Analysis
-
max time kernel
148s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20230831-en -
resource tags
arch:x64arch:x86image:win10v2004-20230831-enlocale:en-usos:windows10-2004-x64system -
submitted
09-09-2023 05:41
Static task
static1
Behavioral task
behavioral1
Sample
Fgmre.exe
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
Fgmre.exe
Resource
win10v2004-20230831-en
General
-
Target
Fgmre.exe
-
Size
6.1MB
-
MD5
fab73af287c1c2d2c9f7eb56ae418c2a
-
SHA1
b9afbf362fd3a04290b37a2abafece67fba21b1b
-
SHA256
33d1fbfef24cf1945248cfdc35c9338aec58774838d2c8b16d7609e8badd60a3
-
SHA512
c5a5803b097509967ff09a401d4f8d055a837c66f4bb257576513519233b40890bb8663ce08eddead348dacdace3d1212e3522480fbd6fe3a5e909970f442bab
-
SSDEEP
98304:wVV8V0jkxwDuoUprzpnNHNVDNHVq4t2KsNStyoXpGQL4+bMzvIBkKAPLf:w7E0oCu9NtVJFRGQLcH
Malware Config
Extracted
bitrat
1.38
smgqnt3eixxksasu.xyz:1234
-
communication_password
30afda4853ef5b1bc36463ba95d84247
-
tor_process
tor
Signatures
-
Downloads MZ/PE file
-
Executes dropped EXE 1 IoCs
pid Process 4456 obIdov8dMdtq6idY.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2415528079-3794552930-4264847036-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\checkupdater = "C:\\Users\\Admin\\AppData\\Local\\checkupdater.exe" Fgmre.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 5 IoCs
pid Process 2432 aspnet_compiler.exe 2432 aspnet_compiler.exe 2432 aspnet_compiler.exe 2432 aspnet_compiler.exe 2432 aspnet_compiler.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 4596 set thread context of 2432 4596 Fgmre.exe 101 -
Suspicious behavior: EnumeratesProcesses 5 IoCs
pid Process 4596 Fgmre.exe 4596 Fgmre.exe 4596 Fgmre.exe 4596 Fgmre.exe 4596 Fgmre.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 4596 Fgmre.exe Token: SeShutdownPrivilege 2432 aspnet_compiler.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2432 aspnet_compiler.exe 2432 aspnet_compiler.exe -
Suspicious use of WriteProcessMemory 20 IoCs
description pid Process procid_target PID 4596 wrote to memory of 2544 4596 Fgmre.exe 99 PID 4596 wrote to memory of 2544 4596 Fgmre.exe 99 PID 4596 wrote to memory of 2544 4596 Fgmre.exe 99 PID 4596 wrote to memory of 3452 4596 Fgmre.exe 100 PID 4596 wrote to memory of 3452 4596 Fgmre.exe 100 PID 4596 wrote to memory of 3452 4596 Fgmre.exe 100 PID 4596 wrote to memory of 2432 4596 Fgmre.exe 101 PID 4596 wrote to memory of 2432 4596 Fgmre.exe 101 PID 4596 wrote to memory of 2432 4596 Fgmre.exe 101 PID 4596 wrote to memory of 2432 4596 Fgmre.exe 101 PID 4596 wrote to memory of 2432 4596 Fgmre.exe 101 PID 4596 wrote to memory of 2432 4596 Fgmre.exe 101 PID 4596 wrote to memory of 2432 4596 Fgmre.exe 101 PID 4596 wrote to memory of 2432 4596 Fgmre.exe 101 PID 4596 wrote to memory of 2432 4596 Fgmre.exe 101 PID 4596 wrote to memory of 2432 4596 Fgmre.exe 101 PID 4596 wrote to memory of 2432 4596 Fgmre.exe 101 PID 2432 wrote to memory of 4456 2432 aspnet_compiler.exe 102 PID 2432 wrote to memory of 4456 2432 aspnet_compiler.exe 102 PID 2432 wrote to memory of 4456 2432 aspnet_compiler.exe 102
Processes
-
C:\Users\Admin\AppData\Local\Temp\Fgmre.exe"C:\Users\Admin\AppData\Local\Temp\Fgmre.exe"1⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4596 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe2⤵PID:2544
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe2⤵PID:3452
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe2⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2432 -
C:\Users\Admin\AppData\Local\Temp\obIdov8dMdtq6idY.exe"C:\Users\Admin\AppData\Local\Temp\obIdov8dMdtq6idY.exe"3⤵
- Executes dropped EXE
PID:4456
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
6.1MB
MD5fab73af287c1c2d2c9f7eb56ae418c2a
SHA1b9afbf362fd3a04290b37a2abafece67fba21b1b
SHA25633d1fbfef24cf1945248cfdc35c9338aec58774838d2c8b16d7609e8badd60a3
SHA512c5a5803b097509967ff09a401d4f8d055a837c66f4bb257576513519233b40890bb8663ce08eddead348dacdace3d1212e3522480fbd6fe3a5e909970f442bab
-
Filesize
6.1MB
MD5fab73af287c1c2d2c9f7eb56ae418c2a
SHA1b9afbf362fd3a04290b37a2abafece67fba21b1b
SHA25633d1fbfef24cf1945248cfdc35c9338aec58774838d2c8b16d7609e8badd60a3
SHA512c5a5803b097509967ff09a401d4f8d055a837c66f4bb257576513519233b40890bb8663ce08eddead348dacdace3d1212e3522480fbd6fe3a5e909970f442bab
-
Filesize
6.1MB
MD5fab73af287c1c2d2c9f7eb56ae418c2a
SHA1b9afbf362fd3a04290b37a2abafece67fba21b1b
SHA25633d1fbfef24cf1945248cfdc35c9338aec58774838d2c8b16d7609e8badd60a3
SHA512c5a5803b097509967ff09a401d4f8d055a837c66f4bb257576513519233b40890bb8663ce08eddead348dacdace3d1212e3522480fbd6fe3a5e909970f442bab