Analysis
- max time kernel
150s - max time network
128s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
11/08/2026, 00:20
General
- Target FXCM_MetaTrader5.exe
- Size 3.3MB
- Sample260811-amx7wabe49
- SHA256 c2862b3a46dfe13c5f965883e1630a6c6042273e431cc9fb11def11a3e7eef2f
Malware Config
Signatures
- Checks BIOS information in registry 2 TTPs 1 IoCs
BIOS information is often read in order to detect sandboxing environments.
- Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
- Drops file in Program Files directory 1 IoCs
- Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
- Enumerates system info in registry 2 TTPs 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\FXCM_MetaTrader5.exe"C:\Users\Admin\AppData\Local\Temp\FXCM_MetaTrader5.exe"1⤵
- Checks BIOS information in registry
- Writes to the Master Boot Record (MBR)
- Drops file in Program Files directory
- Checks processor information in registry
- Enumerates system info in registry
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
memory/2500-1-0x0000000000960000-0x0000000000A27000-memory.dmp
memory/2500-3-0x0000000000C50000-0x0000000000CC4000-memory.dmp
memory/2500-2-0x0000000001120000-0x00000000014C1000-memory.dmp
memory/2500-4-0x00000000014D0000-0x0000000001693000-memory.dmp
memory/2500-6-0x00000000016A0000-0x0000000001752000-memory.dmp
memory/2500-5-0x0000000000B10000-0x0000000000B3A000-memory.dmp
memory/2500-12-0x0000000002260000-0x00000000022DA000-memory.dmp
memory/2500-11-0x00000000020E0000-0x0000000002256000-memory.dmp
memory/2500-13-0x00000000022E0000-0x0000000002570000-memory.dmp
memory/2500-21-0x0000000002C10000-0x0000000002D31000-memory.dmp
memory/2500-36-0x0000000006240000-0x000000000625D000-memory.dmp
memory/2500-43-0x00000000067E0000-0x0000000006900000-memory.dmp
memory/2500-59-0x000000000EB50000-0x000000000ECB8000-memory.dmp
memory/2500-60-0x0000000007C70000-0x0000000007E9A000-memory.dmp
memory/2500-58-0x000000000E860000-0x000000000EB43000-memory.dmp
memory/2500-57-0x000000000DF30000-0x000000000E055000-memory.dmp
memory/2500-56-0x000000000DCE0000-0x000000000DE24000-memory.dmp
memory/2500-46-0x0000000006910000-0x0000000006A69000-memory.dmp
memory/2500-37-0x0000000006120000-0x00000000061CD000-memory.dmp
memory/2500-55-0x000000000DCB0000-0x000000000DCD7000-memory.dmp
memory/2500-54-0x000000000DB50000-0x000000000DB7D000-memory.dmp
memory/2500-53-0x0000000006B90000-0x0000000006BCF000-memory.dmp
memory/2500-52-0x0000000006B50000-0x0000000006B80000-memory.dmp
memory/2500-51-0x000000000DAA0000-0x000000000DB4C000-memory.dmp
memory/2500-50-0x000000000C660000-0x000000000C724000-memory.dmp
memory/2500-49-0x00000000063A0000-0x00000000063AD000-memory.dmp
memory/2500-48-0x0000000006A70000-0x0000000006AF6000-memory.dmp
memory/2500-47-0x0000000006390000-0x000000000639B000-memory.dmp
memory/2500-45-0x0000000006330000-0x000000000633A000-memory.dmp
memory/2500-44-0x0000000006350000-0x0000000006382000-memory.dmp
memory/2500-42-0x0000000006300000-0x0000000006320000-memory.dmp
memory/2500-41-0x00000000062F0000-0x00000000062FC000-memory.dmp
memory/2500-40-0x00000000062B0000-0x00000000062E8000-memory.dmp
memory/2500-39-0x0000000005DE0000-0x0000000005DFC000-memory.dmp
memory/2500-38-0x0000000005D70000-0x0000000005DD8000-memory.dmp
memory/2500-35-0x0000000005CA0000-0x0000000005D48000-memory.dmp
memory/2500-34-0x0000000005C00000-0x0000000005C99000-memory.dmp
memory/2500-32-0x0000000004D50000-0x0000000004E23000-memory.dmp
memory/2500-31-0x0000000004E50000-0x000000000567A000-memory.dmp
memory/2500-25-0x0000000002F50000-0x000000000309B000-memory.dmp
memory/2500-24-0x0000000002EA0000-0x0000000002F43000-memory.dmp
memory/2500-33-0x0000000004D20000-0x0000000004D3A000-memory.dmp
memory/2500-23-0x0000000002DF0000-0x0000000002E97000-memory.dmp
memory/2500-22-0x0000000002D40000-0x0000000002DE9000-memory.dmp
memory/2500-19-0x0000000002AC0000-0x0000000002BD6000-memory.dmp
memory/2500-30-0x0000000004D00000-0x0000000004D13000-memory.dmp
memory/2500-29-0x00000000036C0000-0x00000000036EF000-memory.dmp
memory/2500-26-0x00000000030A0000-0x000000000341C000-memory.dmp
memory/2500-28-0x0000000003470000-0x00000000034A9000-memory.dmp
memory/2500-27-0x0000000003420000-0x0000000003468000-memory.dmp
memory/2500-20-0x0000000002BE0000-0x0000000002C07000-memory.dmp
memory/2500-17-0x00000000028E0000-0x00000000028EB000-memory.dmp
memory/2500-18-0x00000000028F0000-0x0000000002ABA000-memory.dmp
memory/2500-16-0x0000000002590000-0x00000000027D1000-memory.dmp
memory/2500-15-0x0000000002580000-0x000000000258D000-memory.dmp
memory/2500-14-0x0000000000D90000-0x0000000000DB6000-memory.dmp
memory/2500-9-0x0000000002000000-0x00000000020D6000-memory.dmp
memory/2500-8-0x0000000001E60000-0x0000000001FF9000-memory.dmp
memory/2500-10-0x0000000000D30000-0x0000000000D8D000-memory.dmp
memory/2500-7-0x0000000001760000-0x0000000001E56000-memory.dmp
memory/2500-98-0x0000000005D70000-0x0000000005DD8000-memory.dmp
memory/2500-79-0x0000000002AC0000-0x0000000002BD6000-memory.dmp
memory/2500-125-0x0000000000B10000-0x0000000000B3A000-memory.dmp
memory/2500-123-0x0000000000C50000-0x0000000000CC4000-memory.dmp