Analysis
-
max time kernel
149s -
max time network
153s -
platform
windows7_x64 -
resource
win7-20230831-en -
resource tags
arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system -
submitted
09-09-2023 05:41
Static task
static1
Behavioral task
behavioral1
Sample
Fgmre.exe
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
Fgmre.exe
Resource
win10v2004-20230831-en
General
-
Target
Fgmre.exe
-
Size
6.1MB
-
MD5
fab73af287c1c2d2c9f7eb56ae418c2a
-
SHA1
b9afbf362fd3a04290b37a2abafece67fba21b1b
-
SHA256
33d1fbfef24cf1945248cfdc35c9338aec58774838d2c8b16d7609e8badd60a3
-
SHA512
c5a5803b097509967ff09a401d4f8d055a837c66f4bb257576513519233b40890bb8663ce08eddead348dacdace3d1212e3522480fbd6fe3a5e909970f442bab
-
SSDEEP
98304:wVV8V0jkxwDuoUprzpnNHNVDNHVq4t2KsNStyoXpGQL4+bMzvIBkKAPLf:w7E0oCu9NtVJFRGQLcH
Malware Config
Extracted
bitrat
1.38
smgqnt3eixxksasu.xyz:1234
-
communication_password
30afda4853ef5b1bc36463ba95d84247
-
tor_process
tor
Signatures
-
Downloads MZ/PE file
-
Executes dropped EXE 1 IoCs
pid Process 2736 tUqxpF7NoLr4dico.exe -
Loads dropped DLL 4 IoCs
pid Process 2744 aspnet_compiler.exe 2744 aspnet_compiler.exe 2744 aspnet_compiler.exe 2744 aspnet_compiler.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-607259312-1573743425-2763420908-1000\Software\Microsoft\Windows\CurrentVersion\Run\checkupdater = "C:\\Users\\Admin\\AppData\\Local\\checkupdater.exe" Fgmre.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 5 IoCs
pid Process 2744 aspnet_compiler.exe 2744 aspnet_compiler.exe 2744 aspnet_compiler.exe 2744 aspnet_compiler.exe 2744 aspnet_compiler.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 1696 set thread context of 2744 1696 Fgmre.exe 30 -
Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 1696 Fgmre.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeDebugPrivilege 1696 Fgmre.exe Token: SeDebugPrivilege 2744 aspnet_compiler.exe Token: SeShutdownPrivilege 2744 aspnet_compiler.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2744 aspnet_compiler.exe 2744 aspnet_compiler.exe -
Suspicious use of WriteProcessMemory 16 IoCs
description pid Process procid_target PID 1696 wrote to memory of 2744 1696 Fgmre.exe 30 PID 1696 wrote to memory of 2744 1696 Fgmre.exe 30 PID 1696 wrote to memory of 2744 1696 Fgmre.exe 30 PID 1696 wrote to memory of 2744 1696 Fgmre.exe 30 PID 1696 wrote to memory of 2744 1696 Fgmre.exe 30 PID 1696 wrote to memory of 2744 1696 Fgmre.exe 30 PID 1696 wrote to memory of 2744 1696 Fgmre.exe 30 PID 1696 wrote to memory of 2744 1696 Fgmre.exe 30 PID 1696 wrote to memory of 2744 1696 Fgmre.exe 30 PID 1696 wrote to memory of 2744 1696 Fgmre.exe 30 PID 1696 wrote to memory of 2744 1696 Fgmre.exe 30 PID 1696 wrote to memory of 2744 1696 Fgmre.exe 30 PID 2744 wrote to memory of 2736 2744 aspnet_compiler.exe 33 PID 2744 wrote to memory of 2736 2744 aspnet_compiler.exe 33 PID 2744 wrote to memory of 2736 2744 aspnet_compiler.exe 33 PID 2744 wrote to memory of 2736 2744 aspnet_compiler.exe 33
Processes
-
C:\Users\Admin\AppData\Local\Temp\Fgmre.exe"C:\Users\Admin\AppData\Local\Temp\Fgmre.exe"1⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1696 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe2⤵
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2744 -
C:\Users\Admin\AppData\Local\Temp\tUqxpF7NoLr4dico.exe"C:\Users\Admin\AppData\Local\Temp\tUqxpF7NoLr4dico.exe"3⤵
- Executes dropped EXE
PID:2736
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\Y8E7WD55\Fgmre[1].exe
Filesize6.1MB
MD5fab73af287c1c2d2c9f7eb56ae418c2a
SHA1b9afbf362fd3a04290b37a2abafece67fba21b1b
SHA25633d1fbfef24cf1945248cfdc35c9338aec58774838d2c8b16d7609e8badd60a3
SHA512c5a5803b097509967ff09a401d4f8d055a837c66f4bb257576513519233b40890bb8663ce08eddead348dacdace3d1212e3522480fbd6fe3a5e909970f442bab
-
Filesize
6.1MB
MD5fab73af287c1c2d2c9f7eb56ae418c2a
SHA1b9afbf362fd3a04290b37a2abafece67fba21b1b
SHA25633d1fbfef24cf1945248cfdc35c9338aec58774838d2c8b16d7609e8badd60a3
SHA512c5a5803b097509967ff09a401d4f8d055a837c66f4bb257576513519233b40890bb8663ce08eddead348dacdace3d1212e3522480fbd6fe3a5e909970f442bab
-
Filesize
6.1MB
MD5fab73af287c1c2d2c9f7eb56ae418c2a
SHA1b9afbf362fd3a04290b37a2abafece67fba21b1b
SHA25633d1fbfef24cf1945248cfdc35c9338aec58774838d2c8b16d7609e8badd60a3
SHA512c5a5803b097509967ff09a401d4f8d055a837c66f4bb257576513519233b40890bb8663ce08eddead348dacdace3d1212e3522480fbd6fe3a5e909970f442bab
-
Filesize
6.1MB
MD5fab73af287c1c2d2c9f7eb56ae418c2a
SHA1b9afbf362fd3a04290b37a2abafece67fba21b1b
SHA25633d1fbfef24cf1945248cfdc35c9338aec58774838d2c8b16d7609e8badd60a3
SHA512c5a5803b097509967ff09a401d4f8d055a837c66f4bb257576513519233b40890bb8663ce08eddead348dacdace3d1212e3522480fbd6fe3a5e909970f442bab
-
Filesize
6.1MB
MD5fab73af287c1c2d2c9f7eb56ae418c2a
SHA1b9afbf362fd3a04290b37a2abafece67fba21b1b
SHA25633d1fbfef24cf1945248cfdc35c9338aec58774838d2c8b16d7609e8badd60a3
SHA512c5a5803b097509967ff09a401d4f8d055a837c66f4bb257576513519233b40890bb8663ce08eddead348dacdace3d1212e3522480fbd6fe3a5e909970f442bab
-
Filesize
6.1MB
MD5fab73af287c1c2d2c9f7eb56ae418c2a
SHA1b9afbf362fd3a04290b37a2abafece67fba21b1b
SHA25633d1fbfef24cf1945248cfdc35c9338aec58774838d2c8b16d7609e8badd60a3
SHA512c5a5803b097509967ff09a401d4f8d055a837c66f4bb257576513519233b40890bb8663ce08eddead348dacdace3d1212e3522480fbd6fe3a5e909970f442bab
-
Filesize
6.1MB
MD5fab73af287c1c2d2c9f7eb56ae418c2a
SHA1b9afbf362fd3a04290b37a2abafece67fba21b1b
SHA25633d1fbfef24cf1945248cfdc35c9338aec58774838d2c8b16d7609e8badd60a3
SHA512c5a5803b097509967ff09a401d4f8d055a837c66f4bb257576513519233b40890bb8663ce08eddead348dacdace3d1212e3522480fbd6fe3a5e909970f442bab