Overview
overview
10Static
static
3GalacticFortress.exe
windows7-x64
1GalacticFortress.exe
windows10-2004-x64
10GalacticFo...ss.dll
windows7-x64
1GalacticFo...ss.dll
windows10-2004-x64
3GalacticFo...ed.dll
windows7-x64
1GalacticFo...ed.dll
windows10-2004-x64
1GameAssembly.dll
windows7-x64
3GameAssembly.dll
windows10-2004-x64
3UnityCrash...64.exe
windows7-x64
1UnityCrash...64.exe
windows10-2004-x64
1UnityPlayer.dll
windows7-x64
1UnityPlayer.dll
windows10-2004-x64
1baselib.dll
windows7-x64
3baselib.dll
windows10-2004-x64
3Analysis
-
max time kernel
1590s -
max time network
1735s -
platform
windows7_x64 -
resource
win7-20230220-en -
resource tags
arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system -
submitted
21/05/2023, 00:02
Static task
static1
Behavioral task
behavioral1
Sample
GalacticFortress.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
GalacticFortress.exe
Resource
win10v2004-20230220-en
Behavioral task
behavioral3
Sample
GalacticFortress_Data/Plugins/x86_64/KS_Diagnostics_Process.dll
Resource
win7-20230220-en
Behavioral task
behavioral4
Sample
GalacticFortress_Data/Plugins/x86_64/KS_Diagnostics_Process.dll
Resource
win10v2004-20230220-en
Behavioral task
behavioral5
Sample
GalacticFortress_Data/Plugins/x86_64/lib_burst_generated.dll
Resource
win7-20230220-en
Behavioral task
behavioral6
Sample
GalacticFortress_Data/Plugins/x86_64/lib_burst_generated.dll
Resource
win10v2004-20230220-en
Behavioral task
behavioral7
Sample
GameAssembly.dll
Resource
win7-20230220-en
Behavioral task
behavioral8
Sample
GameAssembly.dll
Resource
win10v2004-20230220-en
Behavioral task
behavioral9
Sample
UnityCrashHandler64.exe
Resource
win7-20230220-en
Behavioral task
behavioral10
Sample
UnityCrashHandler64.exe
Resource
win10v2004-20230220-en
Behavioral task
behavioral11
Sample
UnityPlayer.dll
Resource
win7-20230220-en
Behavioral task
behavioral12
Sample
UnityPlayer.dll
Resource
win10v2004-20230221-en
Behavioral task
behavioral13
Sample
baselib.dll
Resource
win7-20230220-en
Behavioral task
behavioral14
Sample
baselib.dll
Resource
win10v2004-20230220-en
General
-
Target
GalacticFortress.exe
-
Size
651KB
-
MD5
b746ec336a45656a92d61da9c3816b05
-
SHA1
28f48c6dcccedd34f4b7dca393a0aba446f0d3f4
-
SHA256
4c48c5a35cf17c0fb3c05864681f7ed59728b7a51cd87940e92136e99ef4ac13
-
SHA512
a33b11f03ab250096f427824b3c5bfe0a384dfd1aca7f25b487d90a3b189879b3d08133d5007c2f30a1394fc2695bae591f38de0905ae96e6ef16141ae183b72
-
SSDEEP
3072:JQJ/VdFgIW9mYucJ/OD8JlsI90TIC7G2E1:a/7FG9mpcJ/OD8h/
Malware Config
Signatures
-
Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: 33 1404 AUDIODG.EXE Token: SeIncBasePriorityPrivilege 1404 AUDIODG.EXE Token: 33 1404 AUDIODG.EXE Token: SeIncBasePriorityPrivilege 1404 AUDIODG.EXE -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 1036 GalacticFortress.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 1036 wrote to memory of 2036 1036 GalacticFortress.exe 27 PID 1036 wrote to memory of 2036 1036 GalacticFortress.exe 27 PID 1036 wrote to memory of 2036 1036 GalacticFortress.exe 27
Processes
-
C:\Users\Admin\AppData\Local\Temp\GalacticFortress.exe"C:\Users\Admin\AppData\Local\Temp\GalacticFortress.exe"1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1036 -
C:\Users\Admin\AppData\Local\Temp\UnityCrashHandler64.exe"C:\Users\Admin\AppData\Local\Temp\UnityCrashHandler64.exe" --attach 1036 15769602⤵PID:2036
-
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x57c1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1404