fortmeme-retrac[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
fortmeme-retrac.exe
Size 1.4MB
Sample260731-yabeca1vcs
SHA256 2661510abc753cfaca42a0e6f94f956f969f8dbad185d4c0f8e0ac95d7fce017
MD5 0a2b75acd399a7b49cae0ebc45d3d383
SHA1 63efa26288fe9e1143f3a8415768d919d84b103b
SHA512 03fe9b65e21e3d88628bad4df1a350d75348f3b0e3be3937c4932d28364fefde7bc918e76fdea675a7d3ce6e56a0a61f594a81f505d167b3bca806b8a28d04f2
SSDEEP 24576:xaXqLy1q7mLsQQW23PlLA1yFadWiQndzzVoeL/Ts7gSWrmaD238Eu/xPHEatpmDr:MXqLy1q7vD3P18yFad/QnVzuk/ggjf1o
TLSH
T153658EA2E7EC5486D02774389B45690FB231742403109BE77F990E5D8BBE9E0CB7EB91
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
fortmeme-retrac.exe

File Explorer

fortmeme-retrac.exe

.exe 1.4MB

fortmeme-retrac.exe

IMPHASH 021f93994034932f19e785640067c641
SHA256 2661510abc753cfaca42a0e6f94f956f969f8dbad185d4c0f8e0ac95d7fce017
MD5 0a2b75acd399a7b49cae0ebc45d3d383
SHA1 63efa26288fe9e1143f3a8415768d919d84b103b
SHA512 03fe9b65e21e3d88628bad4df1a350d75348f3b0e3be3937c4932d28364fefde7bc918e76fdea675a7d3ce6e56a0a61f594a81f505d167b3bca806b8a28d04f2
SSDEEP 24576:xaXqLy1q7mLsQQW23PlLA1yFadWiQndzzVoeL/Ts7gSWrmaD238Eu/xPHEatpmDr:MXqLy1q7vD3P18yFad/QnVzuk/ggjf1o
TLSH
T153658EA2E7EC5486D02774389B45690FB231742403109BE77F990E5D8BBE9E0CB7EB91
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

606340

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\Users\nogibogi\Desktop\stuff\Senex Retrac\x64\Release\nogibogi.pdb

d3d11

D3D11CreateDeviceAndSwapChain

kernel32

TerminateProcess CreateJobObjectW ResumeThread OpenProcess Sleep GetConsoleMode GetTempPathA SetFileAttributesA Beep CreateProcessW GetConsoleWindow GetTickCount GetProcessTimes MultiByteToWideChar GlobalAlloc GlobalFree GlobalLock WideCharToMultiByte GlobalUnlock GetLocaleInfoA LoadLibraryA QueryPerformanceFrequency GetProcAddress FreeLibrary QueryPerformanceCounter SetConsoleMode CreateDirectoryW FindClose FindFirstFileW FindFirstFileExW FindNextFileW GetStdHandle GetFileInformationByHandle SetFileInformationByHandle AreFileApisANSI GetModuleHandleW CopyFileW MoveFileExW GetFileInformationByHandleEx CreateSymbolicLinkW LocalFree FormatMessageA GetLocaleInfoEx ReleaseSRWLockExclusive AcquireSRWLockExclusive SleepConditionVariableSRW GetCurrentThreadId WakeAllConditionVariable UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess IsProcessorFeaturePresent IsDebuggerPresent GetCurrentProcessId GetSystemTimeAsFileTime InitializeSListHead SetConsoleTitleA AssignProcessToJobObject SetInformationJobObject GetModuleFileNameA CloseHandle Process32FirstW Process32NextW GetLastError CreateToolhelp32Snapshot CreateFileW DeviceIoControl GetFileAttributesExW

user32

GetCursorPos ShowCursor UpdateWindow SetWindowLongPtrW GetClientRect GetSystemMetrics GetKeyState ScreenToClient SetWindowLongW mouse_event TranslateMessage SetPropW SetLayeredWindowAttributes GetPropW GetWindowLongPtrW SetWindowPos DestroyWindow ShowWindow GetWindow GetKeyNameTextA GetWindowThreadProcessId GetWindowLongW SetClipboardData GetClipboardData EmptyClipboard CloseClipboard OpenClipboard SetCursorPos EnumWindows SetMenu MapVirtualKeyA SetWindowDisplayAffinity PeekMessageW DispatchMessageW GetAsyncKeyState ClientToScreen GetKeyboardLayout GetForegroundWindow SetCursor LoadCursorW RemovePropW

advapi32

CloseServiceHandle OpenSCManagerW StartServiceA OpenServiceA CreateServiceA

shell32

ShellExecuteA

msvcp140

??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ ?always_noconv@codecvt_base@std@@QEBA_NXZ ?_Xbad_alloc@std@@YAXXZ _Thrd_yield _Query_perf_frequency ??1_Lockit@std@@QEAA@XZ ??0_Lockit@std@@QEAA@H@Z ?_Throw_Cpp_error@std@@YAXH@Z ?uncaught_exceptions@std@@YAHXZ ?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A ?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ ?cin@std@@3V?$basic_istream@DU?$char_traits@D@std@@@1@A ?_Id_cnt@id@locale@std@@0HA ?_Xout_of_range@std@@YAXPEBD@Z ?_Winerror_map@std@@YAHH@Z ?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A ?_Fiopen@std@@YAPEAU_iobuf@@PEBDHH@Z ?_Fiopen@std@@YAPEAU_iobuf@@PEB_WHH@Z ?id@?$ctype@D@std@@2V0locale@2@A ?_Random_device@std@@YAIXZ ?_Xlength_error@std@@YAXPEBD@Z ?_Syserror_map@std@@YAPEBDH@Z _Mtx_lock _Cnd_do_broadcast_at_thread_exit _Query_perf_counter _Thrd_detach _Mtx_unlock ?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ ?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ ?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAPEAD0PEAH001@Z ??0?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA_N_N@Z ??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ ?unshift@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z ?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z ??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ ?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z ?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z ??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z ?in@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ ??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ ?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ ?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z ?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z ?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAPEAV12@PEAD_J@Z ?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAXAEBVlocale@2@@Z ??1?$basic_istream@DU?$char_traits@D@std@@@std@@UEAA@XZ ??5?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@AEA_N@Z ??5?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@AEAH@Z ??5?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@AEAM@Z ?get@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAHXZ ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@_N@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@M@Z ?write@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@PEBD_J@Z ??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UEAA@XZ ?getloc@ios_base@std@@QEBA?AVlocale@2@XZ ?good@ios_base@std@@QEBA_NXZ ??Bios_base@std@@QEBA_NXZ ?_Getcat@?$ctype@D@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z

ntdll

RtlLookupFunctionEntry RtlVirtualUnwind RtlCaptureContext

imm32

ImmSetCompositionWindow ImmSetCandidateWindow ImmGetContext ImmReleaseContext

d3dcompiler_47

D3DCompile

dwmapi

DwmExtendFrameIntoClientArea

vcruntime140_1

__CxxFrameHandler4

vcruntime140

__std_terminate memmove __std_exception_destroy __std_exception_copy _CxxThrowException __C_specific_handler __current_exception_context __current_exception memset memcpy memchr memcmp strchr strstr

api-ms-win-crt-heap-l1-1-0

malloc _callnewh _set_new_mode realloc free

api-ms-win-crt-runtime-l1-1-0

terminate exit _invoke_watson _beginthreadex _register_thread_local_exe_atexit_callback _c_exit __p___argv __p___argc abort _exit _initterm_e _initterm _get_initial_narrow_environment _set_app_type _seh_filter_exe _cexit _crt_atexit _register_onexit_function _initialize_onexit_table _initialize_narrow_environment _configure_narrow_argv system

api-ms-win-crt-stdio-l1-1-0

fclose __stdio_common_vsscanf _wfopen __p__commode _set_fmode __stdio_common_vsprintf_s fputc __acrt_iob_func ftell _get_stream_buffer_pointers _fseeki64 fread fsetpos ungetc setvbuf fgetpos __stdio_common_vsprintf fwrite fflush fseek fgetc

api-ms-win-crt-string-l1-1-0

strncmp strncpy _wcsicmp strcmp towlower

api-ms-win-crt-utility-l1-1-0

qsort rand

api-ms-win-crt-filesystem-l1-1-0

_lock_file _unlock_file

api-ms-win-crt-convert-l1-1-0

atof strtol

api-ms-win-crt-math-l1-1-0

ceilf cos atan2f asinf cosf fmodf log logf pow powf sin sinf sqrtf acosf ldexp atanf __setusermatherr sqrt tanf

api-ms-win-crt-locale-l1-1-0

___lc_codepage_func _configthreadlocale