Analysis
-
max time kernel
119s -
max time network
122s -
platform
windows10_x64 -
resource
win10-en-20211014 -
submitted
24-10-2021 18:55
General
-
Target
Fortnite Hack Mod v1.4.exe
-
Size
2.5MB
-
MD5
b2b2d75e763403a6d129ae989eabb46d
-
SHA1
eef58fb000e6ebcba2464a8cdbdc6aa5989572de
-
SHA256
be830f0f9d8689b7a0a69fa6ab011633bf12ea6e968ca33cb4897eb2bcda1902
-
SHA512
d1c454f28bf01f9c50eaab096c0e2635946c9af3e75d9641654a18dae3d0ea5aec188d33ef3d48c555a2fca4e61fc7b9c743360ed6a881743b092d16f0fd2cd5
Score
9/10
Malware Config
Signatures
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs
-
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Themida packer 1 IoCs
Detects Themida, an advanced Windows software protection system.
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Checks whether UAC is enabled 1 TTPs 1 IoCs
-
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Fortnite Hack Mod v1.4.exe"C:\Users\Admin\AppData\Local\Temp\Fortnite Hack Mod v1.4.exe"1⤵
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.6MB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
6.0MB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB