Analysis

  • max time kernel
    150s
  • max time network
    149s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230703-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
  • submitted
    18-07-2023 17:59

General

  • Target

    Fortnite‮nls.scr

  • Size

    149KB

  • MD5

    141bf998683fbd8da1dd106562844695

  • SHA1

    37e11fe2d414045d3c315029eaa26da4793530e2

  • SHA256

    ca488f8b7b1918330e11260aff4fc2b353413f10b7390bb6f8d5437f4d5bf2d2

  • SHA512

    66269b42a3b1eae9c963a0d97df1759fa29576ac3be8cb4b82c78b5e1eb255cfa69070afd58aeb72f07c80a62acf83fd85b94f1fd9fa5f3e6b76d8e03fd9f110

  • SSDEEP

    768:sQ51nPEgDGJ61ktbP13fGrfX+9wqmE/q5/Vj/iF//hKGk4HU3rgJNIIaKTvqXF0x:bDnV261C6X4NmoFEgJycuoGs

Malware Config

Extracted

Family

stealerium

C2

https://discord.com/api/webhooks/1130093797292900402/tYB3leEFtzF4RkxtyISBBD8JoyElTZ84y-J-gnLkl0c03Bo__qhxshnX3-NkcqxMwsJv

Extracted

Family

njrat

Version

0.7d

Botnet

ffg

C2

runtimebroker.ddns.net:8080

Mutex

9cd48799f48622358d39e92cf2b76213

Attributes
  • reg_key

    9cd48799f48622358d39e92cf2b76213

  • splitter

    Y262SUCZ4UJJ

Signatures

  • Stealerium

    An open source info stealer written in C# first seen in May 2022.

  • njRAT/Bladabindi

    Widely used RAT written in .NET.

  • Downloads MZ/PE file
  • Modifies Windows Firewall 1 TTPs 1 IoCs
  • Checks computer location settings 2 TTPs 3 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file 2 IoCs
  • Executes dropped EXE 3 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs
  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Delays execution with timeout.exe 1 IoCs
  • Kills process with taskkill 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 31 IoCs
  • Suspicious use of AdjustPrivilegeToken 36 IoCs
  • Suspicious use of WriteProcessMemory 47 IoCs
  • outlook_office_path 1 IoCs
  • outlook_win_path 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Fortnite‮nls.scr
    "C:\Users\Admin\AppData\Local\Temp\Fortnite‮nls.scr" /S
    1⤵
    • Checks computer location settings
    • Suspicious use of WriteProcessMemory
    PID:3676
    • C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /C ImGui\FortniterCS.vcxproj
      2⤵
        PID:2880
      • C:\Users\Admin\PerfWatson.exe
        "C:\Users\Admin\PerfWatson.exe"
        2⤵
        • Checks computer location settings
        • Executes dropped EXE
        • Accesses Microsoft Outlook profiles
        • Checks processor information in registry
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        • outlook_office_path
        • outlook_win_path
        PID:1300
        • C:\Windows\SysWOW64\cmd.exe
          "cmd.exe" /C chcp 65001 && netsh wlan show profile | findstr All
          3⤵
          • Suspicious use of WriteProcessMemory
          PID:1076
          • C:\Windows\SysWOW64\chcp.com
            chcp 65001
            4⤵
              PID:2396
            • C:\Windows\SysWOW64\netsh.exe
              netsh wlan show profile
              4⤵
                PID:3748
              • C:\Windows\SysWOW64\findstr.exe
                findstr All
                4⤵
                  PID:1072
              • C:\Windows\SysWOW64\cmd.exe
                "cmd.exe" /C chcp 65001 && netsh wlan show networks mode=bssid
                3⤵
                • Suspicious use of WriteProcessMemory
                PID:3980
                • C:\Windows\SysWOW64\chcp.com
                  chcp 65001
                  4⤵
                    PID:3804
                  • C:\Windows\SysWOW64\netsh.exe
                    netsh wlan show networks mode=bssid
                    4⤵
                      PID:1056
                  • C:\Windows\SysWOW64\cmd.exe
                    "C:\Windows\System32\cmd.exe" /C C:\Users\Admin\AppData\Local\Temp\tmp66.tmp.bat
                    3⤵
                    • Suspicious use of WriteProcessMemory
                    PID:1416
                    • C:\Windows\SysWOW64\chcp.com
                      chcp 65001
                      4⤵
                        PID:1592
                      • C:\Windows\SysWOW64\taskkill.exe
                        TaskKill /F /IM 1300
                        4⤵
                        • Kills process with taskkill
                        • Suspicious use of AdjustPrivilegeToken
                        PID:2200
                      • C:\Windows\SysWOW64\timeout.exe
                        Timeout /T 2 /Nobreak
                        4⤵
                        • Delays execution with timeout.exe
                        PID:1324
                  • C:\Users\Admin\PerfWatson (2).exe
                    "C:\Users\Admin\PerfWatson (2).exe"
                    2⤵
                    • Checks computer location settings
                    • Executes dropped EXE
                    • Suspicious use of WriteProcessMemory
                    PID:3952
                    • C:\Users\Admin\NtUserRuntime.exe
                      "C:\Users\Admin\NtUserRuntime.exe"
                      3⤵
                      • Drops startup file
                      • Executes dropped EXE
                      • Adds Run key to start application
                      • Suspicious use of AdjustPrivilegeToken
                      • Suspicious use of WriteProcessMemory
                      PID:3516
                      • C:\Windows\SysWOW64\netsh.exe
                        netsh firewall add allowedprogram "C:\Users\Admin\NtUserRuntime.exe" "NtUserRuntime.exe" ENABLE
                        4⤵
                        • Modifies Windows Firewall
                        PID:5004
                • C:\Windows\system32\msiexec.exe
                  C:\Windows\system32\msiexec.exe /V
                  1⤵
                  • Suspicious use of AdjustPrivilegeToken
                  PID:1928

                Network

                MITRE ATT&CK Enterprise v6

                Replay Monitor

                Loading Replay Monitor...

                Downloads

                • C:\Users\Admin\AppData\Local\Temp\tmp66.tmp.bat

                  Filesize

                  57B

                  MD5

                  07987ffa17211c48e18bc6ebae327e2e

                  SHA1

                  a199769974ead549eda9dfe389a1f5ce1cdde765

                  SHA256

                  74e5944571c40686d82be0eb99b9add1ca48cde0dc42c651dd92c055e41418b0

                  SHA512

                  ccdb98422bf4471f851e82ae142ab6869b2f045db3342eb204c6db61ee5278352d125251c8e5364e978c9adb19c162e18a109f84225cdd1bd1f813eafb42130f

                • C:\Users\Admin\AppData\Local\e04c609c5fb995a9b2ae374f111ac5ed\Admin@HISXQJCD_en-US\Browsers\Firefox\Bookmarks.txt

                  Filesize

                  105B

                  MD5

                  2e9d094dda5cdc3ce6519f75943a4ff4

                  SHA1

                  5d989b4ac8b699781681fe75ed9ef98191a5096c

                  SHA256

                  c84c98bbf5e0ef9c8d0708b5d60c5bb656b7d6be5135d7f7a8d25557e08cf142

                  SHA512

                  d1f7eed00959e902bdb2125b91721460d3ff99f3bdfc1f2a343d4f58e8d4e5e5a06c0c6cdc0379211c94510f7c00d7a8b34fa7d0ca0c3d54cbbe878f1e9812b7

                • C:\Users\Admin\AppData\Local\e04c609c5fb995a9b2ae374f111ac5ed\Admin@HISXQJCD_en-US\Directories\OneDrive.txt

                  Filesize

                  25B

                  MD5

                  966247eb3ee749e21597d73c4176bd52

                  SHA1

                  1e9e63c2872cef8f015d4b888eb9f81b00a35c79

                  SHA256

                  8ddfc481b1b6ae30815ecce8a73755862f24b3bb7fdebdbf099e037d53eb082e

                  SHA512

                  bd30aec68c070e86e3dec787ed26dd3d6b7d33d83e43cb2d50f9e2cff779fee4c96afbbe170443bd62874073a844beb29a69b10c72c54d7d444a8d86cfd7b5aa

                • C:\Users\Admin\AppData\Local\e04c609c5fb995a9b2ae374f111ac5ed\Admin@HISXQJCD_en-US\Directories\Startup.txt

                  Filesize

                  24B

                  MD5

                  68c93da4981d591704cea7b71cebfb97

                  SHA1

                  fd0f8d97463cd33892cc828b4ad04e03fc014fa6

                  SHA256

                  889ed51f9c16a4b989bda57957d3e132b1a9c117ee84e208207f2fa208a59483

                  SHA512

                  63455c726b55f2d4de87147a75ff04f2daa35278183969ccf185d23707840dd84363bec20d4e8c56252196ce555001ca0e61b3f4887d27577081fdef9e946402

                • C:\Users\Admin\AppData\Local\e04c609c5fb995a9b2ae374f111ac5ed\Admin@HISXQJCD_en-US\Directories\Videos.txt

                  Filesize

                  23B

                  MD5

                  1fddbf1169b6c75898b86e7e24bc7c1f

                  SHA1

                  d2091060cb5191ff70eb99c0088c182e80c20f8c

                  SHA256

                  a67aa329b7d878de61671e18cd2f4b011d11cbac67ea779818c6dafad2d70733

                  SHA512

                  20bfeafde7fec1753fef59de467bd4a3dd7fe627e8c44e95fe62b065a5768c4508e886ec5d898e911a28cf6365f455c9ab1ebe2386d17a76f53037f99061fd4d

                • C:\Users\Admin\AppData\Local\e04c609c5fb995a9b2ae374f111ac5ed\Admin@HISXQJCD_en-US\System\Apps.txt

                  Filesize

                  4KB

                  MD5

                  62ee0b1f7549e906822d2248d68d7638

                  SHA1

                  ad68d9cf72770e50eff6bc648dba15a8baa509cf

                  SHA256

                  0226948b660e2dd6e3f3488f7fa67d9dac5f55277bad2ca2a2c1e7791e010cce

                  SHA512

                  5722804de47c5cc4e1f43312bcd3677550821c83c376a6540a37db1f473dafb50fdc6164230d380985b553f7c59c9aff0e1f21c67803b4d5eb53108779035146

                • C:\Users\Admin\AppData\Local\e04c609c5fb995a9b2ae374f111ac5ed\Admin@HISXQJCD_en-US\System\Process.txt

                  Filesize

                  4KB

                  MD5

                  b62532261dae8f92b2406d4e70b4365e

                  SHA1

                  e0c55242a64fa3651be580d074f3c1ed5530abed

                  SHA256

                  340a5a2f976b2435ac4582a03886cc7570d4c2201d2d743515527fef314ea977

                  SHA512

                  5b0f338581ae38cd34395caed4edcf371f350596f9b7b282fcb69b5ed6641509fc7d73da90949fe30e3e53b235629e217b0006ae791d4bce80b13c9c4c4e5ea6

                • C:\Users\Admin\AppData\Local\e04c609c5fb995a9b2ae374f111ac5ed\Admin@HISXQJCD_en-US\System\ProductKey.txt

                  Filesize

                  29B

                  MD5

                  71eb5479298c7afc6d126fa04d2a9bde

                  SHA1

                  a9b3d5505cf9f84bb6c2be2acece53cb40075113

                  SHA256

                  f6cadfd4e4c25ff3b8cffe54a2af24a757a349abbf4e1142ec4c9789347fe8b3

                  SHA512

                  7c6687e21d31ec1d6d2eff04b07b465f875fd80df26677f1506b14158444cf55044eb6674880bd5bd44f04ff73023b26cb19b8837427a1d6655c96df52f140bd

                • C:\Users\Admin\AppData\Local\e04c609c5fb995a9b2ae374f111ac5ed\msgid.dat

                  Filesize

                  19B

                  MD5

                  75d026ff91f2db5bdb485ecc1b4ba46d

                  SHA1

                  f1e9c9569bd089482480836aef8bb255669ead13

                  SHA256

                  be248d7a8d894a36a9f0adcb9936c6c1d300cc77f57835cb0d0694be3852406a

                  SHA512

                  b029b12580e9515d030b62df08365e802a9ef5aa2e30177176387ebb6d361d2b3147f8441e46b84e31a59a85b5d3f604e6c29c578fe0d7c8ed989c81f70b2403

                • C:\Users\Admin\NtUserRuntime.exe

                  Filesize

                  31KB

                  MD5

                  ffedb9454cd970240628f9a65ba440e1

                  SHA1

                  90e7557bac4789101f7d53a7823623714f16e740

                  SHA256

                  3801c296dab5e58d5609634c40648b2cd7927d106b08966450629ee261e46ca4

                  SHA512

                  9ab7fa0fb2161eea6e23ee8dd3289c50c5dea00edd7122ca3e081a6c3b195b71ce2853dd8182481aeeb1f9b0dbe7355b5fdf97684ba6eff9933f4f516fb53c41

                • C:\Users\Admin\NtUserRuntime.exe

                  Filesize

                  31KB

                  MD5

                  ffedb9454cd970240628f9a65ba440e1

                  SHA1

                  90e7557bac4789101f7d53a7823623714f16e740

                  SHA256

                  3801c296dab5e58d5609634c40648b2cd7927d106b08966450629ee261e46ca4

                  SHA512

                  9ab7fa0fb2161eea6e23ee8dd3289c50c5dea00edd7122ca3e081a6c3b195b71ce2853dd8182481aeeb1f9b0dbe7355b5fdf97684ba6eff9933f4f516fb53c41

                • C:\Users\Admin\PerfWatson (2).exe

                  Filesize

                  31KB

                  MD5

                  ffedb9454cd970240628f9a65ba440e1

                  SHA1

                  90e7557bac4789101f7d53a7823623714f16e740

                  SHA256

                  3801c296dab5e58d5609634c40648b2cd7927d106b08966450629ee261e46ca4

                  SHA512

                  9ab7fa0fb2161eea6e23ee8dd3289c50c5dea00edd7122ca3e081a6c3b195b71ce2853dd8182481aeeb1f9b0dbe7355b5fdf97684ba6eff9933f4f516fb53c41

                • C:\Users\Admin\PerfWatson (2).exe

                  Filesize

                  31KB

                  MD5

                  ffedb9454cd970240628f9a65ba440e1

                  SHA1

                  90e7557bac4789101f7d53a7823623714f16e740

                  SHA256

                  3801c296dab5e58d5609634c40648b2cd7927d106b08966450629ee261e46ca4

                  SHA512

                  9ab7fa0fb2161eea6e23ee8dd3289c50c5dea00edd7122ca3e081a6c3b195b71ce2853dd8182481aeeb1f9b0dbe7355b5fdf97684ba6eff9933f4f516fb53c41

                • C:\Users\Admin\PerfWatson (2).exe

                  Filesize

                  31KB

                  MD5

                  ffedb9454cd970240628f9a65ba440e1

                  SHA1

                  90e7557bac4789101f7d53a7823623714f16e740

                  SHA256

                  3801c296dab5e58d5609634c40648b2cd7927d106b08966450629ee261e46ca4

                  SHA512

                  9ab7fa0fb2161eea6e23ee8dd3289c50c5dea00edd7122ca3e081a6c3b195b71ce2853dd8182481aeeb1f9b0dbe7355b5fdf97684ba6eff9933f4f516fb53c41

                • C:\Users\Admin\PerfWatson.exe

                  Filesize

                  2.9MB

                  MD5

                  1d1da22273bc54c1e9d1c5f94b79655d

                  SHA1

                  91ecd916e9f178468a73bdf7b1dbc79fc6eba929

                  SHA256

                  67dd4aaad52ce3f19f177ab41004a583dc082c1b068408a53c0533540e687833

                  SHA512

                  28d01ce3b1ae0eb3da11191604e890b5f5008305778d5957bc5a2c70425c4d874f5c4db6ede34c99926bf52695de33a8e4e2afa12545982fd15a3e7afed8b524

                • C:\Users\Admin\PerfWatson.exe

                  Filesize

                  2.9MB

                  MD5

                  1d1da22273bc54c1e9d1c5f94b79655d

                  SHA1

                  91ecd916e9f178468a73bdf7b1dbc79fc6eba929

                  SHA256

                  67dd4aaad52ce3f19f177ab41004a583dc082c1b068408a53c0533540e687833

                  SHA512

                  28d01ce3b1ae0eb3da11191604e890b5f5008305778d5957bc5a2c70425c4d874f5c4db6ede34c99926bf52695de33a8e4e2afa12545982fd15a3e7afed8b524

                • C:\Users\Admin\PerfWatson.exe

                  Filesize

                  2.9MB

                  MD5

                  1d1da22273bc54c1e9d1c5f94b79655d

                  SHA1

                  91ecd916e9f178468a73bdf7b1dbc79fc6eba929

                  SHA256

                  67dd4aaad52ce3f19f177ab41004a583dc082c1b068408a53c0533540e687833

                  SHA512

                  28d01ce3b1ae0eb3da11191604e890b5f5008305778d5957bc5a2c70425c4d874f5c4db6ede34c99926bf52695de33a8e4e2afa12545982fd15a3e7afed8b524

                • memory/1300-259-0x0000000006E20000-0x0000000006EB2000-memory.dmp

                  Filesize

                  584KB

                • memory/1300-193-0x00000000051B0000-0x0000000005216000-memory.dmp

                  Filesize

                  408KB

                • memory/1300-480-0x0000000075290000-0x0000000075A40000-memory.dmp

                  Filesize

                  7.7MB

                • memory/1300-188-0x0000000075290000-0x0000000075A40000-memory.dmp

                  Filesize

                  7.7MB

                • memory/1300-478-0x00000000051A0000-0x00000000051B0000-memory.dmp

                  Filesize

                  64KB

                • memory/1300-274-0x0000000007550000-0x0000000007AF4000-memory.dmp

                  Filesize

                  5.6MB

                • memory/1300-323-0x00000000051A0000-0x00000000051B0000-memory.dmp

                  Filesize

                  64KB

                • memory/1300-211-0x0000000075290000-0x0000000075A40000-memory.dmp

                  Filesize

                  7.7MB

                • memory/1300-196-0x00000000051A0000-0x00000000051B0000-memory.dmp

                  Filesize

                  64KB

                • memory/1300-189-0x00000000004F0000-0x00000000007E0000-memory.dmp

                  Filesize

                  2.9MB

                • memory/1300-469-0x0000000007030000-0x000000000704A000-memory.dmp

                  Filesize

                  104KB

                • memory/1300-468-0x0000000006F00000-0x0000000006F22000-memory.dmp

                  Filesize

                  136KB

                • memory/1300-400-0x00000000051A0000-0x00000000051B0000-memory.dmp

                  Filesize

                  64KB

                • memory/3516-390-0x0000000073760000-0x0000000073D11000-memory.dmp

                  Filesize

                  5.7MB

                • memory/3516-219-0x0000000073760000-0x0000000073D11000-memory.dmp

                  Filesize

                  5.7MB

                • memory/3516-383-0x0000000073760000-0x0000000073D11000-memory.dmp

                  Filesize

                  5.7MB

                • memory/3516-380-0x0000000001420000-0x0000000001430000-memory.dmp

                  Filesize

                  64KB

                • memory/3516-217-0x0000000001420000-0x0000000001430000-memory.dmp

                  Filesize

                  64KB

                • memory/3952-194-0x0000000073760000-0x0000000073D11000-memory.dmp

                  Filesize

                  5.7MB

                • memory/3952-195-0x0000000000DA0000-0x0000000000DB0000-memory.dmp

                  Filesize

                  64KB

                • memory/3952-192-0x0000000073760000-0x0000000073D11000-memory.dmp

                  Filesize

                  5.7MB

                • memory/3952-216-0x0000000073760000-0x0000000073D11000-memory.dmp

                  Filesize

                  5.7MB

                • memory/3952-218-0x0000000073760000-0x0000000073D11000-memory.dmp

                  Filesize

                  5.7MB