Overview
overview
10Static
static
1fortnitepy...er.zip
windows10-1703-x64
1fortnitepy...ignore
windows10-1703-x64
3fortnitepy...ES.bat
windows10-1703-x64
10fortnitepy...ICENSE
windows10-1703-x64
1fortnitepy...DME.md
windows10-1703-x64
3fortnitepy...OT.bat
windows10-1703-x64
10fortnitepy...g.json
windows10-1703-x64
3fortnitepy...s.json
windows10-1703-x64
3fortnitepy...ite.py
windows10-1703-x64
3fortnitepy...t__.py
windows10-1703-x64
3fortnitepy...bot.py
windows10-1703-x64
3fortnitepy...ent.py
windows10-1703-x64
3fortnitepy...tic.py
windows10-1703-x64
3fortnitepy...ths.py
windows10-1703-x64
3fortnitepy...ors.py
windows10-1703-x64
3fortnitepy...tor.py
windows10-1703-x64
3fortnitepy...per.py
windows10-1703-x64
3fortnitepy...rty.py
windows10-1703-x64
3fortnitepy...ngs.py
windows10-1703-x64
3fortnitepy...ts.txt
windows10-1703-x64
1Analysis
-
max time kernel
134s -
max time network
136s -
platform
windows10-1703_x64 -
resource
win10-20240221-en -
resource tags
arch:x64arch:x86image:win10-20240221-enlocale:en-usos:windows10-1703-x64system -
submitted
21-02-2024 14:58
Static task
static1
Behavioral task
behavioral1
Sample
fortnitepy-bot-master.zip
Resource
win10-20240221-en
Behavioral task
behavioral2
Sample
fortnitepy-bot-master/.gitignore
Resource
win10-20240221-en
Behavioral task
behavioral3
Sample
fortnitepy-bot-master/INSTALL PACKAGES.bat
Resource
win10-20240221-en
Behavioral task
behavioral4
Sample
fortnitepy-bot-master/LICENSE
Resource
win10-20240221-en
Behavioral task
behavioral5
Sample
fortnitepy-bot-master/README.md
Resource
win10-20240221-en
Behavioral task
behavioral6
Sample
fortnitepy-bot-master/START BOT.bat
Resource
win10-20240221-en
Behavioral task
behavioral7
Sample
fortnitepy-bot-master/config.json
Resource
win10-20240221-en
Behavioral task
behavioral8
Sample
fortnitepy-bot-master/device_auths.json
Resource
win10-20240221-en
Behavioral task
behavioral9
Sample
fortnitepy-bot-master/fortnite.py
Resource
win10-20240221-en
Behavioral task
behavioral10
Sample
fortnitepy-bot-master/partybot/__init__.py
Resource
win10-20240221-en
Behavioral task
behavioral11
Sample
fortnitepy-bot-master/partybot/bot.py
Resource
win10-20240221-en
Behavioral task
behavioral12
Sample
fortnitepy-bot-master/partybot/client.py
Resource
win10-20240221-en
Behavioral task
behavioral13
Sample
fortnitepy-bot-master/partybot/cosmetic.py
Resource
win10-20240214-en
Behavioral task
behavioral14
Sample
fortnitepy-bot-master/partybot/deviceauths.py
Resource
win10-20240221-en
Behavioral task
behavioral15
Sample
fortnitepy-bot-master/partybot/errors.py
Resource
win10-20240221-en
Behavioral task
behavioral16
Sample
fortnitepy-bot-master/partybot/generator.py
Resource
win10-20240221-en
Behavioral task
behavioral17
Sample
fortnitepy-bot-master/partybot/helper.py
Resource
win10-20240221-en
Behavioral task
behavioral18
Sample
fortnitepy-bot-master/partybot/party.py
Resource
win10-20240221-en
Behavioral task
behavioral19
Sample
fortnitepy-bot-master/partybot/settings.py
Resource
win10-20240221-en
Behavioral task
behavioral20
Sample
fortnitepy-bot-master/requirements.txt
Resource
win10-20240221-en
General
-
Target
fortnitepy-bot-master/INSTALL PACKAGES.bat
-
Size
1KB
-
MD5
4eeb5be18c4c89d677f92d9840432483
-
SHA1
c6e221374812ec1f596c3dbe80a62327347cb10f
-
SHA256
9d896813807801e83c0e216b2aace6adc6cbbf7e55ba904657eef440e975190b
-
SHA512
1e43320ad4fccc06d9206d991796e48bf661c640e027fab1077a54fcf06cffff3ba1a9ac04a670ef13217416a7b0d95ca0c4cc8ad70dedab53cc651d9fdc9b85
Malware Config
Extracted
https://www.python.org/ftp/python/3.6.0/python-3.6.0-amd64.exe
Signatures
-
Blocklisted process makes network request 2 IoCs
Processes:
powershell.exepowershell.exeflow pid process 2 684 powershell.exe 4 5020 powershell.exe -
Downloads MZ/PE file
-
Suspicious behavior: EnumeratesProcesses 6 IoCs
Processes:
powershell.exepowershell.exepid process 684 powershell.exe 684 powershell.exe 684 powershell.exe 5020 powershell.exe 5020 powershell.exe 5020 powershell.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
powershell.exepowershell.exedescription pid process Token: SeDebugPrivilege 684 powershell.exe Token: SeDebugPrivilege 5020 powershell.exe -
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
cmd.exedescription pid process target process PID 2164 wrote to memory of 684 2164 cmd.exe powershell.exe PID 2164 wrote to memory of 684 2164 cmd.exe powershell.exe PID 2164 wrote to memory of 5020 2164 cmd.exe powershell.exe PID 2164 wrote to memory of 5020 2164 cmd.exe powershell.exe PID 2164 wrote to memory of 1860 2164 cmd.exe cmd.exe PID 2164 wrote to memory of 1860 2164 cmd.exe cmd.exe
Processes
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\fortnitepy-bot-master\INSTALL PACKAGES.bat"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "(New-Object Net.WebClient).DownloadFile('https://www.python.org/ftp/python/3.6.0/python-3.6.0-amd64.exe', 'python-3.7.0-amd64.exe')"2⤵
- Blocklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "Invoke-WebRequest https://www.python.org/ftp/python/3.7.0/python-3.7.0-amd64.exe -OutFile python-3.7.0-amd64.exe"2⤵
- Blocklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\cmd.execmd /k2⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractiveFilesize
1KB
MD5df6fdc8436092f817e525aab10fbbc39
SHA1b4106482145ee52e762517b7981dfb2932548651
SHA2560c2b519d7ac7054fc0d15bf0d97d1089e990ee7beef87b42592c2c49274a1533
SHA512488bede812d01ad72ff9d78dfcba84c3b48515303e50d79381b577d102534a606f2fb7ab0ceb9a5e5af05176a5a85a30968c695f99796205aefa3af8be84c703
-
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_itofkwmo.rbe.ps1Filesize
1B
MD5c4ca4238a0b923820dcc509a6f75849b
SHA1356a192b7913b04c54574d18c28d46e6395428ab
SHA2566b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b
SHA5124dff4ea340f0a823f15d3f4f01ab62eae0e5da579ccb851f8db9dfe84c58b2b37b89903a740e1ee172da793a6e79d560e5f7f9bd058a12a280433ed6fa46510a
-
C:\Users\Admin\AppData\Local\Temp\fortnitepy-bot-master\python-3.7.0-amd64.exeMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
memory/684-10-0x00000235311F0000-0x0000023531266000-memory.dmpFilesize
472KB
-
memory/684-7-0x0000023531060000-0x0000023531070000-memory.dmpFilesize
64KB
-
memory/684-8-0x0000023531060000-0x0000023531070000-memory.dmpFilesize
64KB
-
memory/684-26-0x0000023531060000-0x0000023531070000-memory.dmpFilesize
64KB
-
memory/684-30-0x00007FF9CA4D0000-0x00007FF9CAEBC000-memory.dmpFilesize
9.9MB
-
memory/684-6-0x00007FF9CA4D0000-0x00007FF9CAEBC000-memory.dmpFilesize
9.9MB
-
memory/684-4-0x0000023518E00000-0x0000023518E22000-memory.dmpFilesize
136KB
-
memory/5020-35-0x00007FF9CA4D0000-0x00007FF9CAEBC000-memory.dmpFilesize
9.9MB
-
memory/5020-55-0x000001D2F2720000-0x000001D2F2730000-memory.dmpFilesize
64KB
-
memory/5020-36-0x000001D2F2720000-0x000001D2F2730000-memory.dmpFilesize
64KB
-
memory/5020-58-0x00007FF9CA4D0000-0x00007FF9CAEBC000-memory.dmpFilesize
9.9MB
-
memory/5020-59-0x000001D2F2720000-0x000001D2F2730000-memory.dmpFilesize
64KB
-
memory/5020-60-0x000001D2F2720000-0x000001D2F2730000-memory.dmpFilesize
64KB
-
memory/5020-61-0x000001D2F2720000-0x000001D2F2730000-memory.dmpFilesize
64KB
-
memory/5020-65-0x00007FF9CA4D0000-0x00007FF9CAEBC000-memory.dmpFilesize
9.9MB