Analysis
-
max time kernel
114s -
max time network
125s -
platform
windows10_x64 -
resource
win10-en-20211014 -
submitted
06-12-2021 07:37
Static task
static1
Behavioral task
behavioral1
Sample
d5fce595b6cc51ed68e3090b624c716d.exe
Resource
win7-en-20211104
Behavioral task
behavioral2
Sample
d5fce595b6cc51ed68e3090b624c716d.exe
Resource
win10-en-20211014
General
-
Target
d5fce595b6cc51ed68e3090b624c716d.exe
-
Size
1.2MB
-
MD5
d5fce595b6cc51ed68e3090b624c716d
-
SHA1
49d091f52156fd2f7401026fc923f3d962326ce9
-
SHA256
4b89c6621588d5974b419f6aa7610ac8df584564a52a8555d32e190bc4f089f9
-
SHA512
55d849fa1de305af3e62597401f75ca771f7f720b53e700ea4d660445ba46fd5309138592d51be929cb3bf8a76d795d71ba95c920029eacf64a80651f9b8f84b
Malware Config
Signatures
-
Executes dropped EXE 3 IoCs
Processes:
fodhelper.exefodhelper.exefodhelper.exepid process 400 fodhelper.exe 3372 fodhelper.exe 2076 fodhelper.exe -
Obfuscated with Agile.Net obfuscator 3 IoCs
Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.
Processes:
resource yara_rule behavioral2/memory/2800-121-0x0000000005850000-0x0000000005871000-memory.dmp agile_net behavioral2/memory/2800-124-0x00000000055E0000-0x0000000005ADE000-memory.dmp agile_net behavioral2/memory/400-141-0x0000000004CC0000-0x0000000004D52000-memory.dmp agile_net -
Suspicious use of SetThreadContext 2 IoCs
Processes:
d5fce595b6cc51ed68e3090b624c716d.exefodhelper.exedescription pid process target process PID 2800 set thread context of 1412 2800 d5fce595b6cc51ed68e3090b624c716d.exe d5fce595b6cc51ed68e3090b624c716d.exe PID 400 set thread context of 3372 400 fodhelper.exe fodhelper.exe -
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
Processes:
schtasks.exeschtasks.exepid process 2940 schtasks.exe 1444 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 5 IoCs
Processes:
d5fce595b6cc51ed68e3090b624c716d.exefodhelper.exefodhelper.exepid process 2800 d5fce595b6cc51ed68e3090b624c716d.exe 2800 d5fce595b6cc51ed68e3090b624c716d.exe 400 fodhelper.exe 400 fodhelper.exe 2076 fodhelper.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
d5fce595b6cc51ed68e3090b624c716d.exefodhelper.exefodhelper.exedescription pid process Token: SeDebugPrivilege 2800 d5fce595b6cc51ed68e3090b624c716d.exe Token: SeDebugPrivilege 400 fodhelper.exe Token: SeDebugPrivilege 2076 fodhelper.exe -
Suspicious use of WriteProcessMemory 22 IoCs
Processes:
d5fce595b6cc51ed68e3090b624c716d.exed5fce595b6cc51ed68e3090b624c716d.exefodhelper.exefodhelper.exedescription pid process target process PID 2800 wrote to memory of 1412 2800 d5fce595b6cc51ed68e3090b624c716d.exe d5fce595b6cc51ed68e3090b624c716d.exe PID 2800 wrote to memory of 1412 2800 d5fce595b6cc51ed68e3090b624c716d.exe d5fce595b6cc51ed68e3090b624c716d.exe PID 2800 wrote to memory of 1412 2800 d5fce595b6cc51ed68e3090b624c716d.exe d5fce595b6cc51ed68e3090b624c716d.exe PID 2800 wrote to memory of 1412 2800 d5fce595b6cc51ed68e3090b624c716d.exe d5fce595b6cc51ed68e3090b624c716d.exe PID 2800 wrote to memory of 1412 2800 d5fce595b6cc51ed68e3090b624c716d.exe d5fce595b6cc51ed68e3090b624c716d.exe PID 2800 wrote to memory of 1412 2800 d5fce595b6cc51ed68e3090b624c716d.exe d5fce595b6cc51ed68e3090b624c716d.exe PID 2800 wrote to memory of 1412 2800 d5fce595b6cc51ed68e3090b624c716d.exe d5fce595b6cc51ed68e3090b624c716d.exe PID 2800 wrote to memory of 1412 2800 d5fce595b6cc51ed68e3090b624c716d.exe d5fce595b6cc51ed68e3090b624c716d.exe PID 1412 wrote to memory of 2940 1412 d5fce595b6cc51ed68e3090b624c716d.exe schtasks.exe PID 1412 wrote to memory of 2940 1412 d5fce595b6cc51ed68e3090b624c716d.exe schtasks.exe PID 1412 wrote to memory of 2940 1412 d5fce595b6cc51ed68e3090b624c716d.exe schtasks.exe PID 400 wrote to memory of 3372 400 fodhelper.exe fodhelper.exe PID 400 wrote to memory of 3372 400 fodhelper.exe fodhelper.exe PID 400 wrote to memory of 3372 400 fodhelper.exe fodhelper.exe PID 400 wrote to memory of 3372 400 fodhelper.exe fodhelper.exe PID 400 wrote to memory of 3372 400 fodhelper.exe fodhelper.exe PID 400 wrote to memory of 3372 400 fodhelper.exe fodhelper.exe PID 400 wrote to memory of 3372 400 fodhelper.exe fodhelper.exe PID 400 wrote to memory of 3372 400 fodhelper.exe fodhelper.exe PID 3372 wrote to memory of 1444 3372 fodhelper.exe schtasks.exe PID 3372 wrote to memory of 1444 3372 fodhelper.exe schtasks.exe PID 3372 wrote to memory of 1444 3372 fodhelper.exe schtasks.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\d5fce595b6cc51ed68e3090b624c716d.exe"C:\Users\Admin\AppData\Local\Temp\d5fce595b6cc51ed68e3090b624c716d.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\d5fce595b6cc51ed68e3090b624c716d.exe"C:\Users\Admin\AppData\Local\Temp\d5fce595b6cc51ed68e3090b624c716d.exe"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe/C /create /F /sc minute /mo 1 /tn "Azure-Update-Task" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\TelemetryServices\fodhelper.exe"3⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Roaming\Microsoft\TelemetryServices\fodhelper.exeC:\Users\Admin\AppData\Roaming\Microsoft\TelemetryServices\fodhelper.exe1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Microsoft\TelemetryServices\fodhelper.exe"C:\Users\Admin\AppData\Roaming\Microsoft\TelemetryServices\fodhelper.exe"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe/C /create /F /sc minute /mo 1 /tn "Azure-Update-Task" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\TelemetryServices\fodhelper.exe"3⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Roaming\Microsoft\TelemetryServices\fodhelper.exeC:\Users\Admin\AppData\Roaming\Microsoft\TelemetryServices\fodhelper.exe1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\fodhelper.exe.logMD5
7648e852b0157b362b07766e0b5b355e
SHA16f9ac6e9d89842d38345fb83930d8c927cb44c69
SHA2568dd14eb336757d783e47f36a98a4fe5c1314d93782907f538417265037819896
SHA512849e5e18a2439b9a228395c5f92d1ff8111b84ca7e56f9c2ace3580d21ceee0f78f7e9836668970a401fcf2fa2d88ff9aa89935595f45302b6af88a4069138d2
-
C:\Users\Admin\AppData\Roaming\Microsoft\TelemetryServices\fodhelper.exeMD5
d5fce595b6cc51ed68e3090b624c716d
SHA149d091f52156fd2f7401026fc923f3d962326ce9
SHA2564b89c6621588d5974b419f6aa7610ac8df584564a52a8555d32e190bc4f089f9
SHA51255d849fa1de305af3e62597401f75ca771f7f720b53e700ea4d660445ba46fd5309138592d51be929cb3bf8a76d795d71ba95c920029eacf64a80651f9b8f84b
-
C:\Users\Admin\AppData\Roaming\Microsoft\TelemetryServices\fodhelper.exeMD5
d5fce595b6cc51ed68e3090b624c716d
SHA149d091f52156fd2f7401026fc923f3d962326ce9
SHA2564b89c6621588d5974b419f6aa7610ac8df584564a52a8555d32e190bc4f089f9
SHA51255d849fa1de305af3e62597401f75ca771f7f720b53e700ea4d660445ba46fd5309138592d51be929cb3bf8a76d795d71ba95c920029eacf64a80651f9b8f84b
-
C:\Users\Admin\AppData\Roaming\Microsoft\TelemetryServices\fodhelper.exeMD5
d5fce595b6cc51ed68e3090b624c716d
SHA149d091f52156fd2f7401026fc923f3d962326ce9
SHA2564b89c6621588d5974b419f6aa7610ac8df584564a52a8555d32e190bc4f089f9
SHA51255d849fa1de305af3e62597401f75ca771f7f720b53e700ea4d660445ba46fd5309138592d51be929cb3bf8a76d795d71ba95c920029eacf64a80651f9b8f84b
-
C:\Users\Admin\AppData\Roaming\Microsoft\TelemetryServices\fodhelper.exeMD5
d5fce595b6cc51ed68e3090b624c716d
SHA149d091f52156fd2f7401026fc923f3d962326ce9
SHA2564b89c6621588d5974b419f6aa7610ac8df584564a52a8555d32e190bc4f089f9
SHA51255d849fa1de305af3e62597401f75ca771f7f720b53e700ea4d660445ba46fd5309138592d51be929cb3bf8a76d795d71ba95c920029eacf64a80651f9b8f84b
-
memory/400-141-0x0000000004CC0000-0x0000000004D52000-memory.dmpFilesize
584KB
-
memory/400-142-0x0000000004CC0000-0x0000000004D52000-memory.dmpFilesize
584KB
-
memory/1412-128-0x000000000040202B-mapping.dmp
-
memory/1412-130-0x0000000000400000-0x0000000000406000-memory.dmpFilesize
24KB
-
memory/1412-127-0x0000000000400000-0x0000000000406000-memory.dmpFilesize
24KB
-
memory/1444-148-0x0000000000000000-mapping.dmp
-
memory/2076-159-0x00000000053A0000-0x000000000589E000-memory.dmpFilesize
5.0MB
-
memory/2800-122-0x0000000006810000-0x0000000006811000-memory.dmpFilesize
4KB
-
memory/2800-115-0x0000000000B10000-0x0000000000B11000-memory.dmpFilesize
4KB
-
memory/2800-123-0x00000000067D0000-0x00000000067D1000-memory.dmpFilesize
4KB
-
memory/2800-124-0x00000000055E0000-0x0000000005ADE000-memory.dmpFilesize
5.0MB
-
memory/2800-121-0x0000000005850000-0x0000000005871000-memory.dmpFilesize
132KB
-
memory/2800-120-0x00000000055E0000-0x0000000005ADE000-memory.dmpFilesize
5.0MB
-
memory/2800-119-0x0000000005680000-0x0000000005681000-memory.dmpFilesize
4KB
-
memory/2800-126-0x00000000095D0000-0x00000000095D1000-memory.dmpFilesize
4KB
-
memory/2800-118-0x00000000055E0000-0x00000000055E1000-memory.dmpFilesize
4KB
-
memory/2800-117-0x0000000005AE0000-0x0000000005AE1000-memory.dmpFilesize
4KB
-
memory/2800-125-0x0000000007040000-0x000000000704B000-memory.dmpFilesize
44KB
-
memory/2940-129-0x0000000000000000-mapping.dmp
-
memory/3372-146-0x000000000040202B-mapping.dmp