Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Overview
overview
10Static
static
3GalacticFortress.exe
windows7-x64
1GalacticFortress.exe
windows10-2004-x64
10GalacticFo...ss.dll
windows7-x64
1GalacticFo...ss.dll
windows10-2004-x64
3GalacticFo...ed.dll
windows7-x64
1GalacticFo...ed.dll
windows10-2004-x64
1GameAssembly.dll
windows7-x64
3GameAssembly.dll
windows10-2004-x64
3UnityCrash...64.exe
windows7-x64
1UnityCrash...64.exe
windows10-2004-x64
1UnityPlayer.dll
windows7-x64
1UnityPlayer.dll
windows10-2004-x64
1baselib.dll
windows7-x64
3baselib.dll
windows10-2004-x64
3Analysis
-
max time kernel
1640s -
max time network
1588s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
21/05/2023, 00:02
Static task
static1
Behavioral task
behavioral1
Sample
GalacticFortress.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
GalacticFortress.exe
Resource
win10v2004-20230220-en
Behavioral task
behavioral3
Sample
GalacticFortress_Data/Plugins/x86_64/KS_Diagnostics_Process.dll
Resource
win7-20230220-en
Behavioral task
behavioral4
Sample
GalacticFortress_Data/Plugins/x86_64/KS_Diagnostics_Process.dll
Resource
win10v2004-20230220-en
Behavioral task
behavioral5
Sample
GalacticFortress_Data/Plugins/x86_64/lib_burst_generated.dll
Resource
win7-20230220-en
Behavioral task
behavioral6
Sample
GalacticFortress_Data/Plugins/x86_64/lib_burst_generated.dll
Resource
win10v2004-20230220-en
Behavioral task
behavioral7
Sample
GameAssembly.dll
Resource
win7-20230220-en
Behavioral task
behavioral8
Sample
GameAssembly.dll
Resource
win10v2004-20230220-en
Behavioral task
behavioral9
Sample
UnityCrashHandler64.exe
Resource
win7-20230220-en
Behavioral task
behavioral10
Sample
UnityCrashHandler64.exe
Resource
win10v2004-20230220-en
Behavioral task
behavioral11
Sample
UnityPlayer.dll
Resource
win7-20230220-en
Behavioral task
behavioral12
Sample
UnityPlayer.dll
Resource
win10v2004-20230221-en
Behavioral task
behavioral13
Sample
baselib.dll
Resource
win7-20230220-en
Behavioral task
behavioral14
Sample
baselib.dll
Resource
win10v2004-20230220-en
General
-
Target
GameAssembly.dll
-
Size
17.0MB
-
MD5
fec3d91ab202e5e2329f5b2aaa154b39
-
SHA1
0253616e175325a0797dbe7b49395bc67f74abd9
-
SHA256
a539b80bd85c3a48da5f9893056079bc98dbba57f1948785429056d0fd9b64c0
-
SHA512
ea90811b1e67e7f413d35b1785387679edd73ca1173c622f3ed7b546d408efd69306f86c079013facbe4a21ae8d9f1f987ac59fa33d2979c843f19ff8e181e28
-
SSDEEP
196608:7pb9EOzN6Kfe1gIWtIeQzGtfRPqocIC6pO4nWNVGnbfG8d4zD:7FzN6Kfe1gIwIRGxRPqocIJTngVGqV
Malware Config
Signatures
-
Program crash 1 IoCs
pid pid_target Process procid_target 2972 488 WerFault.exe 84
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\GameAssembly.dll,#11⤵PID:488
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 488 -s 5322⤵
- Program crash
PID:2972
-
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -pss -s 420 -p 488 -ip 4881⤵PID:3572