Malware Analysis Report

2024-08-06 08:30

Sample ID 220804-jswqnsdfeq
Target FortniteChecker.v.2.0.0.rar
SHA256 4ffa12830e946bd9a968f9e3d79e7dac613d22465e72cc4492aff6d86991f73f
Tags
elysiumstealer collection evasion spyware stealer trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK Matrix

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

4ffa12830e946bd9a968f9e3d79e7dac613d22465e72cc4492aff6d86991f73f

Threat Level: Known bad

The file FortniteChecker.v.2.0.0.rar was found to be: Known bad.

Malicious Activity Summary

elysiumstealer collection evasion spyware stealer trojan

ElysiumStealer

Elysiumstealer family

ElysiumStealer Support DLL

UAC bypass

ElysiumStealer payload

ACProtect 1.3x - 1.4x DLL software

Loads dropped DLL

Reads user/profile data of web browsers

Checks whether UAC is enabled

Looks up external IP address via web service

Accesses Microsoft Outlook profiles

Legitimate hosting services abused for malware hosting/C2

System policy modification

Suspicious behavior: EnumeratesProcesses

outlook_win_path

Suspicious use of WriteProcessMemory

Checks processor information in registry

Suspicious use of AdjustPrivilegeToken

outlook_office_path

MITRE ATT&CK Matrix V6

Initial Access
TA0001
Execution
TA0002
Persistence
TA0003
Privilege Escalation
TA0004
Bypass User Account Control
T1088
Defense Evasion
TA0005
Bypass User Account Control
T1088
Disabling Security Tools
T1089
Modify Registry
T1112
Credential Access
TA0006
Credentials in Files
T1081
Discovery
TA0007
System Information Discovery
T1082
Query Registry
T1012
Lateral Movement
TA0008
Collection
TA0009
Data from Local System
T1005
Email Collection
T1114
Exfiltration
TA0010
Command and Control
TA0011
Web Service
T1102
Impact
TA0040

Analysis: static1

Detonation Overview

Reported

2022-08-04 07:56

Signatures

ElysiumStealer payload

Description Indicator Process Target
N/A N/A N/A N/A

Elysiumstealer family

elysiumstealer

ACProtect 1.3x - 1.4x DLL software

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2022-08-04 07:56

Reported

2022-08-04 07:58

Platform

win10-20220722-en

Max time kernel

30s

Max time network

30s

Command Line

"C:\Users\Admin\AppData\Local\Temp\FortniteChecker.v.2.0.0\ForniteChecker.v2.0.0.exe"

Signatures

ElysiumStealer

stealer elysiumstealer

ElysiumStealer Support DLL

Description Indicator Process Target
N/A N/A N/A N/A

ElysiumStealer payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

UAC bypass

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Users\Admin\AppData\Local\Temp\FortniteChecker.v.2.0.0\ForniteChecker.v2.0.0.exe N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\FortniteChecker.v.2.0.0\ForniteChecker.v2.0.0.exe N/A

Reads user/profile data of web browsers

spyware stealer

Accesses Microsoft Outlook profiles

collection
Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-1608273745-3137450291-1597631108-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Users\Admin\AppData\Local\Temp\FortniteChecker.v.2.0.0\ForniteChecker.v2.0.0.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-1608273745-3137450291-1597631108-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Users\Admin\AppData\Local\Temp\FortniteChecker.v.2.0.0\ForniteChecker.v2.0.0.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-1608273745-3137450291-1597631108-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Users\Admin\AppData\Local\Temp\FortniteChecker.v.2.0.0\ForniteChecker.v2.0.0.exe N/A

Checks whether UAC is enabled

evasion trojan
Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA C:\Users\Admin\AppData\Local\Temp\FortniteChecker.v.2.0.0\ForniteChecker.v2.0.0.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Users\Admin\AppData\Local\Temp\FortniteChecker.v.2.0.0\ForniteChecker.v2.0.0.exe N/A

Legitimate hosting services abused for malware hosting/C2

Looks up external IP address via web service

Description Indicator Process Target
N/A ip-api.com N/A N/A
N/A icanhazip.com N/A N/A

Checks processor information in registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\HARDWARE\Description\System\CentralProcessor\0 C:\Users\Admin\AppData\Local\Temp\FortniteChecker.v.2.0.0\ForniteChecker.v2.0.0.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier C:\Users\Admin\AppData\Local\Temp\FortniteChecker.v.2.0.0\ForniteChecker.v2.0.0.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\FortniteChecker.v.2.0.0\ForniteChecker.v2.0.0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\FortniteChecker.v.2.0.0\ForniteChecker.v2.0.0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\FortniteChecker.v.2.0.0\ForniteChecker.v2.0.0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\FortniteChecker.v.2.0.0\ForniteChecker.v2.0.0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\FortniteChecker.v.2.0.0\ForniteChecker.v2.0.0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\FortniteChecker.v.2.0.0\ForniteChecker.v2.0.0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\FortniteChecker.v.2.0.0\ForniteChecker.v2.0.0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\FortniteChecker.v.2.0.0\ForniteChecker.v2.0.0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\FortniteChecker.v.2.0.0\ForniteChecker.v2.0.0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\FortniteChecker.v.2.0.0\ForniteChecker.v2.0.0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\FortniteChecker.v.2.0.0\ForniteChecker.v2.0.0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\FortniteChecker.v.2.0.0\ForniteChecker.v2.0.0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\FortniteChecker.v.2.0.0\ForniteChecker.v2.0.0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\FortniteChecker.v.2.0.0\ForniteChecker.v2.0.0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\FortniteChecker.v.2.0.0\ForniteChecker.v2.0.0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\FortniteChecker.v.2.0.0\ForniteChecker.v2.0.0.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\FortniteChecker.v.2.0.0\ForniteChecker.v2.0.0.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\FortniteChecker.v.2.0.0\ForniteChecker.v2.0.0.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\system32\msiexec.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 4560 wrote to memory of 1348 N/A C:\Users\Admin\AppData\Local\Temp\FortniteChecker.v.2.0.0\ForniteChecker.v2.0.0.exe C:\Windows\SysWOW64\cmd.exe
PID 4560 wrote to memory of 1348 N/A C:\Users\Admin\AppData\Local\Temp\FortniteChecker.v.2.0.0\ForniteChecker.v2.0.0.exe C:\Windows\SysWOW64\cmd.exe
PID 4560 wrote to memory of 1348 N/A C:\Users\Admin\AppData\Local\Temp\FortniteChecker.v.2.0.0\ForniteChecker.v2.0.0.exe C:\Windows\SysWOW64\cmd.exe
PID 1348 wrote to memory of 1580 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\chcp.com
PID 1348 wrote to memory of 1580 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\chcp.com
PID 1348 wrote to memory of 1580 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\chcp.com
PID 1348 wrote to memory of 2304 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\netsh.exe
PID 1348 wrote to memory of 2304 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\netsh.exe
PID 1348 wrote to memory of 2304 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\netsh.exe
PID 1348 wrote to memory of 2332 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\findstr.exe
PID 1348 wrote to memory of 2332 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\findstr.exe
PID 1348 wrote to memory of 2332 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\findstr.exe

System policy modification

evasion
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Users\Admin\AppData\Local\Temp\FortniteChecker.v.2.0.0\ForniteChecker.v2.0.0.exe N/A

outlook_office_path

Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-1608273745-3137450291-1597631108-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Users\Admin\AppData\Local\Temp\FortniteChecker.v.2.0.0\ForniteChecker.v2.0.0.exe N/A

outlook_win_path

Description Indicator Process Target
Key opened \REGISTRY\USER\S-1-5-21-1608273745-3137450291-1597631108-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 C:\Users\Admin\AppData\Local\Temp\FortniteChecker.v.2.0.0\ForniteChecker.v2.0.0.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\FortniteChecker.v.2.0.0\ForniteChecker.v2.0.0.exe

"C:\Users\Admin\AppData\Local\Temp\FortniteChecker.v.2.0.0\ForniteChecker.v2.0.0.exe"

C:\Windows\SysWOW64\cmd.exe

"cmd.exe" /C chcp 65001 && netsh wlan show profile | findstr All

C:\Windows\SysWOW64\chcp.com

chcp 65001

C:\Windows\SysWOW64\netsh.exe

netsh wlan show profile

C:\Windows\SysWOW64\findstr.exe

findstr All

C:\Windows\system32\msiexec.exe

C:\Windows\system32\msiexec.exe /V

Network

Country Destination Domain Proto
NL 178.79.208.1:80 tcp
US 8.8.8.8:53 ip-api.com udp
US 208.95.112.1:80 ip-api.com tcp
US 8.8.8.8:53 discord.com udp
US 162.159.137.232:443 discord.com tcp
US 8.8.8.8:53 icanhazip.com udp
US 104.18.114.97:80 icanhazip.com tcp

Files

memory/4560-127-0x0000000077560000-0x00000000776EE000-memory.dmp

memory/4560-128-0x0000000077560000-0x00000000776EE000-memory.dmp

memory/4560-129-0x0000000077560000-0x00000000776EE000-memory.dmp

memory/4560-130-0x0000000077560000-0x00000000776EE000-memory.dmp

memory/4560-132-0x0000000077560000-0x00000000776EE000-memory.dmp

memory/4560-131-0x0000000077560000-0x00000000776EE000-memory.dmp

memory/4560-133-0x0000000077560000-0x00000000776EE000-memory.dmp

memory/4560-134-0x0000000077560000-0x00000000776EE000-memory.dmp

memory/4560-135-0x0000000077560000-0x00000000776EE000-memory.dmp

memory/4560-136-0x0000000077560000-0x00000000776EE000-memory.dmp

memory/4560-137-0x0000000077560000-0x00000000776EE000-memory.dmp

memory/4560-138-0x0000000077560000-0x00000000776EE000-memory.dmp

memory/4560-139-0x0000000077560000-0x00000000776EE000-memory.dmp

memory/4560-140-0x0000000077560000-0x00000000776EE000-memory.dmp

memory/4560-141-0x0000000077560000-0x00000000776EE000-memory.dmp

memory/4560-142-0x0000000077560000-0x00000000776EE000-memory.dmp

memory/4560-143-0x0000000077560000-0x00000000776EE000-memory.dmp

memory/4560-144-0x0000000077560000-0x00000000776EE000-memory.dmp

memory/4560-145-0x0000000077560000-0x00000000776EE000-memory.dmp

memory/4560-146-0x0000000077560000-0x00000000776EE000-memory.dmp

memory/4560-147-0x0000000077560000-0x00000000776EE000-memory.dmp

memory/4560-148-0x0000000077560000-0x00000000776EE000-memory.dmp

memory/4560-149-0x0000000077560000-0x00000000776EE000-memory.dmp

memory/4560-150-0x0000000077560000-0x00000000776EE000-memory.dmp

memory/4560-151-0x0000000077560000-0x00000000776EE000-memory.dmp

memory/4560-152-0x0000000077560000-0x00000000776EE000-memory.dmp

memory/4560-153-0x0000000077560000-0x00000000776EE000-memory.dmp

memory/4560-154-0x0000000077560000-0x00000000776EE000-memory.dmp

memory/4560-156-0x0000000077560000-0x00000000776EE000-memory.dmp

memory/4560-155-0x0000000077560000-0x00000000776EE000-memory.dmp

memory/4560-157-0x0000000077560000-0x00000000776EE000-memory.dmp

memory/4560-158-0x0000000077560000-0x00000000776EE000-memory.dmp

memory/4560-159-0x0000000077560000-0x00000000776EE000-memory.dmp

memory/4560-160-0x0000000077560000-0x00000000776EE000-memory.dmp

memory/4560-161-0x0000000000540000-0x0000000000712000-memory.dmp

memory/4560-162-0x0000000077560000-0x00000000776EE000-memory.dmp

memory/4560-163-0x0000000077560000-0x00000000776EE000-memory.dmp

memory/4560-164-0x0000000077560000-0x00000000776EE000-memory.dmp

memory/4560-165-0x0000000077560000-0x00000000776EE000-memory.dmp

memory/4560-166-0x0000000077560000-0x00000000776EE000-memory.dmp

memory/4560-167-0x0000000077560000-0x00000000776EE000-memory.dmp

memory/4560-168-0x0000000004E50000-0x0000000004E5C000-memory.dmp

memory/4560-169-0x0000000077560000-0x00000000776EE000-memory.dmp

memory/4560-171-0x0000000077560000-0x00000000776EE000-memory.dmp

\Users\Admin\AppData\Local\Temp\Runtime.MSIL.1.0.0.0\NativePRo.dll

MD5 94173de2e35aa8d621fc1c4f54b2a082
SHA1 fbb2266ee47f88462560f0370edb329554cd5869
SHA256 7e2c70b7732fb1a9a61d7ce3d7290bc7b31ea28cbfb1dbc79d377835615b941f
SHA512 cadbf4db0417283a02febbabd337bf17b254a6eb6e771f8a553a140dd2b04efd0672b1f3175c044a3edd0a911ce59d6695f765555262560925f3159bb8f3b798

memory/4560-172-0x0000000077560000-0x00000000776EE000-memory.dmp

memory/4560-173-0x0000000077560000-0x00000000776EE000-memory.dmp

memory/4560-174-0x0000000077560000-0x00000000776EE000-memory.dmp

memory/4560-175-0x0000000077560000-0x00000000776EE000-memory.dmp

memory/4560-176-0x0000000077560000-0x00000000776EE000-memory.dmp

memory/4560-177-0x0000000077560000-0x00000000776EE000-memory.dmp

memory/4560-178-0x0000000077560000-0x00000000776EE000-memory.dmp

memory/4560-179-0x0000000077560000-0x00000000776EE000-memory.dmp

memory/4560-180-0x0000000077560000-0x00000000776EE000-memory.dmp

memory/4560-181-0x0000000077560000-0x00000000776EE000-memory.dmp

memory/4560-182-0x0000000004FA0000-0x000000000501A000-memory.dmp

memory/4560-183-0x0000000077560000-0x00000000776EE000-memory.dmp

memory/4560-184-0x0000000077560000-0x00000000776EE000-memory.dmp

memory/4560-185-0x0000000077560000-0x00000000776EE000-memory.dmp

memory/4560-186-0x0000000077560000-0x00000000776EE000-memory.dmp

memory/4560-187-0x00000000050F0000-0x0000000005156000-memory.dmp

memory/4560-188-0x0000000077560000-0x00000000776EE000-memory.dmp

memory/4560-189-0x0000000077560000-0x00000000776EE000-memory.dmp

memory/4560-190-0x0000000077560000-0x00000000776EE000-memory.dmp

memory/4560-191-0x0000000077560000-0x00000000776EE000-memory.dmp

memory/4560-192-0x0000000077560000-0x00000000776EE000-memory.dmp

memory/4560-193-0x0000000077560000-0x00000000776EE000-memory.dmp

memory/4560-194-0x0000000077560000-0x00000000776EE000-memory.dmp

memory/4560-195-0x0000000077560000-0x00000000776EE000-memory.dmp

memory/4560-218-0x0000000006C50000-0x0000000006CE2000-memory.dmp

memory/1348-220-0x0000000000000000-mapping.dmp

memory/4560-224-0x0000000008510000-0x0000000008A0E000-memory.dmp

memory/1580-230-0x0000000000000000-mapping.dmp

memory/2304-245-0x0000000000000000-mapping.dmp

memory/2332-247-0x0000000000000000-mapping.dmp