Analysis
-
max time kernel
117s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20230831-en -
resource tags
arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system -
submitted
05/10/2023, 23:29
Behavioral task
behavioral1
Sample
Azure-Client-FORTNITE.exe
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
Azure-Client-FORTNITE.exe
Resource
win10v2004-20230915-en
General
-
Target
Azure-Client-FORTNITE.exe
-
Size
17.6MB
-
MD5
5c39dc792115caba14a9c47471e1e916
-
SHA1
45bbab0387fc26f082e78c68bee3955dab73efa5
-
SHA256
dbacb20940f7c8a3d2ca6af2095f935f8201eb0e6d5acca07bbcc9a82508c982
-
SHA512
fed3f6b29e2836eacf52605d9fd633d5a788886b552a54a7c1f60ae9193a396e29f7409951e29bbd21c4b305d5f07036368bfd6e187c95db63b116b24ac559de
-
SSDEEP
393216:oqPnLFXlrPjgQpDOETgsvfGbg/U0sbvEo0nCZLDk:ZPLFXNP8QoEmaU0xDm
Malware Config
Signatures
-
Loads dropped DLL 1 IoCs
pid Process 2488 Azure-Client-FORTNITE.exe -
resource yara_rule behavioral1/files/0x00050000000195d4-111.dat upx behavioral1/files/0x00050000000195d4-112.dat upx behavioral1/memory/2488-113-0x000007FEF6340000-0x000007FEF67AE000-memory.dmp upx -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 2452 wrote to memory of 2488 2452 Azure-Client-FORTNITE.exe 28 PID 2452 wrote to memory of 2488 2452 Azure-Client-FORTNITE.exe 28 PID 2452 wrote to memory of 2488 2452 Azure-Client-FORTNITE.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\Azure-Client-FORTNITE.exe"C:\Users\Admin\AppData\Local\Temp\Azure-Client-FORTNITE.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2452 -
C:\Users\Admin\AppData\Local\Temp\Azure-Client-FORTNITE.exe"C:\Users\Admin\AppData\Local\Temp\Azure-Client-FORTNITE.exe"2⤵
- Loads dropped DLL
PID:2488
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.4MB
MD569d4f13fbaeee9b551c2d9a4a94d4458
SHA169540d8dfc0ee299a7ff6585018c7db0662aa629
SHA256801317463bd116e603878c7c106093ba7db2bece11e691793e93065223fc7046
SHA5128e632f141daf44bc470f8ee677c6f0fdcbcacbfce1472d928576bf7b9f91d6b76639d18e386d5e1c97e538a8fe19dd2d22ea47ae1acf138a0925e3c6dd156378
-
Filesize
1.4MB
MD569d4f13fbaeee9b551c2d9a4a94d4458
SHA169540d8dfc0ee299a7ff6585018c7db0662aa629
SHA256801317463bd116e603878c7c106093ba7db2bece11e691793e93065223fc7046
SHA5128e632f141daf44bc470f8ee677c6f0fdcbcacbfce1472d928576bf7b9f91d6b76639d18e386d5e1c97e538a8fe19dd2d22ea47ae1acf138a0925e3c6dd156378