Analysis

  • max time kernel
    123s
  • max time network
    159s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240704-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system
  • submitted
    07-07-2024 02:06

General

  • Target

    Fortnite Cheat.exe

  • Size

    50.6MB

  • MD5

    1ef6777b30bf94b13789fd4366421c62

  • SHA1

    59a335c36a77cc8be226073cc75d78bd95409d2e

  • SHA256

    e6fba68c13f806f95d4482c74428a3289a04c0d77662adb96d15bde315f57d15

  • SHA512

    b006f3cf53c7789f12bfb9afdb528f845b8e1eb1319727adf930652bc6ed89ca289d4bb00057be945d3495ac5c3979f580fe929dda4dda05a00415b7ad486a57

  • SSDEEP

    12288:NNv86NgnNyjZONdGjD2NkdO6zr+8ooqtzqLoaa97DB+QYC1DWc6gSM3S+9GaKLWI:NZIO

Malware Config

Extracted

Family

redline

C2

77.91.77.6:24186

Signatures

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine payload 1 IoCs
  • Loads dropped DLL 1 IoCs
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Suspicious use of SetThreadContext 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 5 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Fortnite Cheat.exe
    "C:\Users\Admin\AppData\Local\Temp\Fortnite Cheat.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:2864
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:3848
  • C:\Windows\System32\rundll32.exe
    C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
    1⤵
      PID:3548

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Roaming\d3d9.dll

      Filesize

      434KB

      MD5

      e70a4cefbe4bbb61b231a6da9c9d249a

      SHA1

      310e4c01db4989ab719c1c13ad9641899c823a71

      SHA256

      4506abd94f90753f44820ee3aa8ec2178f112f7e4871e0e4b21f57ec842588d8

      SHA512

      01956544a9ee45f51c919aa8ce9e8460243c8517021d9ded04c785dcea6079f55ae3062dabda54f042bc364651687183e16b7dff245b1c5aaa5c439773ce1563

    • memory/2864-13-0x0000000075030000-0x00000000757E0000-memory.dmp

      Filesize

      7.7MB

    • memory/2864-1-0x0000000000B20000-0x0000000000BB8000-memory.dmp

      Filesize

      608KB

    • memory/2864-2-0x0000000003090000-0x0000000003096000-memory.dmp

      Filesize

      24KB

    • memory/2864-0-0x000000007503E000-0x000000007503F000-memory.dmp

      Filesize

      4KB

    • memory/2864-12-0x0000000077AD1000-0x0000000077BF1000-memory.dmp

      Filesize

      1.1MB

    • memory/2864-11-0x0000000075030000-0x00000000757E0000-memory.dmp

      Filesize

      7.7MB

    • memory/3848-16-0x0000000004980000-0x0000000004A12000-memory.dmp

      Filesize

      584KB

    • memory/3848-20-0x0000000004D30000-0x0000000004E3A000-memory.dmp

      Filesize

      1.0MB

    • memory/3848-15-0x0000000004E90000-0x0000000005434000-memory.dmp

      Filesize

      5.6MB

    • memory/3848-9-0x0000000000420000-0x0000000000470000-memory.dmp

      Filesize

      320KB

    • memory/3848-17-0x0000000004B20000-0x0000000004B2A000-memory.dmp

      Filesize

      40KB

    • memory/3848-18-0x0000000075030000-0x00000000757E0000-memory.dmp

      Filesize

      7.7MB

    • memory/3848-19-0x0000000005A60000-0x0000000006078000-memory.dmp

      Filesize

      6.1MB

    • memory/3848-14-0x0000000075030000-0x00000000757E0000-memory.dmp

      Filesize

      7.7MB

    • memory/3848-21-0x0000000004BF0000-0x0000000004C02000-memory.dmp

      Filesize

      72KB

    • memory/3848-22-0x0000000004C60000-0x0000000004C9C000-memory.dmp

      Filesize

      240KB

    • memory/3848-23-0x0000000004CB0000-0x0000000004CFC000-memory.dmp

      Filesize

      304KB

    • memory/3848-24-0x0000000005510000-0x0000000005576000-memory.dmp

      Filesize

      408KB

    • memory/3848-25-0x0000000006310000-0x0000000006360000-memory.dmp

      Filesize

      320KB

    • memory/3848-26-0x0000000006530000-0x00000000066F2000-memory.dmp

      Filesize

      1.8MB

    • memory/3848-27-0x0000000006C30000-0x000000000715C000-memory.dmp

      Filesize

      5.2MB

    • memory/3848-29-0x0000000075030000-0x00000000757E0000-memory.dmp

      Filesize

      7.7MB