bde9aa21edb27047da788869a13e5f81f6fc8beca594f07fb70236dca1a1f139

Resubmissions

20-01-2025 15:14

250120-smhfjavqhx 10

20-01-2025 15:13

250120-sl6rqsvqgs 10

Analysis

max time kernel
95s
max time network
142s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
20-01-2025 15:13

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

temp/temp/temp/temp/cleaners/FortniteCleaner.bat
Size

1.5MB
MD5

2429db21a224c48fa6b17e55a6762328
SHA1

f86eb0c2de25e8970add83b66253d3f18b0994e1
SHA256

365685c1e71944bc955c6be46cc33a44099bcb0f8c625228e89445f18866b778
SHA512

0487e79a9b2b427f8c0e5bb860e78039bcf29626bd58ad8190df858fcfa130d15add3fcd350cdadaccbc1d2e13f822dab76e418029d692d2ccd972594b4c0e23
SSDEEP

49152:9TOB4ynYygOvXsMruROZyUpWvWOLZkORn:b

Score

1^/10

Malware Config

Signatures

Kills process with taskkill 11 IoCs

defense_evasion

pid	Process
1304	taskkill.exe
4976	taskkill.exe
3900	taskkill.exe
1116	taskkill.exe
1052	taskkill.exe
1200	taskkill.exe
4684	taskkill.exe
4972	taskkill.exe
1696	taskkill.exe
2708	taskkill.exe
4520	taskkill.exe

Suspicious use of AdjustPrivilegeToken 11 IoCs

description	pid	Process
Token: SeDebugPrivilege	3900	taskkill.exe
Token: SeDebugPrivilege	4972	taskkill.exe
Token: SeDebugPrivilege	1696	taskkill.exe
Token: SeDebugPrivilege	1116	taskkill.exe
Token: SeDebugPrivilege	1052	taskkill.exe
Token: SeDebugPrivilege	1200	taskkill.exe
Token: SeDebugPrivilege	2708	taskkill.exe
Token: SeDebugPrivilege	4520	taskkill.exe
Token: SeDebugPrivilege	1304	taskkill.exe
Token: SeDebugPrivilege	4684	taskkill.exe
Token: SeDebugPrivilege	4976	taskkill.exe

Suspicious use of WriteProcessMemory 26 IoCs

description	pid	Process	procid_target
PID 4048 wrote to memory of 3900	4048	cmd.exe	84
PID 4048 wrote to memory of 3900	4048	cmd.exe	84
PID 4048 wrote to memory of 4972	4048	cmd.exe	86
PID 4048 wrote to memory of 4972	4048	cmd.exe	86
PID 4048 wrote to memory of 1696	4048	cmd.exe	87
PID 4048 wrote to memory of 1696	4048	cmd.exe	87
PID 4048 wrote to memory of 1116	4048	cmd.exe	88
PID 4048 wrote to memory of 1116	4048	cmd.exe	88
PID 4048 wrote to memory of 1052	4048	cmd.exe	89
PID 4048 wrote to memory of 1052	4048	cmd.exe	89
PID 4048 wrote to memory of 1200	4048	cmd.exe	90
PID 4048 wrote to memory of 1200	4048	cmd.exe	90
PID 4048 wrote to memory of 2708	4048	cmd.exe	91
PID 4048 wrote to memory of 2708	4048	cmd.exe	91
PID 4048 wrote to memory of 4520	4048	cmd.exe	92
PID 4048 wrote to memory of 4520	4048	cmd.exe	92
PID 4048 wrote to memory of 1304	4048	cmd.exe	93
PID 4048 wrote to memory of 1304	4048	cmd.exe	93
PID 4048 wrote to memory of 4684	4048	cmd.exe	94
PID 4048 wrote to memory of 4684	4048	cmd.exe	94
PID 4048 wrote to memory of 4976	4048	cmd.exe	95
PID 4048 wrote to memory of 4976	4048	cmd.exe	95
PID 4048 wrote to memory of 3796	4048	cmd.exe	96
PID 4048 wrote to memory of 3796	4048	cmd.exe	96
PID 3796 wrote to memory of 4236	3796	cmd.exe	97
PID 3796 wrote to memory of 4236	3796	cmd.exe	97

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\temp\temp\temp\temp\cleaners\FortniteCleaner.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:4048
- C:\Windows\system32\taskkill.exe
  taskkill /f /im epicgameslauncher.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:3900
- C:\Windows\system32\taskkill.exe
  taskkill /f /im FortniteClient-Win64-Shipping_EAC.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:4972
- C:\Windows\system32\taskkill.exe
  taskkill /f /im FortniteClient-Win64-Shipping.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1696
- C:\Windows\system32\taskkill.exe
  taskkill /f /im FortniteClient-Win64-Shipping_BE.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1116
- C:\Windows\system32\taskkill.exe
  taskkill /f /im FortniteLauncher.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1052
- C:\Windows\system32\taskkill.exe
  taskkill /f /im UnrealCEFSubProcess.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1200
- C:\Windows\system32\taskkill.exe
  taskkill /f /im CEFProcess.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2708
- C:\Windows\system32\taskkill.exe
  taskkill /f /im EasyAntiCheat.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:4520
- C:\Windows\system32\taskkill.exe
  taskkill /f /im BEService.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1304
- C:\Windows\system32\taskkill.exe
  taskkill /f /im BEServices.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:4684
- C:\Windows\system32\taskkill.exe
  taskkill /f /im BattleEye.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:4976
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c findstr /b ::: "C:\Users\Admin\AppData\Local\Temp\temp\temp\temp\temp\cleaners\FortniteCleaner.bat"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3796
- - C:\Windows\system32\findstr.exe
    findstr /b ::: "C:\Users\Admin\AppData\Local\Temp\temp\temp\temp\temp\cleaners\FortniteCleaner.bat"
    3⤵
    PID:4236

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads