68b2c094a9db953e19588e032c462de9070d8370fe909dfd4ccefc9557f7993c

Analysis

max time kernel
150s
max time network
157s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
29-09-2024 01:18

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

fideo.exe
Size

172.0MB
MD5

f877855851d8a48adc29431b6b46a3b7
SHA1

6103fe440d8c9d3fbd9ea15254de40348b39dc96
SHA256

5048cb9ab6308a62de9ba1f8c43533f80ede6831b171dedb9e65a94e64456488
SHA512

1a4d9eeb58f3b08c6e5c5b010f707ab01615b73aaa3526e49cc38c34cbd16f4a5ad2e9f825ed8d0efbe50d3dedbbc54a92e1ac940c807c86c279c01ef4b61b9a
SSDEEP

1572864:LSl+fyef/Uzaajg8s20fFbu2/zi9Gd7ePKro1yjrWR5xWVFYxNxOLh:texNoL

Score

7^/10

Malware Config

Signatures

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\Control Panel\International\Geo\Nation	fideo.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\Control Panel\International\Geo\Nation	fideo.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4972	fideo.exe
4972	fideo.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	2000	fideo.exe
Token: SeCreatePagefilePrivilege	2000	fideo.exe
Token: SeShutdownPrivilege	2000	fideo.exe
Token: SeCreatePagefilePrivilege	2000	fideo.exe
Token: SeShutdownPrivilege	2000	fideo.exe
Token: SeCreatePagefilePrivilege	2000	fideo.exe
Token: SeShutdownPrivilege	2000	fideo.exe
Token: SeCreatePagefilePrivilege	2000	fideo.exe
Token: SeShutdownPrivilege	2000	fideo.exe
Token: SeCreatePagefilePrivilege	2000	fideo.exe
Token: SeShutdownPrivilege	2000	fideo.exe
Token: SeCreatePagefilePrivilege	2000	fideo.exe
Token: SeShutdownPrivilege	2000	fideo.exe
Token: SeCreatePagefilePrivilege	2000	fideo.exe
Token: SeShutdownPrivilege	2000	fideo.exe
Token: SeCreatePagefilePrivilege	2000	fideo.exe
Token: SeShutdownPrivilege	2000	fideo.exe
Token: SeCreatePagefilePrivilege	2000	fideo.exe
Token: SeShutdownPrivilege	2000	fideo.exe
Token: SeCreatePagefilePrivilege	2000	fideo.exe
Token: SeShutdownPrivilege	2000	fideo.exe
Token: SeCreatePagefilePrivilege	2000	fideo.exe
Token: SeShutdownPrivilege	2000	fideo.exe
Token: SeCreatePagefilePrivilege	2000	fideo.exe
Token: SeShutdownPrivilege	2000	fideo.exe
Token: SeCreatePagefilePrivilege	2000	fideo.exe
Token: SeShutdownPrivilege	2000	fideo.exe
Token: SeCreatePagefilePrivilege	2000	fideo.exe
Token: SeShutdownPrivilege	2000	fideo.exe
Token: SeCreatePagefilePrivilege	2000	fideo.exe
Token: SeShutdownPrivilege	2000	fideo.exe
Token: SeCreatePagefilePrivilege	2000	fideo.exe
Token: SeShutdownPrivilege	2000	fideo.exe
Token: SeCreatePagefilePrivilege	2000	fideo.exe
Token: SeShutdownPrivilege	2000	fideo.exe
Token: SeCreatePagefilePrivilege	2000	fideo.exe
Token: SeShutdownPrivilege	2000	fideo.exe
Token: SeCreatePagefilePrivilege	2000	fideo.exe
Token: SeShutdownPrivilege	2000	fideo.exe
Token: SeCreatePagefilePrivilege	2000	fideo.exe
Token: SeShutdownPrivilege	2000	fideo.exe
Token: SeCreatePagefilePrivilege	2000	fideo.exe
Token: SeShutdownPrivilege	2000	fideo.exe
Token: SeCreatePagefilePrivilege	2000	fideo.exe
Token: SeShutdownPrivilege	2000	fideo.exe
Token: SeCreatePagefilePrivilege	2000	fideo.exe
Token: SeShutdownPrivilege	2000	fideo.exe
Token: SeCreatePagefilePrivilege	2000	fideo.exe
Token: SeShutdownPrivilege	2000	fideo.exe
Token: SeCreatePagefilePrivilege	2000	fideo.exe
Token: SeShutdownPrivilege	2000	fideo.exe
Token: SeCreatePagefilePrivilege	2000	fideo.exe
Token: SeShutdownPrivilege	2000	fideo.exe
Token: SeCreatePagefilePrivilege	2000	fideo.exe
Token: SeShutdownPrivilege	2000	fideo.exe
Token: SeCreatePagefilePrivilege	2000	fideo.exe
Token: SeShutdownPrivilege	2000	fideo.exe
Token: SeCreatePagefilePrivilege	2000	fideo.exe
Token: SeShutdownPrivilege	2000	fideo.exe
Token: SeCreatePagefilePrivilege	2000	fideo.exe
Token: SeShutdownPrivilege	2000	fideo.exe
Token: SeCreatePagefilePrivilege	2000	fideo.exe
Token: SeShutdownPrivilege	2000	fideo.exe
Token: SeCreatePagefilePrivilege	2000	fideo.exe

Suspicious use of WriteProcessMemory 36 IoCs

description	pid	Process	procid_target
PID 2000 wrote to memory of 3712	2000	fideo.exe	81
PID 2000 wrote to memory of 3712	2000	fideo.exe	81
PID 2000 wrote to memory of 3712	2000	fideo.exe	81
PID 2000 wrote to memory of 3712	2000	fideo.exe	81
PID 2000 wrote to memory of 3712	2000	fideo.exe	81
PID 2000 wrote to memory of 3712	2000	fideo.exe	81
PID 2000 wrote to memory of 3712	2000	fideo.exe	81
PID 2000 wrote to memory of 3712	2000	fideo.exe	81
PID 2000 wrote to memory of 3712	2000	fideo.exe	81
PID 2000 wrote to memory of 3712	2000	fideo.exe	81
PID 2000 wrote to memory of 3712	2000	fideo.exe	81
PID 2000 wrote to memory of 3712	2000	fideo.exe	81
PID 2000 wrote to memory of 3712	2000	fideo.exe	81
PID 2000 wrote to memory of 3712	2000	fideo.exe	81
PID 2000 wrote to memory of 3712	2000	fideo.exe	81
PID 2000 wrote to memory of 3712	2000	fideo.exe	81
PID 2000 wrote to memory of 3712	2000	fideo.exe	81
PID 2000 wrote to memory of 3712	2000	fideo.exe	81
PID 2000 wrote to memory of 3712	2000	fideo.exe	81
PID 2000 wrote to memory of 3712	2000	fideo.exe	81
PID 2000 wrote to memory of 3712	2000	fideo.exe	81
PID 2000 wrote to memory of 3712	2000	fideo.exe	81
PID 2000 wrote to memory of 3712	2000	fideo.exe	81
PID 2000 wrote to memory of 3712	2000	fideo.exe	81
PID 2000 wrote to memory of 3712	2000	fideo.exe	81
PID 2000 wrote to memory of 3712	2000	fideo.exe	81
PID 2000 wrote to memory of 3712	2000	fideo.exe	81
PID 2000 wrote to memory of 3712	2000	fideo.exe	81
PID 2000 wrote to memory of 3712	2000	fideo.exe	81
PID 2000 wrote to memory of 3712	2000	fideo.exe	81
PID 2000 wrote to memory of 1308	2000	fideo.exe	82
PID 2000 wrote to memory of 1308	2000	fideo.exe	82
PID 2000 wrote to memory of 2292	2000	fideo.exe	83
PID 2000 wrote to memory of 2292	2000	fideo.exe	83
PID 2000 wrote to memory of 4972	2000	fideo.exe	93
PID 2000 wrote to memory of 4972	2000	fideo.exe	93

C:\Users\Admin\AppData\Local\Temp\fideo.exe
"C:\Users\Admin\AppData\Local\Temp\fideo.exe"
1⤵
- Checks computer location settings
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2000
- C:\Users\Admin\AppData\Local\Temp\fideo.exe
  "C:\Users\Admin\AppData\Local\Temp\fideo.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\fideo" --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1764,i,1467509198791216879,3782008902684945457,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=1756 /prefetch:2
  2⤵
  PID:3712
- C:\Users\Admin\AppData\Local\Temp\fideo.exe
  "C:\Users\Admin\AppData\Local\Temp\fideo.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\fideo" --field-trial-handle=2220,i,1467509198791216879,3782008902684945457,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=2216 /prefetch:3
  2⤵
  PID:1308
- C:\Users\Admin\AppData\Local\Temp\fideo.exe
  "C:\Users\Admin\AppData\Local\Temp\fideo.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\fideo" --app-user-model-id=site.fideo.app --app-path="C:\Users\Admin\AppData\Local\Temp\resources\app.asar" --no-sandbox --no-zygote --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=4 --field-trial-handle=2408,i,1467509198791216879,3782008902684945457,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=2404 /prefetch:1
  2⤵
  - Checks computer location settings
  PID:2292
- C:\Users\Admin\AppData\Local\Temp\fideo.exe
  "C:\Users\Admin\AppData\Local\Temp\fideo.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --user-data-dir="C:\Users\Admin\AppData\Roaming\fideo" --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=3336,i,1467509198791216879,3782008902684945457,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=2380 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4972

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dic

Filesize
2B

MD5
f3b25701fe362ec84616a93a45ce9998

SHA1
d62636d8caec13f04e28442a0a6fa1afeb024bbb

SHA256
b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209

SHA512
98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84

Download Submit
C:\Users\Admin\AppData\Roaming\fideo\IndexedDB\file__0.indexeddb.leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Roaming\fideo\Network\Network Persistent State

Filesize
300B

MD5
4335408712afc80dae5113dcd4a95535

SHA1
710b176c8ff173ec804b7f514a7ffff07521e5a9

SHA256
f481b8772f2919850cc4691fede4f52a5e6e1f7e134c6319cfa3d5c97c61b35b

SHA512
bf13f8b19c1411916e4bffe8c813d81aaaf3ebf5215d5b725e1bf59fe8c9663d1960a21432e011580c2e45e41c6c86d527dc051f7d030e80c5f5deb83a8aaf2d

Download Submit
C:\Users\Admin\AppData\Roaming\fideo\Network\Network Persistent State~RFe58ea9a.TMP

Filesize
59B

MD5
2800881c775077e1c4b6e06bf4676de4

SHA1
2873631068c8b3b9495638c865915be822442c8b

SHA256
226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974

SHA512
e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b

Download Submit
memory/4972-91-0x000002049A4C0000-0x000002049A4C1000-memory.dmp

Filesize
4KB

Download
memory/4972-93-0x000002049A4C0000-0x000002049A4C1000-memory.dmp

Filesize
4KB

Download
memory/4972-92-0x000002049A4C0000-0x000002049A4C1000-memory.dmp

Filesize
4KB

Download
memory/4972-103-0x000002049A4C0000-0x000002049A4C1000-memory.dmp

Filesize
4KB

Download
memory/4972-102-0x000002049A4C0000-0x000002049A4C1000-memory.dmp

Filesize
4KB

Download
memory/4972-101-0x000002049A4C0000-0x000002049A4C1000-memory.dmp

Filesize
4KB

Download
memory/4972-100-0x000002049A4C0000-0x000002049A4C1000-memory.dmp

Filesize
4KB

Download
memory/4972-97-0x000002049A4C0000-0x000002049A4C1000-memory.dmp

Filesize
4KB

Download
memory/4972-99-0x000002049A4C0000-0x000002049A4C1000-memory.dmp

Filesize
4KB

Download
memory/4972-98-0x000002049A4C0000-0x000002049A4C1000-memory.dmp

Filesize
4KB

Download