Analysis
-
max time kernel
133s -
max time network
151s -
platform
windows11-21h2_x64 -
resource
win11-20241007-en -
resource tags
-
submitted
08-12-2024 23:59
General
-
Target
sample.exe
-
Size
19.1MB
-
MD5
8ebac20b51430b0cc35cef0bb4343524
-
SHA1
d73890138f1bac7f87cbb0137a86b000ca1dfdc8
-
SHA256
0017a2f18f49ca0a4cc0a1f6a524faa5658ae033eda508906b626329c232fba5
-
SHA512
0db3f4eb3df46f9811793edd29388fe7c9a36c3c9f94f4f16caaaa70d0a28aa4e8a38ccc96fd57270dab9d23b0313f85aab0808e81c660512bc8abc7d2f90674
-
SSDEEP
393216:obnSY7czVZQ+jQ3o3xrcJpuEJsVLDV3EJCP2qzFMlSQbY3hyt:GOVSiQ30xrUQkoFz+qaghyt
Malware Config
Signatures
-
Detect Fabookie payload 1 IoCs
-
Fabookie
Fabookie is facebook account info stealer.
-
Fabookie family
-
Drops startup file 1 IoCs
-
Executes dropped EXE 8 IoCs
-
Loads dropped DLL 9 IoCs
-
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
VMProtect packed file 2 IoCs
Detects executables packed with VMProtect commercial packer.
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 8 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Kills process with taskkill 2 IoCs
-
Modifies registry key 1 TTPs 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 13 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of FindShellTrayWindow 2 IoCs
-
Suspicious use of SetWindowsHookEx 64 IoCs
-
Suspicious use of WriteProcessMemory 35 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\sample.exe"C:\Users\Admin\AppData\Local\Temp\sample.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Software_Tool.exe"C:\Users\Admin\AppData\Local\Temp\Software_Tool.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\sib8DDA.tmp\0\AdblockInstaller.exe"C:\Users\Admin\AppData\Local\Temp\sib8DDA.tmp\0\AdblockInstaller.exe" /pid=7413⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-CUNOR.tmp\AdblockInstaller.tmp"C:\Users\Admin\AppData\Local\Temp\is-CUNOR.tmp\AdblockInstaller.tmp" /SL5="$502D4,15557677,792064,C:\Users\Admin\AppData\Local\Temp\sib8DDA.tmp\0\AdblockInstaller.exe" /pid=7414⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\System32\taskkill.exe" /f /im Adblock.exe5⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\Programs\Adblock\Adblock.exe"C:\Users\Admin\Programs\Adblock\Adblock.exe" --installerSessionId=8c9ee1bc1733702363 --downloadDate=2022-12-17T04:04:11 --distId=marketator --pid=7415⤵
- Drops startup file
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\Programs\Adblock\crashpad_handler.exeC:\Users\Admin\Programs\Adblock\crashpad_handler.exe --no-rate-limit "--database=C:\Users\Admin\AppData\Roaming\Adblock Fast\crashdumps" "--metrics-dir=C:\Users\Admin\AppData\Roaming\Adblock Fast\crashdumps" --url=https://o428832.ingest.sentry.io:443/api/5420194/minidump/?sentry_client=sentry.native/0.4.12&sentry_key=06798e99d7ee416faaf4e01cd2f1faaf "--attachment=C:\Users\Admin\AppData\Roaming\Adblock Fast\crashdumps\95ad165a-0926-4fb1-491d-76ed605f210f.run\__sentry-event" "--attachment=C:\Users\Admin\AppData\Roaming\Adblock Fast\crashdumps\95ad165a-0926-4fb1-491d-76ed605f210f.run\__sentry-breadcrumb1" "--attachment=C:\Users\Admin\AppData\Roaming\Adblock Fast\crashdumps\95ad165a-0926-4fb1-491d-76ed605f210f.run\__sentry-breadcrumb2" --initial-client-data=0x42c,0x430,0x434,0x408,0x438,0x7ff637b8bdd0,0x7ff637b8bdf0,0x7ff637b8be086⤵
- Executes dropped EXE
-
-
-
C:\Windows\system32\cmd.exe"cmd.exe" /c "reg copy HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\{bf5b0da9-8494-48d2-811b-39ea7a64d8e0}_is1 HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall\{bf5b0da9-8494-48d2-811b-39ea7a64d8e0}_is1 /s /f"5⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\reg.exereg copy HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\{bf5b0da9-8494-48d2-811b-39ea7a64d8e0}_is1 HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall\{bf5b0da9-8494-48d2-811b-39ea7a64d8e0}_is1 /s /f6⤵
-
-
-
C:\Windows\system32\cmd.exe"cmd.exe" /c "reg delete HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\{bf5b0da9-8494-48d2-811b-39ea7a64d8e0}_is1 /f"5⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\reg.exereg delete HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\{bf5b0da9-8494-48d2-811b-39ea7a64d8e0}_is1 /f6⤵
- Modifies registry key
-
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\System32\taskkill.exe" /f /im MassiveEngine.exe5⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Resource.exe"C:\Users\Admin\AppData\Local\Temp\Resource.exe"2⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\Folder.exe"C:\Users\Admin\AppData\Local\Temp\Folder.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Folder.exe"C:\Users\Admin\AppData\Local\Temp\Folder.exe" -h3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
135KB
MD50f2871fbf16bf9f5adc60785d8a71bd5
SHA13a5763edc969e9213d5cefaff6a6eb1e48132a91
SHA256e4990a5113f348f96ac4b3d443bce8fec9f6a2c3ac70f749c86dd5b5052ab115
SHA51282b0bc0b01eb9eef999a103ef447a25161a33445d90cd90c60e05b15f9668ff5c75335dc47e2829e4544bd7ee04a33955c83f378675531cf84110320226fad88
-
Filesize
3.5MB
MD510a8375392ad7ff460dbc07a627f9259
SHA196a5c4480a44840e4a7562afd31171f069fbc3e3
SHA25696e2e8605a3db028029fa462712808db69520573b7a940990f5afa1a65910e46
SHA512089f12390b182e83c775adb973275a0dff0c69c9ea6074c25638e7069ae28911fc060491fa34d6202dfa8400e718aa81dce65530f34e110aff17fbc86c07247a
-
Filesize
15.7MB
MD59af27765527617e9d75b5ee6b418c8d6
SHA10e5f46cf55abe0746e8ddf5d7980ad0a5475e8e7
SHA256e92ee1bc7c053bfb6b65bfce216a97d3ba5fd4f09bf9fd4f530101a60bb19030
SHA512033ae6fea1be872fbc028aa9519f558f425076b906330f6dfa2d63e9dba04bfb7efdb583cff87c16a5e4ec2c29736540b8552ec754422ee05ee97788b095bd13
-
Filesize
3.0MB
MD51228c03ba840482eac14e25b727f65b5
SHA1eaa92be989ff71dc2b7cf090b2a8183a3c44e655
SHA256a048ccbd5797616ed03ea8c13ddea2ec868e0ea22ecc6f475bf7e3ba42aa77b7
SHA51277e874dc88b428c43a72ed8ab9e00e98872e9b47c4ad18f35019aa26c89de909448d5ec83a289ed87d8ddbea6e9515c5932973cf54ea3f535d7f2e11bc2318bb
-
Filesize
186KB
MD5a4cf124b21795dfd382c12422fd901ca
SHA17e2832f3b8b8e06ae594558d81416e96a81d3898
SHA2569e371a745ea2c92c4ba996772557f4a66545ed5186d02bb2e73e20dc79906ec7
SHA5123ee82d438e4a01d543791a6a17d78e148a68796e5f57d7354da36da0755369091089466e57ee9b786e7e0305a4321c281e03aeb24f6eb4dd07e7408eb3763cdd
-
Filesize
527KB
MD5eb948284236e2d61eae0741280265983
SHA1d5180db7f54de24c27489b221095871a52dc9156
SHA256dbe5a7daf5bcff97f7c48f9b5476db3072cc85fbffd660adaff2e0455132d026
SHA5126d8087022ee62acd823cfa871b8b3e3251e44f316769dc04e2ad169e9df6a836dba95c3b268716f2397d6c6a3624a9e50dbe0bc847f3c4f3ef8e09bff30f2d75
-
Filesize
15.7MB
MD58d7db88f1fb9c7308f7368ae65e3f0ef
SHA15166ff1bb9b4b5d5f0ab460496cf7cc491f81f62
SHA2565f81f8ee08a7460a3abd3aed1da137f2824bbdf804951477546a96300bd1e31f
SHA512a620347b470c43f1d5d253a4899cbf89b1f9f631da35e5740d5134155e66a2c1756660ac9be21a6d9b5f830fa02461b3781db5c9cfe9d56b23e1454b198a7316
-
Filesize
51KB
MD5928e680dea22c19febe9fc8e05d96472
SHA10a4a749ddfd220e2b646b878881575ff9352cf73
SHA2568b6b56f670d59ff93a1c7e601468127fc21f02dde567b5c21a5d53594cdaef94
SHA5125fbc72c3fa98dc2b5ad2ed556d2c6dc9279d4be3eb90ffd7fa2ada39cb976eba7cb34033e5786d1cb6137c64c869027002be2f2cad408acefd5c22006a1fef34
-
Filesize
16B
MD5206702161f94c5cd39fadd03f4014d98
SHA1bd8bfc144fb5326d21bd1531523d9fb50e1b600a
SHA2561005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167
SHA5120af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145
-
Filesize
16B
MD546295cac801e5d4857d09837238a6394
SHA144e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA2560f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
SHA5128969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
-
Filesize
40B
MD5d460a292fe3801247cf8077c7f62279c
SHA17cce692c0553cc9004be30716408917d0af7087f
SHA2564fee29b0def3e2cd2f84e1ec17f3de04bd5f77e6243990e23ee483bb471a28dc
SHA5121218294de3b8d9e142e7052a1e366e7e7e4a179b7825f4760aa10a9f9276ad4abd729c8c785201c1d59ae8f9002cfdf81b4c164cae5a89486bb7e676f221e97b
-
Filesize
5.4MB
MD5c7119e2a05db13f4888321d28e215c07
SHA12040cf5a97a671e18aee7bbd78a9dce70235f8ab
SHA256b10d464d5b329829a6ec5c5bca79d9e5e5614448bc8763cc51230a3b778b644b
SHA51260cc31c7d054620ad2002f00d16e58728eb941ae9a8ad492d21207e916ce3e1cc4e16e9c130a084939d35ea6f2fbf9e2d5ad89f5dc31407c1e43c70a0974478a
-
Filesize
3.5MB
MD56bcbb964e1fe28513b22273f136a4b37
SHA1fde4927b46bac2340f65fe2811c2307c798e2398
SHA25610c027bdd8008ad62c7e3ab5abd92d2573bb9474a9ea8ffeb218b43a2efaab09
SHA5126e587fda68bc9e9683f2bece39a5ff9357cccd12ea1e3669f8d7c675479b476f482de0e2fea20e7a0f4fec72abde7ec1b0beffa1eed79461abd006427d182fed
-
Filesize
878KB
MD579cae1118a31818af31b388ee4808a1b
SHA19054393f36900ca638a6f58c31f6ed8b5e08ffb4
SHA2568d8770fd885e0bb8a28fc96f31209f05d6b4db9b4036666bd5500d13b2faeb84
SHA5120e320cba17c28bedc5bcd603c462bea62d658ca1aa6d8c954d1b68ae8597b8631ed20aa8754139702ae41d970458f681d4417c3caaa6e4e52a7dde4aeb6538dc
-
Filesize
95KB
MD5dc6723d0c1c83f6fa274d65d65a47962
SHA14f5147e4808ea4e7be6f6648f91089ed98ff3120
SHA2562e27187fcd3e1216d20efab042151f4edbdc10d8cc3c2adf330c0b64ebb8cea0
SHA51225464806174c060c4faaa23458f59d5f47d953232713238a7077f387fac97dd15dd8dcb34632131176341ae8e046d0320ed8ef87782322d623ed1f388a5e142d
-
Filesize
2.3MB
MD5e167dfd4bb292d7837f3c15bc8f6f7a1
SHA1d56a8b15f1da113afda580f5b4271354bb8fa574
SHA2561f64e24bb019f60755215e3ad1efd30926e1febe497f029a69b83cedcb0dac49
SHA512cbd5da6ad4cd5682163b9035af56a0ca95773cd2902d7cbcef37a8c950d3a4b7df6b79864305e449dda47e48f1d4514c48da18fb2a99334269deeaf935947f35
-
Filesize
913KB
MD5cd2e0167f2e1092816f04bc174c13364
SHA18015c003fdf94d5991902437d2e98ae2d7cbccf3
SHA256bfb062608229199430bd5f729fde00147451c074775ee5bf0e2917f7b239df96
SHA5122f64d56f2dd6ff3f4c334540338af223a9a05e50b58e988de112712fe429698393b0acc50ce61831e418b8d63e8029d47473777dc346135303b80ad753ccc4ab
-
Filesize
988KB
MD58b7acf836560a8e41423f1bb60a3b308
SHA13dbca75ddd19e447747865e227d456d7b0694281
SHA256c2e049e90d23b692d1a01ca88d6d95c88b9c6d8cf0257314ae749c0c55906692
SHA51249f75a2c9e18865a55fba824b777d0d418136a736d41db864af4d46571f5f285a60efb3aef24d129f50d2a23d3c78f6329545bc5b76c07073879de0cb19fb0cd
-
Filesize
3.0MB
-
Filesize
828KB
-
Filesize
828KB
-
Filesize
6.1MB
-
Filesize
744KB
-
Filesize
72KB