68b2c094a9db953e19588e032c462de9070d8370fe909dfd4ccefc9557f7993c

Analysis

max time kernel
150s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
28-09-2024 08:07

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

fideo.exe
Size

172.0MB
MD5

f877855851d8a48adc29431b6b46a3b7
SHA1

6103fe440d8c9d3fbd9ea15254de40348b39dc96
SHA256

5048cb9ab6308a62de9ba1f8c43533f80ede6831b171dedb9e65a94e64456488
SHA512

1a4d9eeb58f3b08c6e5c5b010f707ab01615b73aaa3526e49cc38c34cbd16f4a5ad2e9f825ed8d0efbe50d3dedbbc54a92e1ac940c807c86c279c01ef4b61b9a
SSDEEP

1572864:LSl+fyef/Uzaajg8s20fFbu2/zi9Gd7ePKro1yjrWR5xWVFYxNxOLh:texNoL

Score

7^/10

Malware Config

Signatures

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

fideo.exefideo.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000\Control Panel\International\Geo\Nation	fideo.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000\Control Panel\International\Geo\Nation	fideo.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

fideo.exe

pid process

2348 fideo.exe
2348 fideo.exe

pid	process
2348	fideo.exe
2348	fideo.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

fideo.exe

description	pid	process
Token: SeShutdownPrivilege	2368	fideo.exe
Token: SeCreatePagefilePrivilege	2368	fideo.exe
Token: SeShutdownPrivilege	2368	fideo.exe
Token: SeCreatePagefilePrivilege	2368	fideo.exe
Token: SeShutdownPrivilege	2368	fideo.exe
Token: SeCreatePagefilePrivilege	2368	fideo.exe
Token: SeShutdownPrivilege	2368	fideo.exe
Token: SeCreatePagefilePrivilege	2368	fideo.exe
Token: SeShutdownPrivilege	2368	fideo.exe
Token: SeCreatePagefilePrivilege	2368	fideo.exe
Token: SeShutdownPrivilege	2368	fideo.exe
Token: SeCreatePagefilePrivilege	2368	fideo.exe
Token: SeShutdownPrivilege	2368	fideo.exe
Token: SeCreatePagefilePrivilege	2368	fideo.exe
Token: SeShutdownPrivilege	2368	fideo.exe
Token: SeCreatePagefilePrivilege	2368	fideo.exe
Token: SeShutdownPrivilege	2368	fideo.exe
Token: SeCreatePagefilePrivilege	2368	fideo.exe
Token: SeShutdownPrivilege	2368	fideo.exe
Token: SeCreatePagefilePrivilege	2368	fideo.exe
Token: SeShutdownPrivilege	2368	fideo.exe
Token: SeCreatePagefilePrivilege	2368	fideo.exe
Token: SeShutdownPrivilege	2368	fideo.exe
Token: SeCreatePagefilePrivilege	2368	fideo.exe
Token: SeShutdownPrivilege	2368	fideo.exe
Token: SeCreatePagefilePrivilege	2368	fideo.exe
Token: SeShutdownPrivilege	2368	fideo.exe
Token: SeCreatePagefilePrivilege	2368	fideo.exe
Token: SeShutdownPrivilege	2368	fideo.exe
Token: SeCreatePagefilePrivilege	2368	fideo.exe
Token: SeShutdownPrivilege	2368	fideo.exe
Token: SeCreatePagefilePrivilege	2368	fideo.exe
Token: SeShutdownPrivilege	2368	fideo.exe
Token: SeCreatePagefilePrivilege	2368	fideo.exe
Token: SeShutdownPrivilege	2368	fideo.exe
Token: SeCreatePagefilePrivilege	2368	fideo.exe
Token: SeShutdownPrivilege	2368	fideo.exe
Token: SeCreatePagefilePrivilege	2368	fideo.exe
Token: SeShutdownPrivilege	2368	fideo.exe
Token: SeCreatePagefilePrivilege	2368	fideo.exe
Token: SeShutdownPrivilege	2368	fideo.exe
Token: SeCreatePagefilePrivilege	2368	fideo.exe
Token: SeShutdownPrivilege	2368	fideo.exe
Token: SeCreatePagefilePrivilege	2368	fideo.exe
Token: SeShutdownPrivilege	2368	fideo.exe
Token: SeCreatePagefilePrivilege	2368	fideo.exe
Token: SeShutdownPrivilege	2368	fideo.exe
Token: SeCreatePagefilePrivilege	2368	fideo.exe
Token: SeShutdownPrivilege	2368	fideo.exe
Token: SeCreatePagefilePrivilege	2368	fideo.exe
Token: SeShutdownPrivilege	2368	fideo.exe
Token: SeCreatePagefilePrivilege	2368	fideo.exe
Token: SeShutdownPrivilege	2368	fideo.exe
Token: SeCreatePagefilePrivilege	2368	fideo.exe
Token: SeShutdownPrivilege	2368	fideo.exe
Token: SeCreatePagefilePrivilege	2368	fideo.exe
Token: SeShutdownPrivilege	2368	fideo.exe
Token: SeCreatePagefilePrivilege	2368	fideo.exe
Token: SeShutdownPrivilege	2368	fideo.exe
Token: SeCreatePagefilePrivilege	2368	fideo.exe
Token: SeShutdownPrivilege	2368	fideo.exe
Token: SeCreatePagefilePrivilege	2368	fideo.exe
Token: SeShutdownPrivilege	2368	fideo.exe
Token: SeCreatePagefilePrivilege	2368	fideo.exe

Suspicious use of WriteProcessMemory 36 IoCs

Processes:

fideo.exe

description	pid	process	target process
PID 2368 wrote to memory of 2364	2368	fideo.exe	fideo.exe
PID 2368 wrote to memory of 2364	2368	fideo.exe	fideo.exe
PID 2368 wrote to memory of 2364	2368	fideo.exe	fideo.exe
PID 2368 wrote to memory of 2364	2368	fideo.exe	fideo.exe
PID 2368 wrote to memory of 2364	2368	fideo.exe	fideo.exe
PID 2368 wrote to memory of 2364	2368	fideo.exe	fideo.exe
PID 2368 wrote to memory of 2364	2368	fideo.exe	fideo.exe
PID 2368 wrote to memory of 2364	2368	fideo.exe	fideo.exe
PID 2368 wrote to memory of 2364	2368	fideo.exe	fideo.exe
PID 2368 wrote to memory of 2364	2368	fideo.exe	fideo.exe
PID 2368 wrote to memory of 2364	2368	fideo.exe	fideo.exe
PID 2368 wrote to memory of 2364	2368	fideo.exe	fideo.exe
PID 2368 wrote to memory of 2364	2368	fideo.exe	fideo.exe
PID 2368 wrote to memory of 2364	2368	fideo.exe	fideo.exe
PID 2368 wrote to memory of 2364	2368	fideo.exe	fideo.exe
PID 2368 wrote to memory of 2364	2368	fideo.exe	fideo.exe
PID 2368 wrote to memory of 2364	2368	fideo.exe	fideo.exe
PID 2368 wrote to memory of 2364	2368	fideo.exe	fideo.exe
PID 2368 wrote to memory of 2364	2368	fideo.exe	fideo.exe
PID 2368 wrote to memory of 2364	2368	fideo.exe	fideo.exe
PID 2368 wrote to memory of 2364	2368	fideo.exe	fideo.exe
PID 2368 wrote to memory of 2364	2368	fideo.exe	fideo.exe
PID 2368 wrote to memory of 2364	2368	fideo.exe	fideo.exe
PID 2368 wrote to memory of 2364	2368	fideo.exe	fideo.exe
PID 2368 wrote to memory of 2364	2368	fideo.exe	fideo.exe
PID 2368 wrote to memory of 2364	2368	fideo.exe	fideo.exe
PID 2368 wrote to memory of 2364	2368	fideo.exe	fideo.exe
PID 2368 wrote to memory of 2364	2368	fideo.exe	fideo.exe
PID 2368 wrote to memory of 2364	2368	fideo.exe	fideo.exe
PID 2368 wrote to memory of 2364	2368	fideo.exe	fideo.exe
PID 2368 wrote to memory of 2216	2368	fideo.exe	fideo.exe
PID 2368 wrote to memory of 2216	2368	fideo.exe	fideo.exe
PID 2368 wrote to memory of 4068	2368	fideo.exe	fideo.exe
PID 2368 wrote to memory of 4068	2368	fideo.exe	fideo.exe
PID 2368 wrote to memory of 2348	2368	fideo.exe	fideo.exe
PID 2368 wrote to memory of 2348	2368	fideo.exe	fideo.exe

C:\Users\Admin\AppData\Local\Temp\fideo.exe
"C:\Users\Admin\AppData\Local\Temp\fideo.exe"
1⤵
- Checks computer location settings
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2368
- C:\Users\Admin\AppData\Local\Temp\fideo.exe
  "C:\Users\Admin\AppData\Local\Temp\fideo.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\fideo" --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1732,i,1161162300979220799,17167894147198857629,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=1724 /prefetch:2
  2⤵
  PID:2364
- C:\Users\Admin\AppData\Local\Temp\fideo.exe
  "C:\Users\Admin\AppData\Local\Temp\fideo.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\fideo" --field-trial-handle=2188,i,1161162300979220799,17167894147198857629,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=2184 /prefetch:3
  2⤵
  PID:2216
- C:\Users\Admin\AppData\Local\Temp\fideo.exe
  "C:\Users\Admin\AppData\Local\Temp\fideo.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\fideo" --app-user-model-id=site.fideo.app --app-path="C:\Users\Admin\AppData\Local\Temp\resources\app.asar" --no-sandbox --no-zygote --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=4 --field-trial-handle=2484,i,1161162300979220799,17167894147198857629,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=2480 /prefetch:1
  2⤵
  - Checks computer location settings
  PID:4068
- C:\Users\Admin\AppData\Local\Temp\fideo.exe
  "C:\Users\Admin\AppData\Local\Temp\fideo.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --user-data-dir="C:\Users\Admin\AppData\Roaming\fideo" --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=2472,i,1161162300979220799,17167894147198857629,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=912 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2348

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dic

Filesize
2B

MD5
f3b25701fe362ec84616a93a45ce9998

SHA1
d62636d8caec13f04e28442a0a6fa1afeb024bbb

SHA256
b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209

SHA512
98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84

Download Submit
C:\Users\Admin\AppData\Roaming\fideo\IndexedDB\file__0.indexeddb.leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Roaming\fideo\Network\Network Persistent State

Filesize
300B

MD5
f13bfdee4ec7b522ab6df4086a0d375b

SHA1
7dcb718ea4fd5b350236b383441167ce71278260

SHA256
c2749100a4636e165f093bad6296e61b737de07730950fcf029fe9c2c6e2092a

SHA512
fdf24e8824f4b4063d9e8de1cebbb1e20cfa2bae4830e115b2639dbdec47c8d93f741eca3880f55c187ef0de9a9e84f590b31ddf12b5ee3f25b031f7d2b64fa4

Download Submit
C:\Users\Admin\AppData\Roaming\fideo\Network\Network Persistent State~RFe58de16.TMP

Filesize
59B

MD5
2800881c775077e1c4b6e06bf4676de4

SHA1
2873631068c8b3b9495638c865915be822442c8b

SHA256
226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974

SHA512
e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b

Download Submit
memory/2348-91-0x000002A2EBAA0000-0x000002A2EBAA1000-memory.dmp

Filesize
4KB

Download
memory/2348-93-0x000002A2EBAA0000-0x000002A2EBAA1000-memory.dmp

Filesize
4KB

Download
memory/2348-92-0x000002A2EBAA0000-0x000002A2EBAA1000-memory.dmp

Filesize
4KB

Download
memory/2348-97-0x000002A2EBAA0000-0x000002A2EBAA1000-memory.dmp

Filesize
4KB

Download
memory/2348-98-0x000002A2EBAA0000-0x000002A2EBAA1000-memory.dmp

Filesize
4KB

Download
memory/2348-103-0x000002A2EBAA0000-0x000002A2EBAA1000-memory.dmp

Filesize
4KB

Download
memory/2348-102-0x000002A2EBAA0000-0x000002A2EBAA1000-memory.dmp

Filesize
4KB

Download
memory/2348-101-0x000002A2EBAA0000-0x000002A2EBAA1000-memory.dmp

Filesize
4KB

Download
memory/2348-100-0x000002A2EBAA0000-0x000002A2EBAA1000-memory.dmp

Filesize
4KB

Download
memory/2348-99-0x000002A2EBAA0000-0x000002A2EBAA1000-memory.dmp

Filesize
4KB

Download