Analysis
- max time kernel
121s - max time network
121s - platform
windows7_x64 - resource
win7-en-20211014 - submitted
30/11/2021, 08:50
General
- Target FortniteHack_V3.1.exe
- Size 1.3MB
- Sample211130-krmxtaeebn
- SHA256 1e7c90232d03aeedee7ac1a25b4dbb57ab96df556fda2c69dc302a50ea4b0c56
Malware Config
Signatures
- RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
- RedLine Payload 1 IoCs
- Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs
- Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
- Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Checks whether UAC is enabled 1 TTPs 1 IoCs
- Suspicious behavior: EnumeratesProcesses 1 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\FortniteHack_V3.1.exe"C:\Users\Admin\AppData\Local\Temp\FortniteHack_V3.1.exe"1⤵
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
memory/1100-55-0x00000000768A1000-0x00000000768A3000-memory.dmp
memory/1100-56-0x0000000000290000-0x00000000002F0000-memory.dmp
memory/1100-57-0x00000000027F0000-0x00000000027F1000-memory.dmp
memory/1100-58-0x0000000002800000-0x0000000002801000-memory.dmp
memory/1100-59-0x00000000027B0000-0x00000000027B1000-memory.dmp
memory/1100-60-0x0000000002820000-0x0000000002821000-memory.dmp
memory/1100-63-0x00000000027D0000-0x00000000027D1000-memory.dmp
memory/1100-62-0x0000000000400000-0x0000000000802000-memory.dmp
memory/1100-61-0x00000000027E0000-0x00000000027E1000-memory.dmp
memory/1100-64-0x0000000002840000-0x0000000002841000-memory.dmp
memory/1100-67-0x00000000034D0000-0x00000000034D1000-memory.dmp
memory/1100-69-0x00000000034D0000-0x00000000034D1000-memory.dmp
memory/1100-68-0x00000000034D0000-0x00000000034D1000-memory.dmp
memory/1100-66-0x00000000034E0000-0x00000000034E1000-memory.dmp
memory/1100-65-0x0000000002810000-0x0000000002811000-memory.dmp
memory/1100-70-0x00000000034D0000-0x00000000034D1000-memory.dmp
memory/1100-71-0x0000000000830000-0x0000000000831000-memory.dmp
memory/1100-72-0x0000000000840000-0x0000000000841000-memory.dmp
memory/1100-73-0x00000000003E0000-0x00000000003E1000-memory.dmp
memory/1100-75-0x0000000000860000-0x0000000000861000-memory.dmp
memory/1100-74-0x0000000000810000-0x0000000000811000-memory.dmp
memory/1100-76-0x00000000008C0000-0x00000000008C1000-memory.dmp
memory/1100-77-0x00000000034D0000-0x00000000034D1000-memory.dmp
memory/1100-79-0x0000000002740000-0x0000000002741000-memory.dmp
memory/1100-80-0x0000000002750000-0x0000000002751000-memory.dmp
memory/1100-78-0x00000000034D0000-0x00000000034D1000-memory.dmp
memory/1100-81-0x00000000023F0000-0x00000000023F1000-memory.dmp
memory/1100-83-0x0000000002730000-0x0000000002731000-memory.dmp
memory/1100-82-0x0000000002770000-0x0000000002771000-memory.dmp
memory/1100-84-0x0000000002720000-0x0000000002721000-memory.dmp
memory/1100-85-0x0000000002790000-0x0000000002791000-memory.dmp
memory/1100-87-0x00000000034D0000-0x00000000034D1000-memory.dmp
memory/1100-86-0x00000000034D0000-0x00000000034D1000-memory.dmp
memory/1100-88-0x00000000034D0000-0x00000000034D1000-memory.dmp
memory/1100-90-0x00000000034D0000-0x00000000034D1000-memory.dmp
memory/1100-91-0x00000000003D0000-0x00000000003D1000-memory.dmp
memory/1100-92-0x00000000028A0000-0x00000000028A1000-memory.dmp
memory/1100-95-0x00000000028D0000-0x00000000028D1000-memory.dmp
memory/1100-96-0x0000000002890000-0x0000000002891000-memory.dmp
memory/1100-94-0x0000000002860000-0x0000000002861000-memory.dmp
memory/1100-93-0x00000000028B0000-0x00000000028B1000-memory.dmp
memory/1100-89-0x00000000034D0000-0x00000000034D1000-memory.dmp
memory/1100-97-0x0000000002880000-0x0000000002881000-memory.dmp
memory/1100-99-0x00000000003D0000-0x00000000003D1000-memory.dmp
memory/1100-98-0x00000000028F0000-0x00000000028F1000-memory.dmp
memory/1100-100-0x00000000003D0000-0x00000000003D1000-memory.dmp
memory/1100-101-0x00000000028E0000-0x00000000028E1000-memory.dmp
memory/1100-102-0x00000000008D0000-0x00000000008D1000-memory.dmp
memory/1100-103-0x00000000003D0000-0x00000000003D1000-memory.dmp
memory/1100-104-0x00000000003D0000-0x00000000003D1000-memory.dmp
memory/1100-105-0x0000000000400000-0x0000000000402000-memory.dmp
memory/1100-107-0x0000000005A70000-0x0000000005A71000-memory.dmp