f578d77e5264494fd9cf4b740953b12b348745c43cc256cc5339c6a91413f909

Analysis

max time kernel
149s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
23-11-2024 17:28

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

lcb spoofer_updated_quack/cleaners/FortniteCleaner.bat
Size

1.5MB
MD5

2429db21a224c48fa6b17e55a6762328
SHA1

f86eb0c2de25e8970add83b66253d3f18b0994e1
SHA256

365685c1e71944bc955c6be46cc33a44099bcb0f8c625228e89445f18866b778
SHA512

0487e79a9b2b427f8c0e5bb860e78039bcf29626bd58ad8190df858fcfa130d15add3fcd350cdadaccbc1d2e13f822dab76e418029d692d2ccd972594b4c0e23
SSDEEP

49152:9TOB4ynYygOvXsMruROZyUpWvWOLZkORn:b

Score

1^/10

Malware Config

Signatures

Kills process with taskkill 11 IoCs

evasion

Processes:

taskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exe

pid	process
2660	taskkill.exe
2188	taskkill.exe
4768	taskkill.exe
4176	taskkill.exe
400	taskkill.exe
1240	taskkill.exe
2868	taskkill.exe
1740	taskkill.exe
3956	taskkill.exe
1044	taskkill.exe
1308	taskkill.exe

Suspicious use of AdjustPrivilegeToken 11 IoCs

Processes:

taskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exe

description	pid	process
Token: SeDebugPrivilege	1740	taskkill.exe
Token: SeDebugPrivilege	3956	taskkill.exe
Token: SeDebugPrivilege	4768	taskkill.exe
Token: SeDebugPrivilege	4176	taskkill.exe
Token: SeDebugPrivilege	1044	taskkill.exe
Token: SeDebugPrivilege	400	taskkill.exe
Token: SeDebugPrivilege	1240	taskkill.exe
Token: SeDebugPrivilege	2660	taskkill.exe
Token: SeDebugPrivilege	2188	taskkill.exe
Token: SeDebugPrivilege	1308	taskkill.exe
Token: SeDebugPrivilege	2868	taskkill.exe

Suspicious use of WriteProcessMemory 26 IoCs

Processes:

cmd.execmd.exe

description	pid	process	target process
PID 1288 wrote to memory of 1740	1288	cmd.exe	taskkill.exe
PID 1288 wrote to memory of 1740	1288	cmd.exe	taskkill.exe
PID 1288 wrote to memory of 3956	1288	cmd.exe	taskkill.exe
PID 1288 wrote to memory of 3956	1288	cmd.exe	taskkill.exe
PID 1288 wrote to memory of 4768	1288	cmd.exe	taskkill.exe
PID 1288 wrote to memory of 4768	1288	cmd.exe	taskkill.exe
PID 1288 wrote to memory of 4176	1288	cmd.exe	taskkill.exe
PID 1288 wrote to memory of 4176	1288	cmd.exe	taskkill.exe
PID 1288 wrote to memory of 1044	1288	cmd.exe	taskkill.exe
PID 1288 wrote to memory of 1044	1288	cmd.exe	taskkill.exe
PID 1288 wrote to memory of 400	1288	cmd.exe	taskkill.exe
PID 1288 wrote to memory of 400	1288	cmd.exe	taskkill.exe
PID 1288 wrote to memory of 1240	1288	cmd.exe	taskkill.exe
PID 1288 wrote to memory of 1240	1288	cmd.exe	taskkill.exe
PID 1288 wrote to memory of 2660	1288	cmd.exe	taskkill.exe
PID 1288 wrote to memory of 2660	1288	cmd.exe	taskkill.exe
PID 1288 wrote to memory of 2188	1288	cmd.exe	taskkill.exe
PID 1288 wrote to memory of 2188	1288	cmd.exe	taskkill.exe
PID 1288 wrote to memory of 1308	1288	cmd.exe	taskkill.exe
PID 1288 wrote to memory of 1308	1288	cmd.exe	taskkill.exe
PID 1288 wrote to memory of 2868	1288	cmd.exe	taskkill.exe
PID 1288 wrote to memory of 2868	1288	cmd.exe	taskkill.exe
PID 1288 wrote to memory of 1096	1288	cmd.exe	cmd.exe
PID 1288 wrote to memory of 1096	1288	cmd.exe	cmd.exe
PID 1096 wrote to memory of 764	1096	cmd.exe	findstr.exe
PID 1096 wrote to memory of 764	1096	cmd.exe	findstr.exe

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\lcb spoofer_updated_quack\cleaners\FortniteCleaner.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:1288
- C:\Windows\system32\taskkill.exe
  taskkill /f /im epicgameslauncher.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1740
- C:\Windows\system32\taskkill.exe
  taskkill /f /im FortniteClient-Win64-Shipping_EAC.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:3956
- C:\Windows\system32\taskkill.exe
  taskkill /f /im FortniteClient-Win64-Shipping.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:4768
- C:\Windows\system32\taskkill.exe
  taskkill /f /im FortniteClient-Win64-Shipping_BE.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:4176
- C:\Windows\system32\taskkill.exe
  taskkill /f /im FortniteLauncher.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1044
- C:\Windows\system32\taskkill.exe
  taskkill /f /im UnrealCEFSubProcess.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:400
- C:\Windows\system32\taskkill.exe
  taskkill /f /im CEFProcess.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1240
- C:\Windows\system32\taskkill.exe
  taskkill /f /im EasyAntiCheat.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2660
- C:\Windows\system32\taskkill.exe
  taskkill /f /im BEService.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2188
- C:\Windows\system32\taskkill.exe
  taskkill /f /im BEServices.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1308
- C:\Windows\system32\taskkill.exe
  taskkill /f /im BattleEye.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2868
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c findstr /b ::: "C:\Users\Admin\AppData\Local\Temp\lcb spoofer_updated_quack\cleaners\FortniteCleaner.bat"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1096
- - C:\Windows\system32\findstr.exe
    findstr /b ::: "C:\Users\Admin\AppData\Local\Temp\lcb spoofer_updated_quack\cleaners\FortniteCleaner.bat"
    3⤵
    PID:764

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads