7b8e6ac4d63a4d8515200807fbd3a2bd46ac77df64300e5f19508af0d54d2be6

General

Target

Fantom.exe
Size

261KB
MD5

7d80230df68ccba871815d68f016c282
SHA1

e10874c6108a26ceedfc84f50881824462b5b6b6
SHA256

f4234a501edcd30d3bc15c983692c9450383b73bdd310059405c5e3a43cc730b
SHA512

64d02b3e7ed82a64aaac1f74c34d6b6e6feaac665ca9c08911b93eddcec66595687024ec576e74ea09a1193ace3923969c75de8733859835fef45335cf265540
SSDEEP

3072:vDKW1LgppLRHMY0TBfJvjcTp5XxG8pt+oSOpE22obq+NYgvPuCEbMBWJxLRiUgV:vDKW1Lgbdl0TBBvjc/M8n35nYgvKjdzi

Score

8^/10

evasion

Malware Config

Signatures

Disables Task Manager via registry modification
evasion
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.

Query Registry
T1012

System Information Discovery
T1082

Processes:

Fantom.exe

description ioc process

Key value queried \REGISTRY\USER\S-1-5-21-3350690463-3549324357-1323838019-1000\Control Panel\International\Geo\Nation Fantom.exe
Executes dropped EXE 1 IoCs

Processes:

WindowsUpdate.exe

pid process

5056 WindowsUpdate.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

Fantom.exe

pid process

3580 Fantom.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

Fantom.exe

description pid process

Token: SeDebugPrivilege 3580 Fantom.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-3350690463-3549324357-1323838019-1000\Control Panel\International\Geo\Nation	Fantom.exe

pid	process
5056	WindowsUpdate.exe

pid	process
3580	Fantom.exe

description	pid	process
Token: SeDebugPrivilege	3580	Fantom.exe

Suspicious use of WriteProcessMemory 2 IoCs

Processes:

Fantom.exe

description	pid	process	target process
PID 3580 wrote to memory of 5056	3580	Fantom.exe	WindowsUpdate.exe
PID 3580 wrote to memory of 5056	3580	Fantom.exe	WindowsUpdate.exe

C:\Users\Admin\AppData\Local\Temp\Fantom.exe
"C:\Users\Admin\AppData\Local\Temp\Fantom.exe"
1⤵
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3580

C:\Users\Admin\AppData\Local\Temp\WindowsUpdate.exe
"C:\Users\Admin\AppData\Local\Temp\WindowsUpdate.exe"
2⤵
- Executes dropped EXE
PID:5056

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\WindowsUpdate.exe
Filesize
21KB

MD5
fec89e9d2784b4c015fed6f5ae558e08

SHA1
581fd9fb59bd42fbe7bd065cf0e6ff6d4d0daba2

SHA256
489f2546a4ad1e0e0147d1ca2fd8801785689f67fb850171ccbaa6306a152065

SHA512
e3bbf89cc0a955a2819455137e540952c55f417732a596ef314a46d5312b3bed644ac7595f75d3639ebc30e85f0f210dba0ef5b013d1b83bafd2c17a9d685a24

Download Submit
C:\Users\Admin\AppData\Local\Temp\WindowsUpdate.exe
Filesize
21KB

MD5
fec89e9d2784b4c015fed6f5ae558e08

SHA1
581fd9fb59bd42fbe7bd065cf0e6ff6d4d0daba2

SHA256
489f2546a4ad1e0e0147d1ca2fd8801785689f67fb850171ccbaa6306a152065

SHA512
e3bbf89cc0a955a2819455137e540952c55f417732a596ef314a46d5312b3bed644ac7595f75d3639ebc30e85f0f210dba0ef5b013d1b83bafd2c17a9d685a24

Download Submit
C:\Users\Admin\AppData\Local\Temp\WindowsUpdate.exe
Filesize
21KB

MD5
fec89e9d2784b4c015fed6f5ae558e08

SHA1
581fd9fb59bd42fbe7bd065cf0e6ff6d4d0daba2

SHA256
489f2546a4ad1e0e0147d1ca2fd8801785689f67fb850171ccbaa6306a152065

SHA512
e3bbf89cc0a955a2819455137e540952c55f417732a596ef314a46d5312b3bed644ac7595f75d3639ebc30e85f0f210dba0ef5b013d1b83bafd2c17a9d685a24

Download Submit
memory/3580-0-0x0000000004A30000-0x0000000004A62000-memory.dmp

Filesize
200KB

Download
memory/3580-1-0x0000000074870000-0x0000000075020000-memory.dmp

Filesize
7.7MB

Download
memory/3580-2-0x0000000004A60000-0x0000000004A70000-memory.dmp

Filesize
64KB

Download
memory/3580-4-0x0000000004A60000-0x0000000004A70000-memory.dmp

Filesize
64KB

Download
memory/3580-5-0x0000000004AB0000-0x0000000004AE2000-memory.dmp

Filesize
200KB

Download
memory/3580-3-0x0000000004A60000-0x0000000004A70000-memory.dmp

Filesize
64KB

Download
memory/3580-6-0x0000000004AB0000-0x0000000004ADB000-memory.dmp

Filesize
172KB

Download
memory/3580-7-0x0000000004AB0000-0x0000000004ADB000-memory.dmp

Filesize
172KB

Download
memory/3580-9-0x0000000004AB0000-0x0000000004ADB000-memory.dmp

Filesize
172KB

Download
memory/3580-11-0x0000000004AB0000-0x0000000004ADB000-memory.dmp

Filesize
172KB

Download
memory/3580-13-0x0000000004AB0000-0x0000000004ADB000-memory.dmp

Filesize
172KB

Download
memory/3580-15-0x0000000004AB0000-0x0000000004ADB000-memory.dmp

Filesize
172KB

Download
memory/3580-17-0x0000000004AB0000-0x0000000004ADB000-memory.dmp

Filesize
172KB

Download
memory/3580-19-0x0000000004AB0000-0x0000000004ADB000-memory.dmp

Filesize
172KB

Download
memory/3580-21-0x0000000004AB0000-0x0000000004ADB000-memory.dmp

Filesize
172KB

Download
memory/3580-25-0x0000000004AB0000-0x0000000004ADB000-memory.dmp

Filesize
172KB

Download
memory/3580-23-0x0000000004AB0000-0x0000000004ADB000-memory.dmp

Filesize
172KB

Download
memory/3580-27-0x0000000004AB0000-0x0000000004ADB000-memory.dmp

Filesize
172KB

Download
memory/3580-29-0x0000000004AB0000-0x0000000004ADB000-memory.dmp

Filesize
172KB

Download
memory/3580-31-0x0000000004AB0000-0x0000000004ADB000-memory.dmp

Filesize
172KB

Download
memory/3580-33-0x0000000004AB0000-0x0000000004ADB000-memory.dmp

Filesize
172KB

Download
memory/3580-35-0x0000000004AB0000-0x0000000004ADB000-memory.dmp

Filesize
172KB

Download
memory/3580-37-0x0000000004AB0000-0x0000000004ADB000-memory.dmp

Filesize
172KB

Download
memory/3580-39-0x0000000004AB0000-0x0000000004ADB000-memory.dmp

Filesize
172KB

Download
memory/3580-41-0x0000000004AB0000-0x0000000004ADB000-memory.dmp

Filesize
172KB

Download
memory/3580-43-0x0000000004AB0000-0x0000000004ADB000-memory.dmp

Filesize
172KB

Download
memory/3580-45-0x0000000004AB0000-0x0000000004ADB000-memory.dmp

Filesize
172KB

Download
memory/3580-47-0x0000000004AB0000-0x0000000004ADB000-memory.dmp

Filesize
172KB

Download
memory/3580-49-0x0000000004AB0000-0x0000000004ADB000-memory.dmp

Filesize
172KB

Download
memory/3580-51-0x0000000004AB0000-0x0000000004ADB000-memory.dmp

Filesize
172KB

Download
memory/3580-53-0x0000000004AB0000-0x0000000004ADB000-memory.dmp

Filesize
172KB

Download
memory/3580-55-0x0000000004AB0000-0x0000000004ADB000-memory.dmp

Filesize
172KB

Download
memory/3580-57-0x0000000004AB0000-0x0000000004ADB000-memory.dmp

Filesize
172KB

Download
memory/3580-59-0x0000000004AB0000-0x0000000004ADB000-memory.dmp

Filesize
172KB

Download
memory/3580-61-0x0000000004AB0000-0x0000000004ADB000-memory.dmp

Filesize
172KB

Download
memory/3580-63-0x0000000004AB0000-0x0000000004ADB000-memory.dmp

Filesize
172KB

Download
memory/3580-65-0x0000000004AB0000-0x0000000004ADB000-memory.dmp

Filesize
172KB

Download
memory/3580-67-0x0000000004AB0000-0x0000000004ADB000-memory.dmp

Filesize
172KB

Download
memory/3580-69-0x0000000004AB0000-0x0000000004ADB000-memory.dmp

Filesize
172KB

Download
memory/3580-130-0x0000000004A60000-0x0000000004A70000-memory.dmp

Filesize
64KB

Download
memory/3580-131-0x0000000004B00000-0x0000000004B01000-memory.dmp

Filesize
4KB

Download
memory/3580-132-0x0000000004B10000-0x00000000050B4000-memory.dmp

Filesize
5.6MB

Download
memory/3580-133-0x0000000005130000-0x00000000051C2000-memory.dmp

Filesize
584KB

Download
memory/3580-134-0x0000000005370000-0x000000000537A000-memory.dmp

Filesize
40KB

Download
memory/3580-135-0x0000000074870000-0x0000000075020000-memory.dmp

Filesize
7.7MB

Download
memory/3580-136-0x0000000004A60000-0x0000000004A70000-memory.dmp

Filesize
64KB

Download
memory/3580-137-0x0000000005550000-0x000000000555E000-memory.dmp

Filesize
56KB

Download
memory/5056-149-0x0000000000C50000-0x0000000000C5C000-memory.dmp

Filesize
48KB

Download
memory/5056-150-0x00007FFD8E070000-0x00007FFD8EB31000-memory.dmp

Filesize
10.8MB

Download
memory/5056-151-0x000000001B810000-0x000000001B820000-memory.dmp

Filesize
64KB

Download

Analysis

Sharing