Analysis
-
max time kernel
180s -
max time network
197s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
05-05-2023 20:42
Static task
static1
Behavioral task
behavioral1
Sample
FortniteHackModv2.1.exe
Resource
win7-20230220-en
windows7-x64
5 signatures
150 seconds
Behavioral task
behavioral2
Sample
FortniteHackModv2.1.exe
Resource
win10v2004-20230220-en
windows10-2004-x64
5 signatures
150 seconds
General
-
Target
FortniteHackModv2.1.exe
-
Size
739KB
-
MD5
b6d03b0ec3c9d7ffb57a45b36924612a
-
SHA1
6b9d534a757642b733bdd85f33160a9bdcd96ea2
-
SHA256
47e8958d7ae26467cb5b9e1d6e0b206139d18f5a7ccfb834286be5aa76c8a3ee
-
SHA512
0172d13376632a506601ba2a7729acfd9d57808e625921f9e4c2b39654472aa8469b04cb7d56dba60efbc09750577d2cfb545b403fcf06f91ddfaabe413c669c
-
SSDEEP
12288:SF+Sq1UMUOEdKh88XBRDn/IZDtMZGlLBVXBXKYw3tKzeLiIwX939:SF+ScmKyqZ/YZD9VBkdKzb9
Score
10/10
Malware Config
Signatures
-
Panda Stealer payload 2 IoCs
Processes:
resource yara_rule behavioral2/memory/2072-133-0x0000000000400000-0x00000000004A3000-memory.dmp family_pandastealer behavioral2/memory/2072-140-0x0000000000400000-0x00000000004A3000-memory.dmp family_pandastealer -
PandaStealer
Panda Stealer is a fork of CollectorProject Stealer written in C++.
-
Suspicious use of SetThreadContext 1 IoCs
Processes:
FortniteHackModv2.1.exedescription pid process target process PID 4700 set thread context of 2072 4700 FortniteHackModv2.1.exe AppLaunch.exe -
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 1720 4700 WerFault.exe FortniteHackModv2.1.exe -
Suspicious use of WriteProcessMemory 5 IoCs
Processes:
FortniteHackModv2.1.exedescription pid process target process PID 4700 wrote to memory of 2072 4700 FortniteHackModv2.1.exe AppLaunch.exe PID 4700 wrote to memory of 2072 4700 FortniteHackModv2.1.exe AppLaunch.exe PID 4700 wrote to memory of 2072 4700 FortniteHackModv2.1.exe AppLaunch.exe PID 4700 wrote to memory of 2072 4700 FortniteHackModv2.1.exe AppLaunch.exe PID 4700 wrote to memory of 2072 4700 FortniteHackModv2.1.exe AppLaunch.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\FortniteHackModv2.1.exe"C:\Users\Admin\AppData\Local\Temp\FortniteHackModv2.1.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\AppLaunch.exe"2⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4700 -s 1362⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 4700 -ip 47001⤵