bde9aa21edb27047da788869a13e5f81f6fc8beca594f07fb70236dca1a1f139

Analysis

max time kernel
90s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
20-01-2025 16:51

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

temp/temp/temp/temp/cleaners/FortniteCleaner.bat
Size

1.5MB
MD5

2429db21a224c48fa6b17e55a6762328
SHA1

f86eb0c2de25e8970add83b66253d3f18b0994e1
SHA256

365685c1e71944bc955c6be46cc33a44099bcb0f8c625228e89445f18866b778
SHA512

0487e79a9b2b427f8c0e5bb860e78039bcf29626bd58ad8190df858fcfa130d15add3fcd350cdadaccbc1d2e13f822dab76e418029d692d2ccd972594b4c0e23
SSDEEP

49152:9TOB4ynYygOvXsMruROZyUpWvWOLZkORn:b

Score

1^/10

Malware Config

Signatures

Kills process with taskkill 11 IoCs

defense_evasion

pid	Process
4988	taskkill.exe
3916	taskkill.exe
1900	taskkill.exe
4724	taskkill.exe
228	taskkill.exe
4968	taskkill.exe
640	taskkill.exe
1632	taskkill.exe
2012	taskkill.exe
4488	taskkill.exe
428	taskkill.exe

Suspicious use of AdjustPrivilegeToken 11 IoCs

description	pid	Process
Token: SeDebugPrivilege	4988	taskkill.exe
Token: SeDebugPrivilege	3916	taskkill.exe
Token: SeDebugPrivilege	228	taskkill.exe
Token: SeDebugPrivilege	1900	taskkill.exe
Token: SeDebugPrivilege	4968	taskkill.exe
Token: SeDebugPrivilege	640	taskkill.exe
Token: SeDebugPrivilege	1632	taskkill.exe
Token: SeDebugPrivilege	4724	taskkill.exe
Token: SeDebugPrivilege	2012	taskkill.exe
Token: SeDebugPrivilege	4488	taskkill.exe
Token: SeDebugPrivilege	428	taskkill.exe

Suspicious use of WriteProcessMemory 26 IoCs

description	pid	Process	procid_target
PID 3540 wrote to memory of 4988	3540	cmd.exe	86
PID 3540 wrote to memory of 4988	3540	cmd.exe	86
PID 3540 wrote to memory of 3916	3540	cmd.exe	88
PID 3540 wrote to memory of 3916	3540	cmd.exe	88
PID 3540 wrote to memory of 228	3540	cmd.exe	89
PID 3540 wrote to memory of 228	3540	cmd.exe	89
PID 3540 wrote to memory of 1900	3540	cmd.exe	90
PID 3540 wrote to memory of 1900	3540	cmd.exe	90
PID 3540 wrote to memory of 4968	3540	cmd.exe	91
PID 3540 wrote to memory of 4968	3540	cmd.exe	91
PID 3540 wrote to memory of 640	3540	cmd.exe	92
PID 3540 wrote to memory of 640	3540	cmd.exe	92
PID 3540 wrote to memory of 1632	3540	cmd.exe	93
PID 3540 wrote to memory of 1632	3540	cmd.exe	93
PID 3540 wrote to memory of 4724	3540	cmd.exe	94
PID 3540 wrote to memory of 4724	3540	cmd.exe	94
PID 3540 wrote to memory of 2012	3540	cmd.exe	95
PID 3540 wrote to memory of 2012	3540	cmd.exe	95
PID 3540 wrote to memory of 4488	3540	cmd.exe	96
PID 3540 wrote to memory of 4488	3540	cmd.exe	96
PID 3540 wrote to memory of 428	3540	cmd.exe	97
PID 3540 wrote to memory of 428	3540	cmd.exe	97
PID 3540 wrote to memory of 876	3540	cmd.exe	98
PID 3540 wrote to memory of 876	3540	cmd.exe	98
PID 876 wrote to memory of 1208	876	cmd.exe	99
PID 876 wrote to memory of 1208	876	cmd.exe	99

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\temp\temp\temp\temp\cleaners\FortniteCleaner.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:3540
- C:\Windows\system32\taskkill.exe
  taskkill /f /im epicgameslauncher.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:4988
- C:\Windows\system32\taskkill.exe
  taskkill /f /im FortniteClient-Win64-Shipping_EAC.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:3916
- C:\Windows\system32\taskkill.exe
  taskkill /f /im FortniteClient-Win64-Shipping.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:228
- C:\Windows\system32\taskkill.exe
  taskkill /f /im FortniteClient-Win64-Shipping_BE.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1900
- C:\Windows\system32\taskkill.exe
  taskkill /f /im FortniteLauncher.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:4968
- C:\Windows\system32\taskkill.exe
  taskkill /f /im UnrealCEFSubProcess.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:640
- C:\Windows\system32\taskkill.exe
  taskkill /f /im CEFProcess.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1632
- C:\Windows\system32\taskkill.exe
  taskkill /f /im EasyAntiCheat.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:4724
- C:\Windows\system32\taskkill.exe
  taskkill /f /im BEService.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2012
- C:\Windows\system32\taskkill.exe
  taskkill /f /im BEServices.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:4488
- C:\Windows\system32\taskkill.exe
  taskkill /f /im BattleEye.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:428
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c findstr /b ::: "C:\Users\Admin\AppData\Local\Temp\temp\temp\temp\temp\cleaners\FortniteCleaner.bat"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:876
- - C:\Windows\system32\findstr.exe
    findstr /b ::: "C:\Users\Admin\AppData\Local\Temp\temp\temp\temp\temp\cleaners\FortniteCleaner.bat"
    3⤵
    PID:1208

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads