Analysis

  • max time kernel
    91s
  • max time network
    121s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231215-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
  • submitted
    04-04-2024 18:55

General

  • Target

    FortniteFPS.exe

  • Size

    444KB

  • MD5

    ed8f9d380212722ab220453cf5c64524

  • SHA1

    e7cf9a672de8766bb9db767f4b3aaf3a7a0f6b10

  • SHA256

    fda3dd5344e004dc209fe24b2e383fbef569e11dc14f0d02c2051e8a69c80427

  • SHA512

    137a381f40c6db23580350322ddbc2930504dac23b693611ff975efa042fe4ba24587580339c27664eae0ae3c63278dc00e11aa82db6b9acceb0dd806f0c37c8

  • SSDEEP

    12288:khpdFOiCa+pp6DkqebgShtFRvKAOjzEcaY6RqTWmHH:kSa+E9SzFRy7jzEcB6UK

Score
10/10

Malware Config

Signatures

  • Rhadamanthys

    Rhadamanthys is an info stealer written in C++ first seen in August 2022.

  • Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Program crash 3 IoCs
  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious use of WriteProcessMemory 19 IoCs

Processes

  • C:\Windows\system32\sihost.exe
    sihost.exe
    1⤵
      PID:2648
      • C:\Windows\SysWOW64\dialer.exe
        "C:\Windows\system32\dialer.exe"
        2⤵
        • Suspicious behavior: EnumeratesProcesses
        PID:4400
    • C:\Users\Admin\AppData\Local\Temp\FortniteFPS.exe
      "C:\Users\Admin\AppData\Local\Temp\FortniteFPS.exe"
      1⤵
      • Suspicious use of SetThreadContext
      • Suspicious use of WriteProcessMemory
      PID:436
      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
        2⤵
          PID:2420
        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
          "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
          2⤵
          • Suspicious use of NtCreateUserProcessOtherParentProcess
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of WriteProcessMemory
          PID:3296
          • C:\Windows\SysWOW64\WerFault.exe
            C:\Windows\SysWOW64\WerFault.exe -u -p 3296 -s 600
            3⤵
            • Program crash
            PID:2352
          • C:\Windows\SysWOW64\WerFault.exe
            C:\Windows\SysWOW64\WerFault.exe -u -p 3296 -s 596
            3⤵
            • Program crash
            PID:2036
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 436 -s 876
          2⤵
          • Program crash
          PID:3928
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -pss -s 192 -p 436 -ip 436
        1⤵
          PID:2584
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -pss -s 508 -p 3296 -ip 3296
          1⤵
            PID:4344
          • C:\Windows\SysWOW64\WerFault.exe
            C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 3296 -ip 3296
            1⤵
              PID:216

            Network

            MITRE ATT&CK Matrix

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            • memory/436-8-0x0000000002A30000-0x0000000004A30000-memory.dmp

              Filesize

              32.0MB

            • memory/436-1-0x0000000074730000-0x0000000074EE0000-memory.dmp

              Filesize

              7.7MB

            • memory/436-0-0x00000000005B0000-0x0000000000626000-memory.dmp

              Filesize

              472KB

            • memory/436-10-0x0000000074730000-0x0000000074EE0000-memory.dmp

              Filesize

              7.7MB

            • memory/3296-14-0x00007FF8D54D0000-0x00007FF8D56C5000-memory.dmp

              Filesize

              2.0MB

            • memory/3296-22-0x0000000003B50000-0x0000000003F50000-memory.dmp

              Filesize

              4.0MB

            • memory/3296-7-0x0000000000400000-0x000000000046D000-memory.dmp

              Filesize

              436KB

            • memory/3296-11-0x0000000003B50000-0x0000000003F50000-memory.dmp

              Filesize

              4.0MB

            • memory/3296-12-0x0000000003B50000-0x0000000003F50000-memory.dmp

              Filesize

              4.0MB

            • memory/3296-13-0x0000000003B50000-0x0000000003F50000-memory.dmp

              Filesize

              4.0MB

            • memory/3296-4-0x0000000000400000-0x000000000046D000-memory.dmp

              Filesize

              436KB

            • memory/3296-16-0x0000000075B00000-0x0000000075D15000-memory.dmp

              Filesize

              2.1MB

            • memory/3296-17-0x0000000003B50000-0x0000000003F50000-memory.dmp

              Filesize

              4.0MB

            • memory/3296-9-0x0000000000400000-0x000000000046D000-memory.dmp

              Filesize

              436KB

            • memory/4400-18-0x0000000000CA0000-0x0000000000CA9000-memory.dmp

              Filesize

              36KB

            • memory/4400-20-0x00000000028D0000-0x0000000002CD0000-memory.dmp

              Filesize

              4.0MB

            • memory/4400-21-0x00000000028D0000-0x0000000002CD0000-memory.dmp

              Filesize

              4.0MB

            • memory/4400-23-0x00007FF8D54D0000-0x00007FF8D56C5000-memory.dmp

              Filesize

              2.0MB

            • memory/4400-24-0x00000000028D0000-0x0000000002CD0000-memory.dmp

              Filesize

              4.0MB

            • memory/4400-26-0x0000000075B00000-0x0000000075D15000-memory.dmp

              Filesize

              2.1MB

            • memory/4400-27-0x00000000028D0000-0x0000000002CD0000-memory.dmp

              Filesize

              4.0MB