Overview
overview
9Static
static
3FiddlerSetup.exe
windows7-x64
4FiddlerSetup.exe
windows10-2004-x64
9$PLUGINSDI...up.exe
windows7-x64
3$PLUGINSDI...up.exe
windows10-2004-x64
3$PLUGINSDI...em.dll
windows7-x64
3$PLUGINSDI...em.dll
windows10-2004-x64
3Analytics.dll
windows7-x64
1Analytics.dll
windows10-2004-x64
1Be.Windows...ox.dll
windows7-x64
1Be.Windows...ox.dll
windows10-2004-x64
1DotNetZip.dll
windows7-x64
1DotNetZip.dll
windows10-2004-x64
1EnableLoopback.exe
windows7-x64
1EnableLoopback.exe
windows10-2004-x64
5ExecAction.exe
windows7-x64
1ExecAction.exe
windows10-2004-x64
1FSE2.exe
windows7-x64
3FSE2.exe
windows10-2004-x64
3Fiddler.exe
windows7-x64
1Fiddler.exe
windows10-2004-x64
3ForceCPU.exe
windows7-x64
1ForceCPU.exe
windows10-2004-x64
1GA.Analyti...or.dll
windows7-x64
1GA.Analyti...or.dll
windows10-2004-x64
1ImportExpo...ts.dll
windows7-x64
1ImportExpo...ts.dll
windows10-2004-x64
1ImportExpo...rt.dll
windows7-x64
1ImportExpo...rt.dll
windows10-2004-x64
1Inspectors...on.dll
windows7-x64
1Inspectors...on.dll
windows10-2004-x64
1Inspectors...or.dll
windows7-x64
1Inspectors...or.dll
windows10-2004-x64
1Analysis
-
max time kernel
117s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
22-03-2024 17:25
Static task
static1
Behavioral task
behavioral1
Sample
FiddlerSetup.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
FiddlerSetup.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral3
Sample
$PLUGINSDIR/FiddlerSetup.exe
Resource
win7-20240221-en
Behavioral task
behavioral4
Sample
$PLUGINSDIR/FiddlerSetup.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral5
Sample
$PLUGINSDIR/System.dll
Resource
win7-20240221-en
Behavioral task
behavioral6
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20231215-en
Behavioral task
behavioral7
Sample
Analytics.dll
Resource
win7-20240215-en
Behavioral task
behavioral8
Sample
Analytics.dll
Resource
win10v2004-20240226-en
Behavioral task
behavioral9
Sample
Be.Windows.Forms.HexBox.dll
Resource
win7-20240221-en
Behavioral task
behavioral10
Sample
Be.Windows.Forms.HexBox.dll
Resource
win10v2004-20240226-en
Behavioral task
behavioral11
Sample
DotNetZip.dll
Resource
win7-20240221-en
Behavioral task
behavioral12
Sample
DotNetZip.dll
Resource
win10v2004-20240226-en
Behavioral task
behavioral13
Sample
EnableLoopback.exe
Resource
win7-20240221-en
Behavioral task
behavioral14
Sample
EnableLoopback.exe
Resource
win10v2004-20231215-en
Behavioral task
behavioral15
Sample
ExecAction.exe
Resource
win7-20240220-en
Behavioral task
behavioral16
Sample
ExecAction.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral17
Sample
FSE2.exe
Resource
win7-20240215-en
Behavioral task
behavioral18
Sample
FSE2.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral19
Sample
Fiddler.exe
Resource
win7-20240221-en
Behavioral task
behavioral20
Sample
Fiddler.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral21
Sample
ForceCPU.exe
Resource
win7-20240221-en
Behavioral task
behavioral22
Sample
ForceCPU.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral23
Sample
GA.Analytics.Monitor.dll
Resource
win7-20240221-en
Behavioral task
behavioral24
Sample
GA.Analytics.Monitor.dll
Resource
win10v2004-20240319-en
Behavioral task
behavioral25
Sample
ImportExport/BasicFormats.dll
Resource
win7-20240221-en
Behavioral task
behavioral26
Sample
ImportExport/BasicFormats.dll
Resource
win10v2004-20240226-en
Behavioral task
behavioral27
Sample
ImportExport/VSWebTestExport.dll
Resource
win7-20240215-en
Behavioral task
behavioral28
Sample
ImportExport/VSWebTestExport.dll
Resource
win10v2004-20240226-en
Behavioral task
behavioral29
Sample
Inspectors/QWhale.Common.dll
Resource
win7-20240221-en
Behavioral task
behavioral30
Sample
Inspectors/QWhale.Common.dll
Resource
win10v2004-20231215-en
Behavioral task
behavioral31
Sample
Inspectors/QWhale.Editor.dll
Resource
win7-20240220-en
Behavioral task
behavioral32
Sample
Inspectors/QWhale.Editor.dll
Resource
win10v2004-20240226-en
General
-
Target
Fiddler.exe
-
Size
1.5MB
-
MD5
a5b8c0f51898e9d55e4b3aa7904adf32
-
SHA1
5eaff276409670f3e8ce4cbb17086f1362d18868
-
SHA256
5e3006a575d4acce2e5e3cec684d7e9a1fbc3efbb73f06f5c4604faebf014ad3
-
SHA512
6abf01f09c8c6e430118de27322f4d67bf25018633544556630c47bfa9adc2c1fd186c94119a0b9be6c2d8dead9bbb46a8b1185fe02da2085601b0e9613ad427
-
SSDEEP
12288:nkcQS3I8s758yMQhaTqylrpxVKXgDPL5daRtriRStgz+/iUFu0o3AklQvleUl053:rOrc7WeJ3WZwo343m+pmjtSDN
Malware Config
Signatures
-
Processes:
Fiddler.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main Fiddler.exe -
Suspicious behavior: EnumeratesProcesses 17 IoCs
Processes:
Fiddler.exepid process 2168 Fiddler.exe 2168 Fiddler.exe 2168 Fiddler.exe 2168 Fiddler.exe 2168 Fiddler.exe 2168 Fiddler.exe 2168 Fiddler.exe 2168 Fiddler.exe 2168 Fiddler.exe 2168 Fiddler.exe 2168 Fiddler.exe 2168 Fiddler.exe 2168 Fiddler.exe 2168 Fiddler.exe 2168 Fiddler.exe 2168 Fiddler.exe 2168 Fiddler.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
Fiddler.exedescription pid process Token: SeDebugPrivilege 2168 Fiddler.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
Fiddler.exepid process 2168 Fiddler.exe 2168 Fiddler.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Fiddler.exe"C:\Users\Admin\AppData\Local\Temp\Fiddler.exe"1⤵
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:2168
-
C:\Windows\system32\wbem\WmiApSrv.exeC:\Windows\system32\wbem\WmiApSrv.exe1⤵PID:2828
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Progress_Software_Corpora\Fiddler.exe_Url_sblwdlp4jxb3bmuxfbi1zl1jd5acanau\5.0.20211.51073\user.config
Filesize966B
MD52c448ed2239dfa5215c72df3f3e3f3a2
SHA19d0bd4229e906b97a9b58044869ab06d7f1a38c7
SHA25602b88887582b3de13d041310d6596d4a14cbaa1fc8b17caef9b2f60e6bcad58f
SHA512ff0a05a2482d5b57d6304989a5890ca2f204c1d1991f6adcfa956d9cf2597040d188467747deb9b947674ce8c7458e00b688b169cea712e092efdd30d1764144