77a91123ec512e4f19da951ab4f7393ab428d81963b6f72433ba1e1b320e0831

General

Target
FadeSEC.exe
Size 16.2MB
Sample260820-x6x3jsfd92
SHA256 77a91123ec512e4f19da951ab4f7393ab428d81963b6f72433ba1e1b320e0831
MD5 cd28173657f7ff9e4009c52656a15fad
SHA1 74183892bdee179f095808e1d6535b784628a094
SHA512 49d6b5436d7656f576e3fa778e4ddd5449ffc89d2da8efd1ba3514964a11f126313b12ec7114d12b7c84bb8c974d7af53868c934091189963dc771277041ac07
SSDEEP 196608:a6IAAU6cVFRv79J12SwDmF/5zZpt9kx+1kft39q:LHV6M2cZpnw+2hM
TLSH
T169075D0677874DE6DCC63BB4A8AF233D9720FD316E294B2BA98D91341C532DC9D19B90
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion evasion execution persistence privilege_escalation spyware stealer trojan

Malware Config

Signatures

Modifies Windows Defender DisableAntiSpyware settings 3 TTPs 1 IoCs

evasion trojan

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\DisableAntiSpyware = "1"	FadeSEC.exe

Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs

defense_evasion trojan

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	FadeSEC.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	FadeSEC.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	FadeSEC.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	FadeSEC.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	FadeSEC.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	FadeSEC.exe

Enumerates VirtualBox registry keys 2 TTPs 1 IoCs

defense_evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxGuest	FadeSEC.exe

Looks for VMWare services registry key. 1 TTPs 1 IoCs

defense_evasion

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VMTools	FadeSEC.exe

Modifies Windows Firewall 2 TTPs 4 IoCs

defense_evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
4480	netsh.exe
1372	netsh.exe
3408	netsh.exe
1836	netsh.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Event Triggered Execution: Netsh Helper DLL 1 TTPs 6 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2924	cmd.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
5632	FadeSEC.exe
5632	FadeSEC.exe
5632	FadeSEC.exe
5632	FadeSEC.exe
5632	FadeSEC.exe
5632	FadeSEC.exe
5632	FadeSEC.exe
5632	FadeSEC.exe
5632	FadeSEC.exe
5632	FadeSEC.exe
5632	FadeSEC.exe
5632	FadeSEC.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
5632	FadeSEC.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
5632	FadeSEC.exe
5632	FadeSEC.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 5632 wrote to memory of 2924	5632	FadeSEC.exe	90
PID 2924 wrote to memory of 4480	2924	cmd.exe	92
PID 2924 wrote to memory of 1372	2924	cmd.exe	93

C:\Users\Admin\AppData\Local\Temp\FadeSEC.exe
"C:\Users\Admin\AppData\Local\Temp\FadeSEC.exe"
1⤵
- Modifies Windows Defender DisableAntiSpyware settings
- Modifies Windows Defender Real-time Protection settings
- Enumerates VirtualBox registry keys
- Looks for VMWare services registry key.
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5632
- C:\Windows\System32\cmd.exe
  cmd.exe /c netsh advfirewall set allprofiles state off 2>nul & netsh advfirewall set allprofiles firewallpolicy blockinbound,allowoutbound 2>nul & netsh advfirewall set allprofiles settings inboundusernotification disable 2>nul & netsh advfirewall set allprofiles settings remotemanagement disable 2>nul
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2924
- - C:\Windows\system32\netsh.exe
    netsh advfirewall set allprofiles state off
    3⤵
    - Modifies Windows Firewall
    - Event Triggered Execution: Netsh Helper DLL
    PID:4480
- - C:\Windows\system32\netsh.exe
    netsh advfirewall set allprofiles firewallpolicy blockinbound,allowoutbound
    3⤵
    - Modifies Windows Firewall
    - Event Triggered Execution: Netsh Helper DLL
    PID:1372
- - C:\Windows\system32\netsh.exe
    netsh advfirewall set allprofiles settings inboundusernotification disable
    3⤵
    - Modifies Windows Firewall
    PID:3408
- - C:\Windows\system32\netsh.exe
    netsh advfirewall set allprofiles settings remotemanagement disable
    3⤵
    - Modifies Windows Firewall
    PID:1836