2dbf25db010361831baef17f92285d2efb32af12e064d80cc3037937fe228e69

General

Target

orqur - fortnite.exe
Size

6.6MB
MD5

8f10ad3ec661c6f442e7fad625c1bbac
SHA1

506db2cb55ca0f04e4d535d8e0f8293511d147a6
SHA256

2dbf25db010361831baef17f92285d2efb32af12e064d80cc3037937fe228e69
SHA512

98c10f100e974e8ee32419b00d12f17eedf681ae686cb6f30fcf844202bf664f94732f81aa2bf0a0f2691a24840179f7b31b58131c4f83883f361cae303f51a5
SSDEEP

98304:Jen1Kvlahp1Z9hzBLzzbMXYlXYxnCg2j5scrNws9ZiH/MctRkCgL4b3Q6V:nvl81Z1zYXYUne5scrNwfVkvL4Q6

Score

5^/10

Malware Config

Signatures

Suspicious use of NtSetInformationThreadHideFromDebugger 3 IoCs

pid	Process
2532	orqur - fortnite.exe
2532	orqur - fortnite.exe
2532	orqur - fortnite.exe

Delays execution with timeout.exe 1 IoCs

evasion

pid	Process
2724	timeout.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2532	orqur - fortnite.exe
2532	orqur - fortnite.exe

Suspicious use of WriteProcessMemory 27 IoCs

description	pid	Process	procid_target
PID 2532 wrote to memory of 1800	2532	orqur - fortnite.exe	31
PID 2532 wrote to memory of 1800	2532	orqur - fortnite.exe	31
PID 2532 wrote to memory of 1800	2532	orqur - fortnite.exe	31
PID 1800 wrote to memory of 1736	1800	cmd.exe	32
PID 1800 wrote to memory of 1736	1800	cmd.exe	32
PID 1800 wrote to memory of 1736	1800	cmd.exe	32
PID 1800 wrote to memory of 2544	1800	cmd.exe	33
PID 1800 wrote to memory of 2544	1800	cmd.exe	33
PID 1800 wrote to memory of 2544	1800	cmd.exe	33
PID 1800 wrote to memory of 344	1800	cmd.exe	34
PID 1800 wrote to memory of 344	1800	cmd.exe	34
PID 1800 wrote to memory of 344	1800	cmd.exe	34
PID 2532 wrote to memory of 2180	2532	orqur - fortnite.exe	35
PID 2532 wrote to memory of 2180	2532	orqur - fortnite.exe	35
PID 2532 wrote to memory of 2180	2532	orqur - fortnite.exe	35
PID 2532 wrote to memory of 2832	2532	orqur - fortnite.exe	36
PID 2532 wrote to memory of 2832	2532	orqur - fortnite.exe	36
PID 2532 wrote to memory of 2832	2532	orqur - fortnite.exe	36
PID 2832 wrote to memory of 3016	2832	cmd.exe	37
PID 2832 wrote to memory of 3016	2832	cmd.exe	37
PID 2832 wrote to memory of 3016	2832	cmd.exe	37
PID 2532 wrote to memory of 2860	2532	orqur - fortnite.exe	39
PID 2532 wrote to memory of 2860	2532	orqur - fortnite.exe	39
PID 2532 wrote to memory of 2860	2532	orqur - fortnite.exe	39
PID 3016 wrote to memory of 2724	3016	cmd.exe	40
PID 3016 wrote to memory of 2724	3016	cmd.exe	40
PID 3016 wrote to memory of 2724	3016	cmd.exe	40

C:\Users\Admin\AppData\Local\Temp\orqur - fortnite.exe
"C:\Users\Admin\AppData\Local\Temp\orqur - fortnite.exe"
1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2532
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c certutil -hashfile "C:\Users\Admin\AppData\Local\Temp\orqur - fortnite.exe" MD5 | find /i /v "md5" | find /i /v "certutil"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1800
- - C:\Windows\system32\certutil.exe
    certutil -hashfile "C:\Users\Admin\AppData\Local\Temp\orqur - fortnite.exe" MD5
    3⤵
    PID:1736
- - C:\Windows\system32\find.exe
    find /i /v "md5"
    3⤵
    PID:2544
- - C:\Windows\system32\find.exe
    find /i /v "certutil"
    3⤵
    PID:344
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:2180
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c start cmd /C "color b && title Error && echo Signature checksum failed. Request was tampered with or session ended most likely. & echo: & echo Message: Session not found. Use latest code. You can only have app opened 1 at a time. && timeout /t 5"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2832
- - C:\Windows\system32\cmd.exe
    cmd /C "color b && title Error && echo Signature checksum failed. Request was tampered with or session ended most likely. & echo: & echo Message: Session not found. Use latest code. You can only have app opened 1 at a time. && timeout /t 5"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3016
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:2724
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2532 -s 628
  2⤵
  PID:2860

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2532-0-0x0000000140125000-0x000000014051A000-memory.dmp

Filesize
4.0MB

Download
memory/2532-10-0x0000000077070000-0x0000000077072000-memory.dmp

Filesize
8KB

Download
memory/2532-8-0x0000000077070000-0x0000000077072000-memory.dmp

Filesize
8KB

Download
memory/2532-6-0x0000000077070000-0x0000000077072000-memory.dmp

Filesize
8KB

Download
memory/2532-5-0x0000000077040000-0x0000000077042000-memory.dmp

Filesize
8KB

Download
memory/2532-3-0x0000000077040000-0x0000000077042000-memory.dmp

Filesize
8KB

Download
memory/2532-1-0x0000000077040000-0x0000000077042000-memory.dmp

Filesize
8KB

Download
memory/2532-11-0x0000000140000000-0x0000000140BAB000-memory.dmp

Filesize
11.7MB

Download
memory/2532-15-0x0000000140000000-0x0000000140BAB000-memory.dmp

Filesize
11.7MB

Download
memory/2532-16-0x0000000140000000-0x0000000140BAB000-memory.dmp

Filesize
11.7MB

Download
memory/2532-17-0x0000000140000000-0x0000000140BAB000-memory.dmp

Filesize
11.7MB

Download
memory/2532-20-0x0000000140125000-0x000000014051A000-memory.dmp

Filesize
4.0MB

Download
memory/2532-21-0x0000000140000000-0x0000000140BAB000-memory.dmp

Filesize
11.7MB

Download

Analysis

Sharing