Behavioral task
behavioral1
Sample
fortnite3.exe
Resource
win7-20230621-en
Behavioral task
behavioral2
Sample
fortnite3.exe
Resource
win10v2004-20230621-en
General
-
Target
fortnite3.exe
-
Size
123KB
-
MD5
ed0a563d3d57d03356187c1a2fbcce3f
-
SHA1
29b80e1cd5dcb6e134985ad547afe03fa9f5f9d5
-
SHA256
ed78295a1b60b7053383c7f2a4837c62cb5625d7d57b5f4121df45660a000c65
-
SHA512
d3670a61771d918a65c9ca6e5d46a6aa01872eadb71bd0afe681476bbf5b53ecfa25488facd1ab0ce46a8240958ad073c9dddf914678f3c6743178719f167b67
-
SSDEEP
3072:kBHLe0crYUAc3W3RBjJ9wUZBva7oRrADruYQLeT8YGjjsxf:k1vcruc3WBBEUy7oL3jjwf
Malware Config
Extracted
allcome
http://dba692117be7b6d3480fe5220fdd58b38bf.xyz/API/2/configure.php?cf6zrlhn=Fate1337
DKqTfjWcxULLMPhvUyKdtReRtNEZ4HSAgD
r3bB4NXmog8ozTuJpPBjYpPMH6XKa9QTY5
0x379844563B2947bCf8Ee7660d674E91704ba85cc
Xbd8YLpgw4ozYe6B8t4KF7oFmEgFCaeR2F
TVkpWWHjd2ddXYVGw8E7YsowfbYaCizwrY
t1SH4jS9wURQMDhEvyAAQSfYDC8hEawBdrK
GCCFDFVYXWTUSB3JIA6NBJNVYTMBD2MYTNVHF3G7QMQXY3PYSXMYGNKF
45vYBVpWhcrBu98FM2dXZUbXBhywVsck6Vba7PKY86ms6QJ185FFWuhR41cCyr8pfJbNNS5EbDPVkaJPByxUHuFxCsL9iBu
qqxm73rvrlh7zxhhlkalwadsqgte9d7lfc072hn2ra
12CmRkqqDVeA1sd5um6eKosttoPPZktLnm
0x675585AcFb13A721f00Da26cB61d31210C6eE932
LfWNvpj1q8ULhaEN4MhSQRhKQqfwUvXjPV
ronin:d9b303aA47179A673FED60dD34559dAF133BC149
79241794097
+79889916188
+79889916188
https://steamcommunity.com/tradeoffer/new/?partner=896820235&token=FIQwFTT8
LP1oSHdQ3kdgrWnPvB5XtuBLZaMq9JMoWt
ltc1qpdwhnnvrankvmksa98dpswkfe825yfd8690jfe
bc1qngt9pchlwak6rzc37ez05sfhzr8dnyupu7e769
bc1q78nvv8g9f53hhyzhjr0h4khmxajdsxmwj3kc4a
47vKd6j46WL9N9KrbisKDXd5Yd8KhSbcgHpY1MXTv97qW6QPTQk71m2ZLFY7N7DXojZqbuxDnHT9bKaYfVNzcipn5LxY4aw
Signatures
-
Allcome family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
Processes:
resource fortnite3.exe
Files
-
fortnite3.exe.exe windows x86
ed5e7a68bd9d3fcbe4fc8ca66473351b
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GlobalAlloc
GlobalLock
GlobalUnlock
CopyFileA
SetFileAttributesA
CreateDirectoryA
Process32First
CreateMutexA
WaitForSingleObject
CreateToolhelp32Snapshot
Process32Next
CloseHandle
GetModuleFileNameA
MultiByteToWideChar
CreateFileW
DecodePointer
GetConsoleMode
GetConsoleOutputCP
FlushFileBuffers
HeapReAlloc
HeapSize
SetFilePointerEx
GetProcessHeap
GetStringTypeW
SetStdHandle
FreeEnvironmentStringsW
GetEnvironmentStringsW
WideCharToMultiByte
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
GetStartupInfoW
GetModuleHandleW
QueryPerformanceFrequency
WaitForSingleObjectEx
Sleep
GetExitCodeThread
InitializeCriticalSectionEx
GetProcAddress
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
RtlUnwind
RaiseException
GetLastError
SetLastError
EncodePointer
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
FreeLibrary
LoadLibraryExW
ExitProcess
GetModuleHandleExW
CreateThread
ExitThread
FreeLibraryAndExitThread
GetStdHandle
WriteFile
GetModuleFileNameW
HeapFree
HeapAlloc
GetFileType
LCMapStringW
FindClose
FindFirstFileExW
FindNextFileW
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
GetCommandLineA
GetCommandLineW
WriteConsoleW
user32
OpenClipboard
GetClipboardData
SetClipboardData
CloseClipboard
EmptyClipboard
GetKeyState
LoadStringA
shell32
ShellExecuteA
SHGetSpecialFolderPathA
urlmon
IsValidURL
wininet
InternetCloseHandle
InternetOpenUrlA
InternetOpenA
InternetReadFile
Sections
.text Size: 76KB - Virtual size: 76KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 34KB - Virtual size: 34KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 3KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 3KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 5KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ