Inspectors...or.dll
windows7-x64
1Inspectors...or.dll
windows10-2004-x64
1Inspectors...es.dll
windows7-x64
1Inspectors...es.dll
windows10-2004-x64
1Analysis
-
max time kernel
122s -
max time network
137s -
platform
windows7_x64 -
resource
win7-20240220-en -
resource tags
arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system -
submitted
26-02-2024 18:30
Static task
static1
Behavioral task
behavioral1
Sample
FiddlerSetup.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
FiddlerSetup.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral3
Sample
$PLUGINSDIR/FiddlerSetup.exe
Resource
win7-20240221-en
Behavioral task
behavioral4
Sample
$PLUGINSDIR/FiddlerSetup.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral5
Sample
$PLUGINSDIR/System.dll
Resource
win7-20240221-en
Behavioral task
behavioral6
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20240226-en
Behavioral task
behavioral7
Sample
Analytics.dll
Resource
win7-20240221-en
Behavioral task
behavioral8
Sample
Analytics.dll
Resource
win10v2004-20240226-en
Behavioral task
behavioral9
Sample
Be.Windows.Forms.HexBox.dll
Resource
win7-20240220-en
Behavioral task
behavioral10
Sample
Be.Windows.Forms.HexBox.dll
Resource
win10v2004-20240226-en
Behavioral task
behavioral11
Sample
EnableLoopback.exe
Resource
win7-20240215-en
Behavioral task
behavioral12
Sample
EnableLoopback.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral13
Sample
ExecAction.exe
Resource
win7-20240221-en
Behavioral task
behavioral14
Sample
ExecAction.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral15
Sample
FSE2.exe
Resource
win7-20240221-en
Behavioral task
behavioral16
Sample
FSE2.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral17
Sample
Fiddler.exe
Resource
win7-20240220-en
Behavioral task
behavioral18
Sample
Fiddler.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral19
Sample
ForceCPU.exe
Resource
win7-20240221-en
Behavioral task
behavioral20
Sample
ForceCPU.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral21
Sample
GA.Analytics.Monitor.dll
Resource
win7-20240221-en
Behavioral task
behavioral22
Sample
GA.Analytics.Monitor.dll
Resource
win10v2004-20240226-en
Behavioral task
behavioral23
Sample
ImportExport/BasicFormats.dll
Resource
win7-20240221-en
Behavioral task
behavioral24
Sample
ImportExport/BasicFormats.dll
Resource
win10v2004-20240226-en
Behavioral task
behavioral25
Sample
ImportExport/VSWebTestExport.dll
Resource
win7-20240221-en
Behavioral task
behavioral26
Sample
ImportExport/VSWebTestExport.dll
Resource
win10v2004-20240226-en
Behavioral task
behavioral27
Sample
Inspectors/QWhale.Common.dll
Resource
win7-20240221-en
Behavioral task
behavioral28
Sample
Inspectors/QWhale.Common.dll
Resource
win10v2004-20240226-en
Behavioral task
behavioral29
Sample
Inspectors/QWhale.Editor.dll
Resource
win7-20240221-en
Behavioral task
behavioral30
Sample
Inspectors/QWhale.Editor.dll
Resource
win10v2004-20240226-en
Behavioral task
behavioral31
Sample
Inspectors/QWhale.Syntax.Schemes.dll
Resource
win7-20240221-en
Behavioral task
behavioral32
Sample
Inspectors/QWhale.Syntax.Schemes.dll
Resource
win10v2004-20240226-en
General
-
Target
Fiddler.exe
-
Size
1.4MB
-
MD5
bf4fb7029571683986ecf3a48eacd4fd
-
SHA1
5f1c4f0a79f4a0c8e96d27adbf0153a45a58cc11
-
SHA256
b0eab66bae42868d402f326a37cb0e4364d4a686eb5feb4d93325b5078c1bc0e
-
SHA512
ec240842386f28e87576720252d12c5a02ea9e2c29485d1acaea34c89a1577041462610d953a59e9e4acef4d3c566e861d6672a00d9bf196d778bf13a45bb25e
-
SSDEEP
24576:HA93BNl5yPcNBSuUsRCb/l+53flpmjaqkIw:swLzkIw
Malware Config
Signatures
-
Processes:
Fiddler.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main Fiddler.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes:
Fiddler.exepid process 2092 Fiddler.exe 2092 Fiddler.exe 2092 Fiddler.exe 2092 Fiddler.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
Fiddler.exepid process 2092 Fiddler.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
Fiddler.exedescription pid process Token: SeDebugPrivilege 2092 Fiddler.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
Fiddler.exepid process 2092 Fiddler.exe 2092 Fiddler.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Fiddler.exe"C:\Users\Admin\AppData\Local\Temp\Fiddler.exe"1⤵
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Progress_Software_Corpora\Fiddler.exe_Url_sblwdlp4jxb3bmuxfbi1zl1jd5acanau\5.0.20202.18177\user.configFilesize
966B
MD5f23bcae424ffef2f86565cd14609efde
SHA164623e6470fe0c603c953987d54b151a8d136b01
SHA25605fd5b13bcd6e13010627b6cb032be9d25f28d7473a4c0e8d90aeb91fa3614ae
SHA512da112602e32fed911e6a37f2842b433eb615d90e98f5fc67eb1838b36e3150761410506e623972d0f9e55d5ba37b4db0df8fbeb80d28dbeeba47075acbd103ca
-
memory/2092-20-0x000000001B540000-0x000000001B548000-memory.dmpFilesize
32KB
-
memory/2092-43-0x00000000234F0000-0x0000000023C96000-memory.dmpFilesize
7.6MB
-
memory/2092-3-0x000000001B860000-0x000000001B8B0000-memory.dmpFilesize
320KB
-
memory/2092-4-0x00000000023E0000-0x00000000023F6000-memory.dmpFilesize
88KB
-
memory/2092-5-0x000000001BAB0000-0x000000001BAF8000-memory.dmpFilesize
288KB
-
memory/2092-6-0x00000000024A0000-0x00000000024C4000-memory.dmpFilesize
144KB
-
memory/2092-7-0x000000001B050000-0x000000001B0D0000-memory.dmpFilesize
512KB
-
memory/2092-8-0x000000001B050000-0x000000001B0D0000-memory.dmpFilesize
512KB
-
memory/2092-9-0x000000001B050000-0x000000001B0D0000-memory.dmpFilesize
512KB
-
memory/2092-10-0x00000000024D0000-0x00000000024DC000-memory.dmpFilesize
48KB
-
memory/2092-11-0x000000001AA40000-0x000000001AA4C000-memory.dmpFilesize
48KB
-
memory/2092-12-0x000000001AA40000-0x000000001AA4C000-memory.dmpFilesize
48KB
-
memory/2092-13-0x000000001B050000-0x000000001B0D0000-memory.dmpFilesize
512KB
-
memory/2092-21-0x000000001B580000-0x000000001B588000-memory.dmpFilesize
32KB
-
memory/2092-15-0x000000001B510000-0x000000001B522000-memory.dmpFilesize
72KB
-
memory/2092-16-0x000000001B050000-0x000000001B0D0000-memory.dmpFilesize
512KB
-
memory/2092-17-0x000000001B530000-0x000000001B540000-memory.dmpFilesize
64KB
-
memory/2092-18-0x000000001F900000-0x000000001FAAE000-memory.dmpFilesize
1.7MB
-
memory/2092-48-0x000000001B050000-0x000000001B0D0000-memory.dmpFilesize
512KB
-
memory/2092-2-0x000000001B050000-0x000000001B0D0000-memory.dmpFilesize
512KB
-
memory/2092-14-0x000000001E820000-0x000000001E862000-memory.dmpFilesize
264KB
-
memory/2092-22-0x000000001B810000-0x000000001B81C000-memory.dmpFilesize
48KB
-
memory/2092-23-0x000000001B820000-0x000000001B846000-memory.dmpFilesize
152KB
-
memory/2092-24-0x000000001BB00000-0x000000001BB0E000-memory.dmpFilesize
56KB
-
memory/2092-25-0x000000001F450000-0x000000001F50A000-memory.dmpFilesize
744KB
-
memory/2092-26-0x000000001FAB0000-0x000000001FFAE000-memory.dmpFilesize
5.0MB
-
memory/2092-27-0x000000001FFB0000-0x00000000204AE000-memory.dmpFilesize
5.0MB
-
memory/2092-28-0x000000001BB10000-0x000000001BB18000-memory.dmpFilesize
32KB
-
memory/2092-29-0x000000001BB20000-0x000000001BB28000-memory.dmpFilesize
32KB
-
memory/2092-33-0x000000001B050000-0x000000001B0D0000-memory.dmpFilesize
512KB
-
memory/2092-1-0x000007FEF57F0000-0x000007FEF61DC000-memory.dmpFilesize
9.9MB
-
memory/2092-39-0x000000001EDE0000-0x000000001EE88000-memory.dmpFilesize
672KB
-
memory/2092-41-0x000007FEF57F0000-0x000007FEF61DC000-memory.dmpFilesize
9.9MB
-
memory/2092-0-0x0000000000D20000-0x0000000000E96000-memory.dmpFilesize
1.5MB
-
memory/2092-46-0x000000001B050000-0x000000001B0D0000-memory.dmpFilesize
512KB
-
memory/2092-47-0x000000001B050000-0x000000001B0D0000-memory.dmpFilesize
512KB
-
memory/2092-49-0x000000001B050000-0x000000001B0D0000-memory.dmpFilesize
512KB
-
memory/2092-19-0x000000001B560000-0x000000001B57A000-memory.dmpFilesize
104KB
-
memory/2092-50-0x000000001B050000-0x000000001B0D0000-memory.dmpFilesize
512KB