Resubmissions

08-12-2024 23:53

241208-3xp88swmes 10

19-07-2023 10:01

230719-l2n4asdb6y 10

Analysis

  • max time kernel
    150s
  • max time network
    148s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    08-12-2024 23:53

General

  • Target

    sample.exe

  • Size

    19.1MB

  • MD5

    8ebac20b51430b0cc35cef0bb4343524

  • SHA1

    d73890138f1bac7f87cbb0137a86b000ca1dfdc8

  • SHA256

    0017a2f18f49ca0a4cc0a1f6a524faa5658ae033eda508906b626329c232fba5

  • SHA512

    0db3f4eb3df46f9811793edd29388fe7c9a36c3c9f94f4f16caaaa70d0a28aa4e8a38ccc96fd57270dab9d23b0313f85aab0808e81c660512bc8abc7d2f90674

  • SSDEEP

    393216:obnSY7czVZQ+jQ3o3xrcJpuEJsVLDV3EJCP2qzFMlSQbY3hyt:GOVSiQ30xrUQkoFz+qaghyt

Malware Config

Signatures

  • Detect Fabookie payload 1 IoCs
  • Fabookie

    Fabookie is facebook account info stealer.

  • Fabookie family
  • Downloads MZ/PE file
  • Checks computer location settings 2 TTPs 3 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file 1 IoCs
  • Executes dropped EXE 8 IoCs
  • Loads dropped DLL 9 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • VMProtect packed file 2 IoCs

    Detects executables packed with VMProtect commercial packer.

  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 8 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Kills process with taskkill 2 IoCs
  • Modifies registry key 1 TTPs 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 10 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SetWindowsHookEx 13 IoCs
  • Suspicious use of WriteProcessMemory 35 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Users\Admin\AppData\Local\Temp\sample.exe
    "C:\Users\Admin\AppData\Local\Temp\sample.exe"
    1⤵
    • Checks computer location settings
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:4256
    • C:\Users\Admin\AppData\Local\Temp\Software_Tool.exe
      "C:\Users\Admin\AppData\Local\Temp\Software_Tool.exe"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:684
      • C:\Users\Admin\AppData\Local\Temp\sibA1B0.tmp\0\AdblockInstaller.exe
        "C:\Users\Admin\AppData\Local\Temp\sibA1B0.tmp\0\AdblockInstaller.exe" /pid=741
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:1192
        • C:\Users\Admin\AppData\Local\Temp\is-QSJHN.tmp\AdblockInstaller.tmp
          "C:\Users\Admin\AppData\Local\Temp\is-QSJHN.tmp\AdblockInstaller.tmp" /SL5="$602AA,15557677,792064,C:\Users\Admin\AppData\Local\Temp\sibA1B0.tmp\0\AdblockInstaller.exe" /pid=741
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          • Loads dropped DLL
          • System Location Discovery: System Language Discovery
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of SetWindowsHookEx
          • Suspicious use of WriteProcessMemory
          PID:4024
          • C:\Windows\SysWOW64\taskkill.exe
            "C:\Windows\System32\taskkill.exe" /f /im Adblock.exe
            5⤵
            • System Location Discovery: System Language Discovery
            • Kills process with taskkill
            • Suspicious use of AdjustPrivilegeToken
            PID:4208
          • C:\Users\Admin\Programs\Adblock\Adblock.exe
            "C:\Users\Admin\Programs\Adblock\Adblock.exe" --installerSessionId=896de5331733702051 --downloadDate=2022-12-17T04:04:11 --distId=marketator --pid=741
            5⤵
            • Drops startup file
            • Executes dropped EXE
            • Loads dropped DLL
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of FindShellTrayWindow
            • Suspicious use of SetWindowsHookEx
            • Suspicious use of WriteProcessMemory
            PID:412
            • C:\Users\Admin\Programs\Adblock\crashpad_handler.exe
              C:\Users\Admin\Programs\Adblock\crashpad_handler.exe --no-rate-limit "--database=C:\Users\Admin\AppData\Roaming\Adblock Fast\crashdumps" "--metrics-dir=C:\Users\Admin\AppData\Roaming\Adblock Fast\crashdumps" --url=https://o428832.ingest.sentry.io:443/api/5420194/minidump/?sentry_client=sentry.native/0.4.12&sentry_key=06798e99d7ee416faaf4e01cd2f1faaf "--attachment=C:\Users\Admin\AppData\Roaming\Adblock Fast\crashdumps\1ecd1c82-b2f5-4728-feed-8d2c04c026e3.run\__sentry-event" "--attachment=C:\Users\Admin\AppData\Roaming\Adblock Fast\crashdumps\1ecd1c82-b2f5-4728-feed-8d2c04c026e3.run\__sentry-breadcrumb1" "--attachment=C:\Users\Admin\AppData\Roaming\Adblock Fast\crashdumps\1ecd1c82-b2f5-4728-feed-8d2c04c026e3.run\__sentry-breadcrumb2" --initial-client-data=0x3e8,0x3ec,0x3f0,0x3c4,0x3f4,0x7ff7d534bdd0,0x7ff7d534bdf0,0x7ff7d534be08
              6⤵
              • Executes dropped EXE
              • Suspicious use of SetWindowsHookEx
              PID:632
          • C:\Windows\system32\cmd.exe
            "cmd.exe" /c "reg copy HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\{bf5b0da9-8494-48d2-811b-39ea7a64d8e0}_is1 HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall\{bf5b0da9-8494-48d2-811b-39ea7a64d8e0}_is1 /s /f"
            5⤵
            • Suspicious use of WriteProcessMemory
            PID:1936
            • C:\Windows\system32\reg.exe
              reg copy HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\{bf5b0da9-8494-48d2-811b-39ea7a64d8e0}_is1 HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall\{bf5b0da9-8494-48d2-811b-39ea7a64d8e0}_is1 /s /f
              6⤵
                PID:1208
            • C:\Windows\system32\cmd.exe
              "cmd.exe" /c "reg delete HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\{bf5b0da9-8494-48d2-811b-39ea7a64d8e0}_is1 /f"
              5⤵
              • Suspicious use of WriteProcessMemory
              PID:3476
              • C:\Windows\system32\reg.exe
                reg delete HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\{bf5b0da9-8494-48d2-811b-39ea7a64d8e0}_is1 /f
                6⤵
                • Modifies registry key
                PID:1924
            • C:\Windows\SysWOW64\taskkill.exe
              "C:\Windows\System32\taskkill.exe" /f /im MassiveEngine.exe
              5⤵
              • System Location Discovery: System Language Discovery
              • Kills process with taskkill
              • Suspicious use of AdjustPrivilegeToken
              PID:1632
      • C:\Users\Admin\AppData\Local\Temp\Resource.exe
        "C:\Users\Admin\AppData\Local\Temp\Resource.exe"
        2⤵
        • Executes dropped EXE
        PID:3592
      • C:\Users\Admin\AppData\Local\Temp\Folder.exe
        "C:\Users\Admin\AppData\Local\Temp\Folder.exe"
        2⤵
        • Checks computer location settings
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:1676
        • C:\Users\Admin\AppData\Local\Temp\Folder.exe
          "C:\Users\Admin\AppData\Local\Temp\Folder.exe" -h
          3⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:3940

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\Folder.exe

      Filesize

      135KB

      MD5

      0f2871fbf16bf9f5adc60785d8a71bd5

      SHA1

      3a5763edc969e9213d5cefaff6a6eb1e48132a91

      SHA256

      e4990a5113f348f96ac4b3d443bce8fec9f6a2c3ac70f749c86dd5b5052ab115

      SHA512

      82b0bc0b01eb9eef999a103ef447a25161a33445d90cd90c60e05b15f9668ff5c75335dc47e2829e4544bd7ee04a33955c83f378675531cf84110320226fad88

    • C:\Users\Admin\AppData\Local\Temp\Resource.exe

      Filesize

      3.5MB

      MD5

      10a8375392ad7ff460dbc07a627f9259

      SHA1

      96a5c4480a44840e4a7562afd31171f069fbc3e3

      SHA256

      96e2e8605a3db028029fa462712808db69520573b7a940990f5afa1a65910e46

      SHA512

      089f12390b182e83c775adb973275a0dff0c69c9ea6074c25638e7069ae28911fc060491fa34d6202dfa8400e718aa81dce65530f34e110aff17fbc86c07247a

    • C:\Users\Admin\AppData\Local\Temp\Software_Tool.exe

      Filesize

      15.7MB

      MD5

      9af27765527617e9d75b5ee6b418c8d6

      SHA1

      0e5f46cf55abe0746e8ddf5d7980ad0a5475e8e7

      SHA256

      e92ee1bc7c053bfb6b65bfce216a97d3ba5fd4f09bf9fd4f530101a60bb19030

      SHA512

      033ae6fea1be872fbc028aa9519f558f425076b906330f6dfa2d63e9dba04bfb7efdb583cff87c16a5e4ec2c29736540b8552ec754422ee05ee97788b095bd13

    • C:\Users\Admin\AppData\Local\Temp\is-KLQHR.tmp\PEInjector.dll

      Filesize

      186KB

      MD5

      a4cf124b21795dfd382c12422fd901ca

      SHA1

      7e2832f3b8b8e06ae594558d81416e96a81d3898

      SHA256

      9e371a745ea2c92c4ba996772557f4a66545ed5186d02bb2e73e20dc79906ec7

      SHA512

      3ee82d438e4a01d543791a6a17d78e148a68796e5f57d7354da36da0755369091089466e57ee9b786e7e0305a4321c281e03aeb24f6eb4dd07e7408eb3763cdd

    • C:\Users\Admin\AppData\Local\Temp\is-QSJHN.tmp\AdblockInstaller.tmp

      Filesize

      3.0MB

      MD5

      1228c03ba840482eac14e25b727f65b5

      SHA1

      eaa92be989ff71dc2b7cf090b2a8183a3c44e655

      SHA256

      a048ccbd5797616ed03ea8c13ddea2ec868e0ea22ecc6f475bf7e3ba42aa77b7

      SHA512

      77e874dc88b428c43a72ed8ab9e00e98872e9b47c4ad18f35019aa26c89de909448d5ec83a289ed87d8ddbea6e9515c5932973cf54ea3f535d7f2e11bc2318bb

    • C:\Users\Admin\AppData\Local\Temp\nslA104.tmp\Sibuia.dll

      Filesize

      527KB

      MD5

      eb948284236e2d61eae0741280265983

      SHA1

      d5180db7f54de24c27489b221095871a52dc9156

      SHA256

      dbe5a7daf5bcff97f7c48f9b5476db3072cc85fbffd660adaff2e0455132d026

      SHA512

      6d8087022ee62acd823cfa871b8b3e3251e44f316769dc04e2ad169e9df6a836dba95c3b268716f2397d6c6a3624a9e50dbe0bc847f3c4f3ef8e09bff30f2d75

    • C:\Users\Admin\AppData\Local\Temp\sibA1B0.tmp\0\AdblockInstaller.exe

      Filesize

      15.7MB

      MD5

      8d7db88f1fb9c7308f7368ae65e3f0ef

      SHA1

      5166ff1bb9b4b5d5f0ab460496cf7cc491f81f62

      SHA256

      5f81f8ee08a7460a3abd3aed1da137f2824bbdf804951477546a96300bd1e31f

      SHA512

      a620347b470c43f1d5d253a4899cbf89b1f9f631da35e5740d5134155e66a2c1756660ac9be21a6d9b5f830fa02461b3781db5c9cfe9d56b23e1454b198a7316

    • C:\Users\Admin\AppData\Local\Temp\sibA1B0.tmp\SibClr.dll

      Filesize

      51KB

      MD5

      928e680dea22c19febe9fc8e05d96472

      SHA1

      0a4a749ddfd220e2b646b878881575ff9352cf73

      SHA256

      8b6b56f670d59ff93a1c7e601468127fc21f02dde567b5c21a5d53594cdaef94

      SHA512

      5fbc72c3fa98dc2b5ad2ed556d2c6dc9279d4be3eb90ffd7fa2ada39cb976eba7cb34033e5786d1cb6137c64c869027002be2f2cad408acefd5c22006a1fef34

    • C:\Users\Admin\AppData\Roaming\Adblock Fast\Massive\usage\000002.dbtmp

      Filesize

      16B

      MD5

      206702161f94c5cd39fadd03f4014d98

      SHA1

      bd8bfc144fb5326d21bd1531523d9fb50e1b600a

      SHA256

      1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

      SHA512

      0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

    • C:\Users\Admin\AppData\Roaming\Adblock Fast\Massive\usage\CURRENT

      Filesize

      16B

      MD5

      46295cac801e5d4857d09837238a6394

      SHA1

      44e0fa1b517dbf802b18faf0785eeea6ac51594b

      SHA256

      0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

      SHA512

      8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

    • C:\Users\Admin\AppData\Roaming\Adblock Fast\crashdumps\settings.dat

      Filesize

      40B

      MD5

      f664d41ce7cdf23f39a6197ca917bdb0

      SHA1

      a3a34eeca7381b1822305f3c1fe2c1eeb5ff5461

      SHA256

      752d7fddfb0d8355b4df9702b599e56e7e67ddb1696d1cc7c31ef75ed50984ba

      SHA512

      bb86ba9a997ba204cc0381073421df1c33d3c4063f79c6e966c2e39cab5889729bff84684b34355581570b1f3fab6efba939f753809008a4d6fd6f4119a1b987

    • C:\Users\Admin\Programs\Adblock\Adblock.exe

      Filesize

      5.4MB

      MD5

      c7119e2a05db13f4888321d28e215c07

      SHA1

      2040cf5a97a671e18aee7bbd78a9dce70235f8ab

      SHA256

      b10d464d5b329829a6ec5c5bca79d9e5e5614448bc8763cc51230a3b778b644b

      SHA512

      60cc31c7d054620ad2002f00d16e58728eb941ae9a8ad492d21207e916ce3e1cc4e16e9c130a084939d35ea6f2fbf9e2d5ad89f5dc31407c1e43c70a0974478a

    • C:\Users\Admin\Programs\Adblock\MassiveService.dll

      Filesize

      3.5MB

      MD5

      6bcbb964e1fe28513b22273f136a4b37

      SHA1

      fde4927b46bac2340f65fe2811c2307c798e2398

      SHA256

      10c027bdd8008ad62c7e3ab5abd92d2573bb9474a9ea8ffeb218b43a2efaab09

      SHA512

      6e587fda68bc9e9683f2bece39a5ff9357cccd12ea1e3669f8d7c675479b476f482de0e2fea20e7a0f4fec72abde7ec1b0beffa1eed79461abd006427d182fed

    • C:\Users\Admin\Programs\Adblock\MiningGpu.dll

      Filesize

      878KB

      MD5

      79cae1118a31818af31b388ee4808a1b

      SHA1

      9054393f36900ca638a6f58c31f6ed8b5e08ffb4

      SHA256

      8d8770fd885e0bb8a28fc96f31209f05d6b4db9b4036666bd5500d13b2faeb84

      SHA512

      0e320cba17c28bedc5bcd603c462bea62d658ca1aa6d8c954d1b68ae8597b8631ed20aa8754139702ae41d970458f681d4417c3caaa6e4e52a7dde4aeb6538dc

    • C:\Users\Admin\Programs\Adblock\SysGpuInfoEx.dll

      Filesize

      95KB

      MD5

      dc6723d0c1c83f6fa274d65d65a47962

      SHA1

      4f5147e4808ea4e7be6f6648f91089ed98ff3120

      SHA256

      2e27187fcd3e1216d20efab042151f4edbdc10d8cc3c2adf330c0b64ebb8cea0

      SHA512

      25464806174c060c4faaa23458f59d5f47d953232713238a7077f387fac97dd15dd8dcb34632131176341ae8e046d0320ed8ef87782322d623ed1f388a5e142d

    • C:\Users\Admin\Programs\Adblock\WinSparkle.dll

      Filesize

      2.3MB

      MD5

      e167dfd4bb292d7837f3c15bc8f6f7a1

      SHA1

      d56a8b15f1da113afda580f5b4271354bb8fa574

      SHA256

      1f64e24bb019f60755215e3ad1efd30926e1febe497f029a69b83cedcb0dac49

      SHA512

      cbd5da6ad4cd5682163b9035af56a0ca95773cd2902d7cbcef37a8c950d3a4b7df6b79864305e449dda47e48f1d4514c48da18fb2a99334269deeaf935947f35

    • C:\Users\Admin\Programs\Adblock\crashpad_handler.exe

      Filesize

      913KB

      MD5

      cd2e0167f2e1092816f04bc174c13364

      SHA1

      8015c003fdf94d5991902437d2e98ae2d7cbccf3

      SHA256

      bfb062608229199430bd5f729fde00147451c074775ee5bf0e2917f7b239df96

      SHA512

      2f64d56f2dd6ff3f4c334540338af223a9a05e50b58e988de112712fe429698393b0acc50ce61831e418b8d63e8029d47473777dc346135303b80ad753ccc4ab

    • C:\Users\Admin\Programs\Adblock\nvml.dll

      Filesize

      988KB

      MD5

      8b7acf836560a8e41423f1bb60a3b308

      SHA1

      3dbca75ddd19e447747865e227d456d7b0694281

      SHA256

      c2e049e90d23b692d1a01ca88d6d95c88b9c6d8cf0257314ae749c0c55906692

      SHA512

      49f75a2c9e18865a55fba824b777d0d418136a736d41db864af4d46571f5f285a60efb3aef24d129f50d2a23d3c78f6329545bc5b76c07073879de0cb19fb0cd

    • memory/684-49-0x0000000010C20000-0x0000000010CDA000-memory.dmp

      Filesize

      744KB

    • memory/684-46-0x000000000EA90000-0x000000000EAA2000-memory.dmp

      Filesize

      72KB

    • memory/1192-55-0x0000000000400000-0x00000000004CF000-memory.dmp

      Filesize

      828KB

    • memory/1192-170-0x0000000000400000-0x00000000004CF000-memory.dmp

      Filesize

      828KB

    • memory/3592-41-0x0000000140000000-0x0000000140619000-memory.dmp

      Filesize

      6.1MB

    • memory/4024-171-0x0000000000400000-0x0000000000709000-memory.dmp

      Filesize

      3.0MB

    • memory/4024-201-0x0000000000400000-0x0000000000709000-memory.dmp

      Filesize

      3.0MB