68b2c094a9db953e19588e032c462de9070d8370fe909dfd4ccefc9557f7993c

Analysis

max time kernel
150s
max time network
162s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
28-09-2024 08:19

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

fideo.exe
Size

172.0MB
MD5

f877855851d8a48adc29431b6b46a3b7
SHA1

6103fe440d8c9d3fbd9ea15254de40348b39dc96
SHA256

5048cb9ab6308a62de9ba1f8c43533f80ede6831b171dedb9e65a94e64456488
SHA512

1a4d9eeb58f3b08c6e5c5b010f707ab01615b73aaa3526e49cc38c34cbd16f4a5ad2e9f825ed8d0efbe50d3dedbbc54a92e1ac940c807c86c279c01ef4b61b9a
SSDEEP

1572864:LSl+fyef/Uzaajg8s20fFbu2/zi9Gd7ePKro1yjrWR5xWVFYxNxOLh:texNoL

Score

7^/10

Malware Config

Signatures

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\Control Panel\International\Geo\Nation	fideo.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\Control Panel\International\Geo\Nation	fideo.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2768	fideo.exe
2768	fideo.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	344	fideo.exe
Token: SeCreatePagefilePrivilege	344	fideo.exe
Token: SeShutdownPrivilege	344	fideo.exe
Token: SeCreatePagefilePrivilege	344	fideo.exe
Token: SeShutdownPrivilege	344	fideo.exe
Token: SeCreatePagefilePrivilege	344	fideo.exe
Token: SeShutdownPrivilege	344	fideo.exe
Token: SeCreatePagefilePrivilege	344	fideo.exe
Token: SeShutdownPrivilege	344	fideo.exe
Token: SeCreatePagefilePrivilege	344	fideo.exe
Token: SeShutdownPrivilege	344	fideo.exe
Token: SeCreatePagefilePrivilege	344	fideo.exe
Token: SeShutdownPrivilege	344	fideo.exe
Token: SeCreatePagefilePrivilege	344	fideo.exe
Token: SeShutdownPrivilege	344	fideo.exe
Token: SeCreatePagefilePrivilege	344	fideo.exe
Token: SeShutdownPrivilege	344	fideo.exe
Token: SeCreatePagefilePrivilege	344	fideo.exe
Token: SeShutdownPrivilege	344	fideo.exe
Token: SeCreatePagefilePrivilege	344	fideo.exe
Token: SeShutdownPrivilege	344	fideo.exe
Token: SeCreatePagefilePrivilege	344	fideo.exe
Token: SeShutdownPrivilege	344	fideo.exe
Token: SeCreatePagefilePrivilege	344	fideo.exe
Token: SeShutdownPrivilege	344	fideo.exe
Token: SeCreatePagefilePrivilege	344	fideo.exe
Token: SeShutdownPrivilege	344	fideo.exe
Token: SeCreatePagefilePrivilege	344	fideo.exe
Token: SeShutdownPrivilege	344	fideo.exe
Token: SeCreatePagefilePrivilege	344	fideo.exe
Token: SeShutdownPrivilege	344	fideo.exe
Token: SeCreatePagefilePrivilege	344	fideo.exe
Token: SeShutdownPrivilege	344	fideo.exe
Token: SeCreatePagefilePrivilege	344	fideo.exe
Token: SeShutdownPrivilege	344	fideo.exe
Token: SeCreatePagefilePrivilege	344	fideo.exe
Token: SeShutdownPrivilege	344	fideo.exe
Token: SeCreatePagefilePrivilege	344	fideo.exe
Token: SeShutdownPrivilege	344	fideo.exe
Token: SeCreatePagefilePrivilege	344	fideo.exe
Token: SeShutdownPrivilege	344	fideo.exe
Token: SeCreatePagefilePrivilege	344	fideo.exe
Token: SeShutdownPrivilege	344	fideo.exe
Token: SeCreatePagefilePrivilege	344	fideo.exe
Token: SeShutdownPrivilege	344	fideo.exe
Token: SeCreatePagefilePrivilege	344	fideo.exe
Token: SeShutdownPrivilege	344	fideo.exe
Token: SeCreatePagefilePrivilege	344	fideo.exe
Token: SeShutdownPrivilege	344	fideo.exe
Token: SeCreatePagefilePrivilege	344	fideo.exe
Token: SeShutdownPrivilege	344	fideo.exe
Token: SeCreatePagefilePrivilege	344	fideo.exe
Token: SeShutdownPrivilege	344	fideo.exe
Token: SeCreatePagefilePrivilege	344	fideo.exe
Token: SeShutdownPrivilege	344	fideo.exe
Token: SeCreatePagefilePrivilege	344	fideo.exe
Token: SeShutdownPrivilege	344	fideo.exe
Token: SeCreatePagefilePrivilege	344	fideo.exe
Token: SeShutdownPrivilege	344	fideo.exe
Token: SeCreatePagefilePrivilege	344	fideo.exe
Token: SeShutdownPrivilege	344	fideo.exe
Token: SeCreatePagefilePrivilege	344	fideo.exe
Token: SeShutdownPrivilege	344	fideo.exe
Token: SeCreatePagefilePrivilege	344	fideo.exe

Suspicious use of WriteProcessMemory 36 IoCs

description	pid	Process	procid_target
PID 344 wrote to memory of 2608	344	fideo.exe	81
PID 344 wrote to memory of 2608	344	fideo.exe	81
PID 344 wrote to memory of 2608	344	fideo.exe	81
PID 344 wrote to memory of 2608	344	fideo.exe	81
PID 344 wrote to memory of 2608	344	fideo.exe	81
PID 344 wrote to memory of 2608	344	fideo.exe	81
PID 344 wrote to memory of 2608	344	fideo.exe	81
PID 344 wrote to memory of 2608	344	fideo.exe	81
PID 344 wrote to memory of 2608	344	fideo.exe	81
PID 344 wrote to memory of 2608	344	fideo.exe	81
PID 344 wrote to memory of 2608	344	fideo.exe	81
PID 344 wrote to memory of 2608	344	fideo.exe	81
PID 344 wrote to memory of 2608	344	fideo.exe	81
PID 344 wrote to memory of 2608	344	fideo.exe	81
PID 344 wrote to memory of 2608	344	fideo.exe	81
PID 344 wrote to memory of 2608	344	fideo.exe	81
PID 344 wrote to memory of 2608	344	fideo.exe	81
PID 344 wrote to memory of 2608	344	fideo.exe	81
PID 344 wrote to memory of 2608	344	fideo.exe	81
PID 344 wrote to memory of 2608	344	fideo.exe	81
PID 344 wrote to memory of 2608	344	fideo.exe	81
PID 344 wrote to memory of 2608	344	fideo.exe	81
PID 344 wrote to memory of 2608	344	fideo.exe	81
PID 344 wrote to memory of 2608	344	fideo.exe	81
PID 344 wrote to memory of 2608	344	fideo.exe	81
PID 344 wrote to memory of 2608	344	fideo.exe	81
PID 344 wrote to memory of 2608	344	fideo.exe	81
PID 344 wrote to memory of 2608	344	fideo.exe	81
PID 344 wrote to memory of 2608	344	fideo.exe	81
PID 344 wrote to memory of 2608	344	fideo.exe	81
PID 344 wrote to memory of 2304	344	fideo.exe	82
PID 344 wrote to memory of 2304	344	fideo.exe	82
PID 344 wrote to memory of 2976	344	fideo.exe	83
PID 344 wrote to memory of 2976	344	fideo.exe	83
PID 344 wrote to memory of 2768	344	fideo.exe	93
PID 344 wrote to memory of 2768	344	fideo.exe	93

C:\Users\Admin\AppData\Local\Temp\fideo.exe
"C:\Users\Admin\AppData\Local\Temp\fideo.exe"
1⤵
- Checks computer location settings
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:344
- C:\Users\Admin\AppData\Local\Temp\fideo.exe
  "C:\Users\Admin\AppData\Local\Temp\fideo.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\fideo" --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1712,i,13716030426657860851,8441929552989108734,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=1704 /prefetch:2
  2⤵
  PID:2608
- C:\Users\Admin\AppData\Local\Temp\fideo.exe
  "C:\Users\Admin\AppData\Local\Temp\fideo.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\fideo" --field-trial-handle=2120,i,13716030426657860851,8441929552989108734,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=2116 /prefetch:3
  2⤵
  PID:2304
- C:\Users\Admin\AppData\Local\Temp\fideo.exe
  "C:\Users\Admin\AppData\Local\Temp\fideo.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\fideo" --app-user-model-id=site.fideo.app --app-path="C:\Users\Admin\AppData\Local\Temp\resources\app.asar" --no-sandbox --no-zygote --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=4 --field-trial-handle=2468,i,13716030426657860851,8441929552989108734,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=2464 /prefetch:1
  2⤵
  - Checks computer location settings
  PID:2976
- C:\Users\Admin\AppData\Local\Temp\fideo.exe
  "C:\Users\Admin\AppData\Local\Temp\fideo.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --user-data-dir="C:\Users\Admin\AppData\Roaming\fideo" --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=2544,i,13716030426657860851,8441929552989108734,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=2540 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2768

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dic

Filesize
2B

MD5
f3b25701fe362ec84616a93a45ce9998

SHA1
d62636d8caec13f04e28442a0a6fa1afeb024bbb

SHA256
b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209

SHA512
98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84

Download Submit
C:\Users\Admin\AppData\Roaming\fideo\IndexedDB\file__0.indexeddb.leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Roaming\fideo\Network\Network Persistent State

Filesize
300B

MD5
12643eaac7c972ca8a71404039fd34d7

SHA1
60a07709697fc2db7e836bd32f4f52267cef9546

SHA256
5e1db608484f30bcfdc3273b2add9857489aac8e79ada9b69911ad50a8c69bd8

SHA512
dcdaa9c78699ee67aee4c311824530a21dcd091abf26902594bdc0bbcdca1446c61da8fcf713fa65b41e2ea5dce762abca4cc4036491fd65b9496959c5c1e21c

Download Submit
C:\Users\Admin\AppData\Roaming\fideo\Network\Network Persistent State~RFe591e2d.TMP

Filesize
59B

MD5
2800881c775077e1c4b6e06bf4676de4

SHA1
2873631068c8b3b9495638c865915be822442c8b

SHA256
226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974

SHA512
e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b

Download Submit
memory/2768-91-0x00000208AB4B0000-0x00000208AB4B1000-memory.dmp

Filesize
4KB

Download
memory/2768-93-0x00000208AB4B0000-0x00000208AB4B1000-memory.dmp

Filesize
4KB

Download
memory/2768-92-0x00000208AB4B0000-0x00000208AB4B1000-memory.dmp

Filesize
4KB

Download
memory/2768-97-0x00000208AB4B0000-0x00000208AB4B1000-memory.dmp

Filesize
4KB

Download
memory/2768-99-0x00000208AB4B0000-0x00000208AB4B1000-memory.dmp

Filesize
4KB

Download
memory/2768-103-0x00000208AB4B0000-0x00000208AB4B1000-memory.dmp

Filesize
4KB

Download
memory/2768-102-0x00000208AB4B0000-0x00000208AB4B1000-memory.dmp

Filesize
4KB

Download
memory/2768-101-0x00000208AB4B0000-0x00000208AB4B1000-memory.dmp

Filesize
4KB

Download
memory/2768-100-0x00000208AB4B0000-0x00000208AB4B1000-memory.dmp

Filesize
4KB

Download
memory/2768-98-0x00000208AB4B0000-0x00000208AB4B1000-memory.dmp

Filesize
4KB

Download