Overview
overview
10Static
static
3GalacticFortress.exe
windows7-x64
1GalacticFortress.exe
windows10-2004-x64
10GalacticFo...ss.dll
windows7-x64
1GalacticFo...ss.dll
windows10-2004-x64
3GalacticFo...ed.dll
windows7-x64
1GalacticFo...ed.dll
windows10-2004-x64
1GameAssembly.dll
windows7-x64
3GameAssembly.dll
windows10-2004-x64
3UnityCrash...64.exe
windows7-x64
1UnityCrash...64.exe
windows10-2004-x64
1UnityPlayer.dll
windows7-x64
1UnityPlayer.dll
windows10-2004-x64
1baselib.dll
windows7-x64
3baselib.dll
windows10-2004-x64
3Analysis
-
max time kernel
1553s -
max time network
1590s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
21/05/2023, 00:02
Static task
static1
Behavioral task
behavioral1
Sample
GalacticFortress.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
GalacticFortress.exe
Resource
win10v2004-20230220-en
Behavioral task
behavioral3
Sample
GalacticFortress_Data/Plugins/x86_64/KS_Diagnostics_Process.dll
Resource
win7-20230220-en
Behavioral task
behavioral4
Sample
GalacticFortress_Data/Plugins/x86_64/KS_Diagnostics_Process.dll
Resource
win10v2004-20230220-en
Behavioral task
behavioral5
Sample
GalacticFortress_Data/Plugins/x86_64/lib_burst_generated.dll
Resource
win7-20230220-en
Behavioral task
behavioral6
Sample
GalacticFortress_Data/Plugins/x86_64/lib_burst_generated.dll
Resource
win10v2004-20230220-en
Behavioral task
behavioral7
Sample
GameAssembly.dll
Resource
win7-20230220-en
Behavioral task
behavioral8
Sample
GameAssembly.dll
Resource
win10v2004-20230220-en
Behavioral task
behavioral9
Sample
UnityCrashHandler64.exe
Resource
win7-20230220-en
Behavioral task
behavioral10
Sample
UnityCrashHandler64.exe
Resource
win10v2004-20230220-en
Behavioral task
behavioral11
Sample
UnityPlayer.dll
Resource
win7-20230220-en
Behavioral task
behavioral12
Sample
UnityPlayer.dll
Resource
win10v2004-20230221-en
Behavioral task
behavioral13
Sample
baselib.dll
Resource
win7-20230220-en
Behavioral task
behavioral14
Sample
baselib.dll
Resource
win10v2004-20230220-en
General
-
Target
GalacticFortress_Data/Plugins/x86_64/KS_Diagnostics_Process.dll
-
Size
4.9MB
-
MD5
9ffd4b950fef075cdc7059c0c7a7c202
-
SHA1
b043a1d763b6fd943bd5ffd3526566105b34c9f9
-
SHA256
7f3a6750ad394103070c8370b4b3b96ff93dc7a2a7da543f60b3029f6a73fa8a
-
SHA512
a2dcbb96007c4e176da08ad92b5b14713abdcbc6007bb856297b6d926e16de1d81fc05b3f6a3d0749c07d7a3ad8f57ee011d3baa0b10e05f001de5d4d92356a5
-
SSDEEP
49152:ZIW2dGyJkJUkjvR3SGa2MV/b2ecedRIRPCW3+fJI6F38984JFynbdyO+BvjP:7O0iMMVHdRIRPCSghnbdyO+xP
Malware Config
Signatures
-
Program crash 1 IoCs
pid pid_target Process procid_target 2008 4124 WerFault.exe 81
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\GalacticFortress_Data\Plugins\x86_64\KS_Diagnostics_Process.dll,#11⤵PID:4124
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 4124 -s 4362⤵
- Program crash
PID:2008
-
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -pss -s 476 -p 4124 -ip 41241⤵PID:1948