Analysis
-
max time kernel
135s -
max time network
161s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
01-05-2023 19:39
Static task
static1
Behavioral task
behavioral1
Sample
FortniteHackMod v2.1.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
FortniteHackMod v2.1.exe
Resource
win10v2004-20230220-en
General
-
Target
FortniteHackMod v2.1.exe
-
Size
739KB
-
MD5
b6d03b0ec3c9d7ffb57a45b36924612a
-
SHA1
6b9d534a757642b733bdd85f33160a9bdcd96ea2
-
SHA256
47e8958d7ae26467cb5b9e1d6e0b206139d18f5a7ccfb834286be5aa76c8a3ee
-
SHA512
0172d13376632a506601ba2a7729acfd9d57808e625921f9e4c2b39654472aa8469b04cb7d56dba60efbc09750577d2cfb545b403fcf06f91ddfaabe413c669c
-
SSDEEP
12288:SF+Sq1UMUOEdKh88XBRDn/IZDtMZGlLBVXBXKYw3tKzeLiIwX939:SF+ScmKyqZ/YZD9VBkdKzb9
Malware Config
Signatures
-
Panda Stealer payload 2 IoCs
Processes:
resource yara_rule behavioral2/memory/4560-133-0x0000000000400000-0x00000000004A3000-memory.dmp family_pandastealer behavioral2/memory/4560-140-0x0000000000400000-0x00000000004A3000-memory.dmp family_pandastealer -
PandaStealer
Panda Stealer is a fork of CollectorProject Stealer written in C++.
-
Suspicious use of SetThreadContext 1 IoCs
Processes:
FortniteHackMod v2.1.exedescription pid process target process PID 4028 set thread context of 4560 4028 FortniteHackMod v2.1.exe AppLaunch.exe -
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 3672 4028 WerFault.exe FortniteHackMod v2.1.exe -
Suspicious use of WriteProcessMemory 5 IoCs
Processes:
FortniteHackMod v2.1.exedescription pid process target process PID 4028 wrote to memory of 4560 4028 FortniteHackMod v2.1.exe AppLaunch.exe PID 4028 wrote to memory of 4560 4028 FortniteHackMod v2.1.exe AppLaunch.exe PID 4028 wrote to memory of 4560 4028 FortniteHackMod v2.1.exe AppLaunch.exe PID 4028 wrote to memory of 4560 4028 FortniteHackMod v2.1.exe AppLaunch.exe PID 4028 wrote to memory of 4560 4028 FortniteHackMod v2.1.exe AppLaunch.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\FortniteHackMod v2.1.exe"C:\Users\Admin\AppData\Local\Temp\FortniteHackMod v2.1.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\AppLaunch.exe"2⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4028 -s 1522⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 4028 -ip 40281⤵