fabookie | 96e2e8605a3db028029fa462712808db69520573b7a940990f5afa1a65910e46

Analysis

max time kernel
121s
max time network
123s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
10-12-2024 03:12

Target

96e2e8605a3db028029fa462712808db69520573b7a940990f5afa1a65910e46.exe
Size

3.5MB
MD5

10a8375392ad7ff460dbc07a627f9259
SHA1

96a5c4480a44840e4a7562afd31171f069fbc3e3
SHA256

96e2e8605a3db028029fa462712808db69520573b7a940990f5afa1a65910e46
SHA512

089f12390b182e83c775adb973275a0dff0c69c9ea6074c25638e7069ae28911fc060491fa34d6202dfa8400e718aa81dce65530f34e110aff17fbc86c07247a
SSDEEP

98304:4mLEmqged7HbxPUimRNilkibvyq/Ta5DLUfd:4mL3QfOimRkkiRau1

Score

10^/10

Detect Fabookie payload 1 IoCs

resource	yara_rule
behavioral1/memory/2992-0-0x0000000140000000-0x0000000140619000-memory.dmp	family_fabookie

Fabookie
Fabookie is facebook account info stealer.
spyware stealer fabookie
Fabookie family
fabookie

VMProtect packed file 1 IoCs

Detects executables packed with VMProtect commercial packer.

resource	yara_rule
behavioral1/memory/2992-0-0x0000000140000000-0x0000000140619000-memory.dmp	vmprotect

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2992 wrote to memory of 2516	2992	96e2e8605a3db028029fa462712808db69520573b7a940990f5afa1a65910e46.exe	30
PID 2992 wrote to memory of 2516	2992	96e2e8605a3db028029fa462712808db69520573b7a940990f5afa1a65910e46.exe	30
PID 2992 wrote to memory of 2516	2992	96e2e8605a3db028029fa462712808db69520573b7a940990f5afa1a65910e46.exe	30

C:\Users\Admin\AppData\Local\Temp\96e2e8605a3db028029fa462712808db69520573b7a940990f5afa1a65910e46.exe
"C:\Users\Admin\AppData\Local\Temp\96e2e8605a3db028029fa462712808db69520573b7a940990f5afa1a65910e46.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2992
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2992 -s 56
  2⤵
  PID:2516

memory/2992-0-0x0000000140000000-0x0000000140619000-memory.dmp

Filesize
6.1MB

Download