General
- Target FMRS.exe
- Size 6.0MB
- Sample260721-pj8a1abm2y
- SHA256 970289ddb417f66fe708fe8a26712d6682b4faaec5df97b1e8dafd3019137a9a
- MD5 da98b10a636537294f8783d2a58ad28a
- SHA1 80cf72748cff25f1c043e325f1e15033b2886677
- SHA512 666648b287a70ce850c37a05f413f643f4fd47bf892ea8e5aaa42eb1b26051871a5ec605f34f5e8fde477463ec9baf68233e041ad4e6943f07a72e45f55491fa
- SSDEEP 98304:KpmmgfRXXuarr/Obvk8hCTGlqkVGW/Ohp97jKtR8VtwI0zBi2YGVWJQbKGHOAT0Y:KpMnjH2bjtlqkIW/07jKVI0zBTrVWJQv
- TLSH T1C356339A6AE381FFD11BD7388A55FF34F6A1DF163A40C8015BDBBC8B3EB5A818415418
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
FMRS.exe
Resource
win10v2004-20260513-en
21 signatures
150 seconds
Behavioral task
behavioral2
Sample
FMRS.exe
Resource
win11ltsc2024-20260709-en
15 signatures
150 seconds
Malware Config
Targets
-
- Target FMRS.exe
- Size 6.0MB
- SHA256 970289ddb417f66fe708fe8a26712d6682b4faaec5df97b1e8dafd3019137a9a
- MD5 da98b10a636537294f8783d2a58ad28a
- SHA1 80cf72748cff25f1c043e325f1e15033b2886677
- SHA512 666648b287a70ce850c37a05f413f643f4fd47bf892ea8e5aaa42eb1b26051871a5ec605f34f5e8fde477463ec9baf68233e041ad4e6943f07a72e45f55491fa
- SSDEEP 98304:KpmmgfRXXuarr/Obvk8hCTGlqkVGW/Ohp97jKtR8VtwI0zBi2YGVWJQbKGHOAT0Y:KpMnjH2bjtlqkIW/07jKVI0zBTrVWJQv
- TLSH T1C356339A6AE381FFD11BD7388A55FF34F6A1DF163A40C8015BDBBC8B3EB5A818415418
- MD5 SHA1 SHA512 SSDEEP TLSH
Score7/10Checks computer location settings
Looks up country code configured in the registry, likely geofence.
Executes dropped EXE
Loads dropped DLL
Drops file in System32 directory
Enumerates processes with tasklist