Analysis
-
max time kernel
20s -
max time network
35s -
platform
windows7_x64 -
resource
win7-20230220-en -
resource tags
arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system -
submitted
05-05-2023 20:42
Static task
static1
Behavioral task
behavioral1
Sample
FortniteHackModv2.1.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
FortniteHackModv2.1.exe
Resource
win10v2004-20230220-en
General
-
Target
FortniteHackModv2.1.exe
-
Size
739KB
-
MD5
b6d03b0ec3c9d7ffb57a45b36924612a
-
SHA1
6b9d534a757642b733bdd85f33160a9bdcd96ea2
-
SHA256
47e8958d7ae26467cb5b9e1d6e0b206139d18f5a7ccfb834286be5aa76c8a3ee
-
SHA512
0172d13376632a506601ba2a7729acfd9d57808e625921f9e4c2b39654472aa8469b04cb7d56dba60efbc09750577d2cfb545b403fcf06f91ddfaabe413c669c
-
SSDEEP
12288:SF+Sq1UMUOEdKh88XBRDn/IZDtMZGlLBVXBXKYw3tKzeLiIwX939:SF+ScmKyqZ/YZD9VBkdKzb9
Malware Config
Signatures
-
Panda Stealer payload 3 IoCs
Processes:
resource yara_rule behavioral1/memory/684-55-0x0000000000400000-0x00000000004A3000-memory.dmp family_pandastealer behavioral1/memory/684-63-0x0000000000400000-0x00000000004A3000-memory.dmp family_pandastealer behavioral1/memory/684-64-0x0000000000400000-0x00000000004A3000-memory.dmp family_pandastealer -
PandaStealer
Panda Stealer is a fork of CollectorProject Stealer written in C++.
-
Suspicious use of SetThreadContext 1 IoCs
Processes:
FortniteHackModv2.1.exedescription pid process target process PID 2004 set thread context of 684 2004 FortniteHackModv2.1.exe AppLaunch.exe -
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 1680 2004 WerFault.exe FortniteHackModv2.1.exe -
Suspicious use of WriteProcessMemory 13 IoCs
Processes:
FortniteHackModv2.1.exedescription pid process target process PID 2004 wrote to memory of 684 2004 FortniteHackModv2.1.exe AppLaunch.exe PID 2004 wrote to memory of 684 2004 FortniteHackModv2.1.exe AppLaunch.exe PID 2004 wrote to memory of 684 2004 FortniteHackModv2.1.exe AppLaunch.exe PID 2004 wrote to memory of 684 2004 FortniteHackModv2.1.exe AppLaunch.exe PID 2004 wrote to memory of 684 2004 FortniteHackModv2.1.exe AppLaunch.exe PID 2004 wrote to memory of 684 2004 FortniteHackModv2.1.exe AppLaunch.exe PID 2004 wrote to memory of 684 2004 FortniteHackModv2.1.exe AppLaunch.exe PID 2004 wrote to memory of 684 2004 FortniteHackModv2.1.exe AppLaunch.exe PID 2004 wrote to memory of 684 2004 FortniteHackModv2.1.exe AppLaunch.exe PID 2004 wrote to memory of 1680 2004 FortniteHackModv2.1.exe WerFault.exe PID 2004 wrote to memory of 1680 2004 FortniteHackModv2.1.exe WerFault.exe PID 2004 wrote to memory of 1680 2004 FortniteHackModv2.1.exe WerFault.exe PID 2004 wrote to memory of 1680 2004 FortniteHackModv2.1.exe WerFault.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\FortniteHackModv2.1.exe"C:\Users\Admin\AppData\Local\Temp\FortniteHackModv2.1.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\AppLaunch.exe"2⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2004 -s 362⤵
- Program crash
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/684-54-0x0000000000400000-0x00000000004A3000-memory.dmpFilesize
652KB
-
memory/684-55-0x0000000000400000-0x00000000004A3000-memory.dmpFilesize
652KB
-
memory/684-61-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmpFilesize
4KB
-
memory/684-63-0x0000000000400000-0x00000000004A3000-memory.dmpFilesize
652KB
-
memory/684-64-0x0000000000400000-0x00000000004A3000-memory.dmpFilesize
652KB