Analysis
- max time kernel
123s - max time network
123s - platform
windows10_x64 - resource
win10-en-20211104 - submitted
26/11/2021, 17:03
General
- Target Fortnite Hack.exe
- Size 1.3MB
- Sample211126-vkpsyadfcq
- SHA256 c18cf6f2677277c4885ccb069d4e65b8c97c96c0ea72cee5d8e6a2d018d74ed0
Malware Config
Signatures
- RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
- RedLine Payload 1 IoCs
- Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs
- Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
- Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Checks whether UAC is enabled 1 TTPs 1 IoCs
- Suspicious behavior: EnumeratesProcesses 1 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Fortnite Hack.exe"C:\Users\Admin\AppData\Local\Temp\Fortnite Hack.exe"1⤵
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
memory/3584-118-0x0000000000AF0000-0x0000000000B50000-memory.dmp
memory/3584-120-0x00000000029D0000-0x00000000029D1000-memory.dmp
memory/3584-121-0x0000000002980000-0x0000000002981000-memory.dmp
memory/3584-122-0x00000000029F0000-0x00000000029F1000-memory.dmp
memory/3584-119-0x00000000029C0000-0x00000000029C1000-memory.dmp
memory/3584-124-0x00000000029A0000-0x00000000029A1000-memory.dmp
memory/3584-123-0x00000000029B0000-0x00000000029B1000-memory.dmp
memory/3584-126-0x0000000000400000-0x00000000007EC000-memory.dmp
memory/3584-127-0x00000000029E0000-0x00000000029E1000-memory.dmp
memory/3584-128-0x00000000036B0000-0x00000000036B1000-memory.dmp
memory/3584-129-0x00000000036A0000-0x00000000036A1000-memory.dmp
memory/3584-130-0x00000000036A0000-0x00000000036A1000-memory.dmp
memory/3584-125-0x0000000002A10000-0x0000000002A11000-memory.dmp
memory/3584-131-0x00000000036A0000-0x00000000036A1000-memory.dmp
memory/3584-132-0x00000000036A0000-0x00000000036A1000-memory.dmp
memory/3584-133-0x00000000027A0000-0x00000000027A1000-memory.dmp
memory/3584-134-0x00000000027B0000-0x00000000027B1000-memory.dmp
memory/3584-135-0x0000000002760000-0x0000000002761000-memory.dmp
memory/3584-136-0x0000000002780000-0x0000000002781000-memory.dmp
memory/3584-137-0x00000000027D0000-0x00000000027D1000-memory.dmp
memory/3584-138-0x0000000002800000-0x0000000002801000-memory.dmp
memory/3584-139-0x00000000036A0000-0x00000000036A1000-memory.dmp
memory/3584-140-0x00000000036A0000-0x00000000036A1000-memory.dmp
memory/3584-141-0x0000000002910000-0x0000000002911000-memory.dmp
memory/3584-142-0x0000000002920000-0x0000000002921000-memory.dmp
memory/3584-143-0x00000000028D0000-0x00000000028D1000-memory.dmp
memory/3584-144-0x0000000002940000-0x0000000002941000-memory.dmp
memory/3584-145-0x0000000002900000-0x0000000002901000-memory.dmp
memory/3584-146-0x00000000028F0000-0x00000000028F1000-memory.dmp
memory/3584-148-0x00000000036A0000-0x00000000036A1000-memory.dmp
memory/3584-149-0x00000000036A0000-0x00000000036A1000-memory.dmp
memory/3584-147-0x0000000002960000-0x0000000002961000-memory.dmp
memory/3584-150-0x00000000036A0000-0x00000000036A1000-memory.dmp
memory/3584-151-0x00000000036A0000-0x00000000036A1000-memory.dmp
memory/3584-152-0x00000000036A0000-0x00000000036A1000-memory.dmp
memory/3584-153-0x0000000002750000-0x0000000002751000-memory.dmp
memory/3584-154-0x0000000002A70000-0x0000000002A71000-memory.dmp
memory/3584-155-0x0000000002A80000-0x0000000002A81000-memory.dmp
memory/3584-156-0x0000000002A30000-0x0000000002A31000-memory.dmp
memory/3584-157-0x0000000002AA0000-0x0000000002AA1000-memory.dmp
memory/3584-158-0x0000000002A60000-0x0000000002A61000-memory.dmp
memory/3584-160-0x0000000002AC0000-0x0000000002AC1000-memory.dmp
memory/3584-159-0x0000000002A50000-0x0000000002A51000-memory.dmp
memory/3584-161-0x0000000002750000-0x0000000002751000-memory.dmp
memory/3584-163-0x0000000002AB0000-0x0000000002AB1000-memory.dmp
memory/3584-162-0x0000000002750000-0x0000000002751000-memory.dmp
memory/3584-165-0x0000000002750000-0x0000000002751000-memory.dmp
memory/3584-164-0x0000000002810000-0x0000000002811000-memory.dmp
memory/3584-166-0x0000000002750000-0x0000000002751000-memory.dmp
memory/3584-167-0x0000000000400000-0x0000000000402000-memory.dmp
memory/3584-169-0x0000000005DD0000-0x0000000005DD1000-memory.dmp
memory/3584-170-0x0000000006440000-0x0000000006441000-memory.dmp
memory/3584-171-0x0000000006470000-0x0000000006471000-memory.dmp
memory/3584-172-0x0000000006580000-0x0000000006581000-memory.dmp
memory/3584-173-0x0000000006600000-0x0000000006601000-memory.dmp
memory/3584-174-0x0000000006760000-0x0000000006761000-memory.dmp
memory/3584-175-0x0000000007160000-0x0000000007161000-memory.dmp
memory/3584-176-0x00000000071E0000-0x00000000071E1000-memory.dmp
memory/3584-177-0x0000000007280000-0x0000000007281000-memory.dmp
memory/3584-178-0x0000000007BA0000-0x0000000007BA1000-memory.dmp
memory/3584-179-0x0000000007C20000-0x0000000007C21000-memory.dmp
memory/3584-180-0x0000000007E20000-0x0000000007E21000-memory.dmp
memory/3584-181-0x0000000007FB0000-0x0000000007FB1000-memory.dmp
memory/3584-182-0x0000000008190000-0x0000000008191000-memory.dmp