Analysis
-
max time kernel
16s -
max time network
16s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
13-12-2024 21:55
Behavioral task
behavioral1
Sample
cheatfortnite.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
cheatfortnite.exe
Resource
win10v2004-20241007-en
General
-
Target
cheatfortnite.exe
-
Size
6.9MB
-
MD5
c8241ffaa3c1e6eb10192424e8d2dabb
-
SHA1
dcf25b0a0b3f1ec681ff71a25d2c9dc0f119dd1d
-
SHA256
973dc4caf0232f42a06efd4a8695dbb89b3fc8dc974d59cc6cdea34e49967094
-
SHA512
1b0ba7b8534c214d3ae914d41680f373aa2687c3a8f6bc32dc87aee1164cff151a4ac14aa72a109c30ad5ffd64c11aab90496368be6bb664c56161625fe6b08a
-
SSDEEP
98304:+SDjWM8JEE1FZqh4KBamaHl3Ne4i3Tf2PkOpfW9hZMMoVmkzhxIdfXeRpYRJJcGK:+S0HBeNTfm/pf+xk4dWRpmrbW3jmre
Malware Config
Signatures
-
Loads dropped DLL 1 IoCs
pid Process 2548 cheatfortnite.exe -
resource yara_rule behavioral1/files/0x000500000001945c-21.dat upx behavioral1/memory/2548-23-0x000007FEF6630000-0x000007FEF6C18000-memory.dmp upx -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 2400 wrote to memory of 2548 2400 cheatfortnite.exe 30 PID 2400 wrote to memory of 2548 2400 cheatfortnite.exe 30 PID 2400 wrote to memory of 2548 2400 cheatfortnite.exe 30
Processes
-
C:\Users\Admin\AppData\Local\Temp\cheatfortnite.exe"C:\Users\Admin\AppData\Local\Temp\cheatfortnite.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2400 -
C:\Users\Admin\AppData\Local\Temp\cheatfortnite.exe"C:\Users\Admin\AppData\Local\Temp\cheatfortnite.exe"2⤵
- Loads dropped DLL
PID:2548
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.6MB
MD5bb46b85029b543b70276ad8e4c238799
SHA1123bdcd9eebcac1ec0fd2764a37e5e5476bb0c1c
SHA25672c24e1db1ba4df791720a93ca9502d77c3738eebf8b9092a5d82aa8d80121d0
SHA5125e993617509c1cf434938d6a467eb0494e04580ad242535a04937f7c174d429da70a6e71792fc3de69e103ffc5d9de51d29001a4df528cfffefdaa2cef4eaf31