fortmeme-retrac[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
fortmeme-retrac.exe
Size 1.4MB
Sample260802-sg67psck2v
SHA256 2d41f3c81c58412c20ddb255408bf13b77dc5539f21e8fbe219837d4bb835811
MD5 97f094c63e13b2328e2259d526829861
SHA1 b946fd3f5b420115f1ce06f6b212b7e10a5353a4
SHA512 c0bd318dd14e7eef106d4f1e7b241c7f4b90d4ec03ed9678bc2d43bd0fd831cb71f40e20fa9ab2bacb28f4b715ab62ecfe7287dc08276c282de39cfb9d5ea335
SSDEEP 24576:xaXqLy1q7mLsQQW23PlLA1yFadWiQndzzVoeL/Ts7gSWrmaD238Eu/xPHEatpmD:MXqLy1q7vD3P18yFad/QnVzuk/ggjf18
TLSH
T18A658DA2E7EC5486D02774389B45690FB231742403109BE77F990E5D8BBE9E0CB7EB91
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
fortmeme-retrac.exe

File Explorer

fortmeme-retrac.exe

.exe 1.4MB

fortmeme-retrac.exe

IMPHASH 021f93994034932f19e785640067c641
SHA256 2d41f3c81c58412c20ddb255408bf13b77dc5539f21e8fbe219837d4bb835811
MD5 97f094c63e13b2328e2259d526829861
SHA1 b946fd3f5b420115f1ce06f6b212b7e10a5353a4
SHA512 c0bd318dd14e7eef106d4f1e7b241c7f4b90d4ec03ed9678bc2d43bd0fd831cb71f40e20fa9ab2bacb28f4b715ab62ecfe7287dc08276c282de39cfb9d5ea335
SSDEEP 24576:xaXqLy1q7mLsQQW23PlLA1yFadWiQndzzVoeL/Ts7gSWrmaD238Eu/xPHEatpmD:MXqLy1q7vD3P18yFad/QnVzuk/ggjf18
TLSH
T18A658DA2E7EC5486D02774389B45690FB231742403109BE77F990E5D8BBE9E0CB7EB91
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

606340

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\Users\nogibogi\Desktop\stuff\Senex Retrac\x64\Release\nogibogi.pdb

d3d11

D3D11CreateDeviceAndSwapChain

kernel32

TerminateProcess CreateJobObjectW ResumeThread OpenProcess Sleep GetConsoleMode GetTempPathA SetFileAttributesA Beep CreateProcessW GetConsoleWindow GetTickCount GetProcessTimes MultiByteToWideChar GlobalAlloc GlobalFree GlobalLock WideCharToMultiByte GlobalUnlock GetLocaleInfoA LoadLibraryA QueryPerformanceFrequency GetProcAddress FreeLibrary QueryPerformanceCounter SetConsoleMode CreateDirectoryW FindClose FindFirstFileW FindFirstFileExW FindNextFileW GetStdHandle GetFileInformationByHandle SetFileInformationByHandle AreFileApisANSI GetModuleHandleW CopyFileW MoveFileExW GetFileInformationByHandleEx CreateSymbolicLinkW LocalFree FormatMessageA GetLocaleInfoEx ReleaseSRWLockExclusive AcquireSRWLockExclusive SleepConditionVariableSRW GetCurrentThreadId WakeAllConditionVariable UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess IsProcessorFeaturePresent IsDebuggerPresent GetCurrentProcessId GetSystemTimeAsFileTime InitializeSListHead SetConsoleTitleA AssignProcessToJobObject SetInformationJobObject GetModuleFileNameA CloseHandle Process32FirstW Process32NextW GetLastError CreateToolhelp32Snapshot CreateFileW DeviceIoControl GetFileAttributesExW

user32

GetCursorPos ShowCursor UpdateWindow SetWindowLongPtrW GetClientRect GetSystemMetrics GetKeyState ScreenToClient SetWindowLongW mouse_event TranslateMessage SetPropW SetLayeredWindowAttributes GetPropW GetWindowLongPtrW SetWindowPos DestroyWindow ShowWindow GetWindow GetKeyNameTextA GetWindowThreadProcessId GetWindowLongW SetClipboardData GetClipboardData EmptyClipboard CloseClipboard OpenClipboard SetCursorPos EnumWindows SetMenu MapVirtualKeyA SetWindowDisplayAffinity PeekMessageW DispatchMessageW GetAsyncKeyState ClientToScreen GetKeyboardLayout GetForegroundWindow SetCursor LoadCursorW RemovePropW

advapi32

CloseServiceHandle OpenSCManagerW StartServiceA OpenServiceA CreateServiceA

shell32

ShellExecuteA

msvcp140

??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ ?always_noconv@codecvt_base@std@@QEBA_NXZ ?_Xbad_alloc@std@@YAXXZ _Thrd_yield _Query_perf_frequency ??1_Lockit@std@@QEAA@XZ ??0_Lockit@std@@QEAA@H@Z ?_Throw_Cpp_error@std@@YAXH@Z ?uncaught_exceptions@std@@YAHXZ ?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A ?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ ?cin@std@@3V?$basic_istream@DU?$char_traits@D@std@@@1@A ?_Id_cnt@id@locale@std@@0HA ?_Xout_of_range@std@@YAXPEBD@Z ?_Winerror_map@std@@YAHH@Z ?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A ?_Fiopen@std@@YAPEAU_iobuf@@PEBDHH@Z ?_Fiopen@std@@YAPEAU_iobuf@@PEB_WHH@Z ?id@?$ctype@D@std@@2V0locale@2@A ?_Random_device@std@@YAIXZ ?_Xlength_error@std@@YAXPEBD@Z ?_Syserror_map@std@@YAPEBDH@Z _Mtx_lock _Cnd_do_broadcast_at_thread_exit _Query_perf_counter _Thrd_detach _Mtx_unlock ?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ ?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ ?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAPEAD0PEAH001@Z ??0?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA_N_N@Z ??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ ?unshift@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z ?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z ??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ ?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z ?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z ??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z ?in@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ ??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ ?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ ?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z ?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z ?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAPEAV12@PEAD_J@Z ?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAXAEBVlocale@2@@Z ??1?$basic_istream@DU?$char_traits@D@std@@@std@@UEAA@XZ ??5?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@AEA_N@Z ??5?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@AEAH@Z ??5?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@AEAM@Z ?get@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAHXZ ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@_N@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@M@Z ?write@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@PEBD_J@Z ??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UEAA@XZ ?getloc@ios_base@std@@QEBA?AVlocale@2@XZ ?good@ios_base@std@@QEBA_NXZ ??Bios_base@std@@QEBA_NXZ ?_Getcat@?$ctype@D@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z

ntdll

RtlLookupFunctionEntry RtlVirtualUnwind RtlCaptureContext

imm32

ImmSetCompositionWindow ImmSetCandidateWindow ImmGetContext ImmReleaseContext

d3dcompiler_47

D3DCompile

dwmapi

DwmExtendFrameIntoClientArea

vcruntime140_1

__CxxFrameHandler4

vcruntime140

__std_terminate memmove __std_exception_destroy __std_exception_copy _CxxThrowException __C_specific_handler __current_exception_context __current_exception memset memcpy memchr memcmp strchr strstr

api-ms-win-crt-heap-l1-1-0

malloc _callnewh _set_new_mode realloc free

api-ms-win-crt-runtime-l1-1-0

terminate exit _invoke_watson _beginthreadex _register_thread_local_exe_atexit_callback _c_exit __p___argv __p___argc abort _exit _initterm_e _initterm _get_initial_narrow_environment _set_app_type _seh_filter_exe _cexit _crt_atexit _register_onexit_function _initialize_onexit_table _initialize_narrow_environment _configure_narrow_argv system

api-ms-win-crt-stdio-l1-1-0

fclose __stdio_common_vsscanf _wfopen __p__commode _set_fmode __stdio_common_vsprintf_s fputc __acrt_iob_func ftell _get_stream_buffer_pointers _fseeki64 fread fsetpos ungetc setvbuf fgetpos __stdio_common_vsprintf fwrite fflush fseek fgetc

api-ms-win-crt-string-l1-1-0

strncmp strncpy _wcsicmp strcmp towlower

api-ms-win-crt-utility-l1-1-0

qsort rand

api-ms-win-crt-filesystem-l1-1-0

_lock_file _unlock_file

api-ms-win-crt-convert-l1-1-0

atof strtol

api-ms-win-crt-math-l1-1-0

ceilf cos atan2f asinf cosf fmodf log logf pow powf sin sinf sqrtf acosf ldexp atanf __setusermatherr sqrt tanf

api-ms-win-crt-locale-l1-1-0

___lc_codepage_func _configthreadlocale