Overview
overview
1Static
static
1FortniteLauncher.exe
windows7-x64
1FortniteLauncher.exe
windows10-2004-x64
1MaterialSkin.dll
windows7-x64
1MaterialSkin.dll
windows10-2004-x64
1Newtonsoft.Json.dll
windows7-x64
1Newtonsoft.Json.dll
windows10-2004-x64
1Platanium.dll
windows7-x64
1Platanium.dll
windows10-2004-x64
1Analysis
-
max time kernel
68s -
max time network
78s -
platform
windows7_x64 -
resource
win7-20230220-en -
resource tags
arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system -
submitted
31-03-2023 15:26
Static task
static1
Behavioral task
behavioral1
Sample
FortniteLauncher.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
FortniteLauncher.exe
Resource
win10v2004-20230220-en
Behavioral task
behavioral3
Sample
MaterialSkin.dll
Resource
win7-20230220-en
Behavioral task
behavioral4
Sample
MaterialSkin.dll
Resource
win10v2004-20230220-en
Behavioral task
behavioral5
Sample
Newtonsoft.Json.dll
Resource
win7-20230220-en
Behavioral task
behavioral6
Sample
Newtonsoft.Json.dll
Resource
win10v2004-20230220-en
Behavioral task
behavioral7
Sample
Platanium.dll
Resource
win7-20230220-en
Behavioral task
behavioral8
Sample
Platanium.dll
Resource
win10v2004-20230220-en
General
-
Target
FortniteLauncher.exe
-
Size
387KB
-
MD5
8b528f2dbe12d7f8e73be1e0aed385b8
-
SHA1
0f7e25fb92b5c3909f843f4cdf73dbd658750be4
-
SHA256
f4b6b1c41f04007b2816e50bfe6e53515d430cf3d64d1f5cb0ed6f8a67959b85
-
SHA512
0e88d919263b71fc589ea58bd7cda1250e9d4468438ea304b42a11ba3fa0424b35618e8d68ec736bd00db8458131a80597d52e1848f671115eb08487d6ab7881
-
SSDEEP
6144:X5BK9hJbgDFcv7SzYLDOj2S/KScp+4+pNBVM0jaTw3xreDy9sE7E:X5BK5bgDFmSzcUHSRF+fM0jfxMy9seE
Malware Config
Signatures
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 108 FortniteLauncher.exe -
Suspicious use of AdjustPrivilegeToken 5 IoCs
description pid Process Token: 33 1372 AUDIODG.EXE Token: SeIncBasePriorityPrivilege 1372 AUDIODG.EXE Token: 33 1372 AUDIODG.EXE Token: SeIncBasePriorityPrivilege 1372 AUDIODG.EXE Token: SeDebugPrivilege 108 FortniteLauncher.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 108 FortniteLauncher.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\FortniteLauncher.exe"C:\Users\Admin\AppData\Local\Temp\FortniteLauncher.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:108
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x47c1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1372