Overview
overview
4Static
static
3FiddlerSetup.exe
windows7-x64
4FiddlerSetup.exe
windows10-2004-x64
4$PLUGINSDI...up.exe
windows7-x64
3$PLUGINSDI...up.exe
windows10-2004-x64
3RunNsisUni...rs.bat
windows7-x64
1RunNsisUni...rs.bat
windows10-2004-x64
1ScriptEdit...cs.dll
windows7-x64
1ScriptEdit...cs.dll
windows10-2004-x64
1ScriptEdit...or.dll
windows7-x64
1ScriptEdit...or.dll
windows10-2004-x64
1ScriptEdit...on.dll
windows7-x64
1ScriptEdit...on.dll
windows10-2004-x64
1ScriptEdit...or.dll
windows7-x64
1ScriptEdit...or.dll
windows10-2004-x64
1ScriptEdit...rs.dll
windows7-x64
1ScriptEdit...rs.dll
windows10-2004-x64
1ScriptEdit...ax.dll
windows7-x64
1ScriptEdit...ax.dll
windows10-2004-x64
1Scripts/Fi...on.dll
windows7-x64
1Scripts/Fi...on.dll
windows10-2004-x64
1Scripts/Fi...on.dll
windows7-x64
1Scripts/Fi...on.dll
windows10-2004-x64
1Scripts/Fi...ol.dll
windows7-x64
1Scripts/Fi...ol.dll
windows10-2004-x64
1Scripts/Fi...es.dll
windows7-x64
1Scripts/Fi...es.dll
windows10-2004-x64
1Scripts/QW...on.dll
windows7-x64
1Scripts/QW...on.dll
windows10-2004-x64
1Scripts/QW...or.dll
windows7-x64
1Scripts/QW...or.dll
windows10-2004-x64
1Scripts/QW...rs.dll
windows7-x64
1Scripts/QW...rs.dll
windows10-2004-x64
1Analysis
-
max time kernel
118s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240611-en -
resource tags
arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system -
submitted
28-06-2024 20:37
Static task
static1
Behavioral task
behavioral1
Sample
FiddlerSetup.exe
Resource
win7-20240611-en
Behavioral task
behavioral2
Sample
FiddlerSetup.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral3
Sample
$PLUGINSDIR/FiddlerSetup.exe
Resource
win7-20240508-en
Behavioral task
behavioral4
Sample
$PLUGINSDIR/FiddlerSetup.exe
Resource
win10v2004-20240611-en
Behavioral task
behavioral5
Sample
RunNsisUninstallers.bat
Resource
win7-20231129-en
Behavioral task
behavioral6
Sample
RunNsisUninstallers.bat
Resource
win10v2004-20240226-en
Behavioral task
behavioral7
Sample
ScriptEditor/Analytics.dll
Resource
win7-20240611-en
Behavioral task
behavioral8
Sample
ScriptEditor/Analytics.dll
Resource
win10v2004-20240508-en
Behavioral task
behavioral9
Sample
ScriptEditor/GA.Analytics.Monitor.dll
Resource
win7-20231129-en
Behavioral task
behavioral10
Sample
ScriptEditor/GA.Analytics.Monitor.dll
Resource
win10v2004-20240611-en
Behavioral task
behavioral11
Sample
ScriptEditor/QWhale.Common.dll
Resource
win7-20240611-en
Behavioral task
behavioral12
Sample
ScriptEditor/QWhale.Common.dll
Resource
win10v2004-20240611-en
Behavioral task
behavioral13
Sample
ScriptEditor/QWhale.Editor.dll
Resource
win7-20240221-en
Behavioral task
behavioral14
Sample
ScriptEditor/QWhale.Editor.dll
Resource
win10v2004-20240508-en
Behavioral task
behavioral15
Sample
ScriptEditor/QWhale.Syntax.Parsers.dll
Resource
win7-20240419-en
Behavioral task
behavioral16
Sample
ScriptEditor/QWhale.Syntax.Parsers.dll
Resource
win10v2004-20240508-en
Behavioral task
behavioral17
Sample
ScriptEditor/QWhale.Syntax.dll
Resource
win7-20240508-en
Behavioral task
behavioral18
Sample
ScriptEditor/QWhale.Syntax.dll
Resource
win10v2004-20240508-en
Behavioral task
behavioral19
Sample
Scripts/FiddlerOrchestra.Addon.dll
Resource
win7-20240220-en
Behavioral task
behavioral20
Sample
Scripts/FiddlerOrchestra.Addon.dll
Resource
win10v2004-20240508-en
Behavioral task
behavioral21
Sample
Scripts/FiddlerOrchestra.Connection.dll
Resource
win7-20240611-en
Behavioral task
behavioral22
Sample
Scripts/FiddlerOrchestra.Connection.dll
Resource
win10v2004-20240611-en
Behavioral task
behavioral23
Sample
Scripts/FiddlerOrchestra.Protocol.dll
Resource
win7-20240220-en
Behavioral task
behavioral24
Sample
Scripts/FiddlerOrchestra.Protocol.dll
Resource
win10v2004-20240611-en
Behavioral task
behavioral25
Sample
Scripts/FiddlerOrchestra.Utilities.dll
Resource
win7-20240419-en
Behavioral task
behavioral26
Sample
Scripts/FiddlerOrchestra.Utilities.dll
Resource
win10v2004-20240508-en
Behavioral task
behavioral27
Sample
Scripts/QWhale.Common.dll
Resource
win7-20240508-en
Behavioral task
behavioral28
Sample
Scripts/QWhale.Common.dll
Resource
win10v2004-20240508-en
Behavioral task
behavioral29
Sample
Scripts/QWhale.Editor.dll
Resource
win7-20231129-en
Behavioral task
behavioral30
Sample
Scripts/QWhale.Editor.dll
Resource
win10v2004-20240508-en
Behavioral task
behavioral31
Sample
Scripts/QWhale.Syntax.Parsers.dll
Resource
win7-20240221-en
Behavioral task
behavioral32
Sample
Scripts/QWhale.Syntax.Parsers.dll
Resource
win10v2004-20240226-en
General
-
Target
FiddlerSetup.exe
-
Size
6.3MB
-
MD5
77a80b10028f9c800c5cbb5a80fde929
-
SHA1
7e8a8ce83bba6bec7b62cca06ae7680ef5c5ddec
-
SHA256
207e1a39c74a03ae535ad04fe74bc435baa777ecefaec95abe78664cd2b34690
-
SHA512
883600cb4d5114cef47dba6d7fde929c02f0f4d2baafa9dbb746fccfee92ebb6bfb02602e64dfb2c93b773abfdf8b49ac780b0c02414107761dd66e6999480bc
-
SSDEEP
98304:mIouszMd5OYRxqFu5rMnb8ELGUHjvYEarhIPAT99taafHOwRcxzv77Nd6fKnCKbX:FqzMSx3oohYTXt5WwREv77cKCKkBbYOY
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
Processes:
FiddlerSetup.exepid process 2936 FiddlerSetup.exe -
Loads dropped DLL 1 IoCs
Processes:
FiddlerSetup.exepid process 2392 FiddlerSetup.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
NSIS installer 2 IoCs
Processes:
resource yara_rule \Users\Admin\AppData\Local\Temp\nsy50DF.tmp\FiddlerSetup.exe nsis_installer_1 \Users\Admin\AppData\Local\Temp\nsy50DF.tmp\FiddlerSetup.exe nsis_installer_2 -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
FiddlerSetup.exepid process 2936 FiddlerSetup.exe -
Suspicious use of WriteProcessMemory 7 IoCs
Processes:
FiddlerSetup.exedescription pid process target process PID 2392 wrote to memory of 2936 2392 FiddlerSetup.exe FiddlerSetup.exe PID 2392 wrote to memory of 2936 2392 FiddlerSetup.exe FiddlerSetup.exe PID 2392 wrote to memory of 2936 2392 FiddlerSetup.exe FiddlerSetup.exe PID 2392 wrote to memory of 2936 2392 FiddlerSetup.exe FiddlerSetup.exe PID 2392 wrote to memory of 2936 2392 FiddlerSetup.exe FiddlerSetup.exe PID 2392 wrote to memory of 2936 2392 FiddlerSetup.exe FiddlerSetup.exe PID 2392 wrote to memory of 2936 2392 FiddlerSetup.exe FiddlerSetup.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\FiddlerSetup.exe"C:\Users\Admin\AppData\Local\Temp\FiddlerSetup.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\nsy50DF.tmp\FiddlerSetup.exe"C:\Users\Admin\AppData\Local\Temp\nsy50DF.tmp\FiddlerSetup.exe" /D=2⤵
- Executes dropped EXE
- Suspicious behavior: GetForegroundWindowSpam
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
\Users\Admin\AppData\Local\Temp\nsy50DF.tmp\FiddlerSetup.exeFilesize
3.1MB
MD57e3090e237b9f252efc88d097f71ed47
SHA18a1cae86f421c4c74f7f543609826cfc472e5fa8
SHA25691547aa10f5b4d1be95c7bfa289499ded2b65d1070ec6fce0208e61771df5318
SHA512378d29ca00b73ff5b729d6bc39e63b61f833f7baad9d806db77ee7acab993b3b567f7e533aae2178bf8a9391bc8d205aadd72d75a29a71c0f2827196ff040afa