bde9aa21edb27047da788869a13e5f81f6fc8beca594f07fb70236dca1a1f139

Analysis

max time kernel
92s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
20-01-2025 16:56

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

temp/temp/temp/temp/cleaners/FortniteCleaner.bat
Size

1.5MB
MD5

2429db21a224c48fa6b17e55a6762328
SHA1

f86eb0c2de25e8970add83b66253d3f18b0994e1
SHA256

365685c1e71944bc955c6be46cc33a44099bcb0f8c625228e89445f18866b778
SHA512

0487e79a9b2b427f8c0e5bb860e78039bcf29626bd58ad8190df858fcfa130d15add3fcd350cdadaccbc1d2e13f822dab76e418029d692d2ccd972594b4c0e23
SSDEEP

49152:9TOB4ynYygOvXsMruROZyUpWvWOLZkORn:b

Score

1^/10

Malware Config

Signatures

Kills process with taskkill 11 IoCs

defense_evasion

pid	Process
404	taskkill.exe
3904	taskkill.exe
3956	taskkill.exe
3240	taskkill.exe
2476	taskkill.exe
2736	taskkill.exe
5108	taskkill.exe
1140	taskkill.exe
416	taskkill.exe
3328	taskkill.exe
4744	taskkill.exe

Suspicious use of AdjustPrivilegeToken 11 IoCs

description	pid	Process
Token: SeDebugPrivilege	404	taskkill.exe
Token: SeDebugPrivilege	3904	taskkill.exe
Token: SeDebugPrivilege	3956	taskkill.exe
Token: SeDebugPrivilege	5108	taskkill.exe
Token: SeDebugPrivilege	1140	taskkill.exe
Token: SeDebugPrivilege	3240	taskkill.exe
Token: SeDebugPrivilege	416	taskkill.exe
Token: SeDebugPrivilege	2476	taskkill.exe
Token: SeDebugPrivilege	2736	taskkill.exe
Token: SeDebugPrivilege	3328	taskkill.exe
Token: SeDebugPrivilege	4744	taskkill.exe

Suspicious use of WriteProcessMemory 26 IoCs

description	pid	Process	procid_target
PID 4840 wrote to memory of 404	4840	cmd.exe	85
PID 4840 wrote to memory of 404	4840	cmd.exe	85
PID 4840 wrote to memory of 3904	4840	cmd.exe	87
PID 4840 wrote to memory of 3904	4840	cmd.exe	87
PID 4840 wrote to memory of 3956	4840	cmd.exe	88
PID 4840 wrote to memory of 3956	4840	cmd.exe	88
PID 4840 wrote to memory of 5108	4840	cmd.exe	89
PID 4840 wrote to memory of 5108	4840	cmd.exe	89
PID 4840 wrote to memory of 1140	4840	cmd.exe	90
PID 4840 wrote to memory of 1140	4840	cmd.exe	90
PID 4840 wrote to memory of 3240	4840	cmd.exe	91
PID 4840 wrote to memory of 3240	4840	cmd.exe	91
PID 4840 wrote to memory of 416	4840	cmd.exe	92
PID 4840 wrote to memory of 416	4840	cmd.exe	92
PID 4840 wrote to memory of 2476	4840	cmd.exe	93
PID 4840 wrote to memory of 2476	4840	cmd.exe	93
PID 4840 wrote to memory of 2736	4840	cmd.exe	94
PID 4840 wrote to memory of 2736	4840	cmd.exe	94
PID 4840 wrote to memory of 3328	4840	cmd.exe	95
PID 4840 wrote to memory of 3328	4840	cmd.exe	95
PID 4840 wrote to memory of 4744	4840	cmd.exe	96
PID 4840 wrote to memory of 4744	4840	cmd.exe	96
PID 4840 wrote to memory of 1932	4840	cmd.exe	97
PID 4840 wrote to memory of 1932	4840	cmd.exe	97
PID 1932 wrote to memory of 3356	1932	cmd.exe	98
PID 1932 wrote to memory of 3356	1932	cmd.exe	98

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\temp\temp\temp\temp\cleaners\FortniteCleaner.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:4840
- C:\Windows\system32\taskkill.exe
  taskkill /f /im epicgameslauncher.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:404
- C:\Windows\system32\taskkill.exe
  taskkill /f /im FortniteClient-Win64-Shipping_EAC.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:3904
- C:\Windows\system32\taskkill.exe
  taskkill /f /im FortniteClient-Win64-Shipping.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:3956
- C:\Windows\system32\taskkill.exe
  taskkill /f /im FortniteClient-Win64-Shipping_BE.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:5108
- C:\Windows\system32\taskkill.exe
  taskkill /f /im FortniteLauncher.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1140
- C:\Windows\system32\taskkill.exe
  taskkill /f /im UnrealCEFSubProcess.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:3240
- C:\Windows\system32\taskkill.exe
  taskkill /f /im CEFProcess.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:416
- C:\Windows\system32\taskkill.exe
  taskkill /f /im EasyAntiCheat.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2476
- C:\Windows\system32\taskkill.exe
  taskkill /f /im BEService.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2736
- C:\Windows\system32\taskkill.exe
  taskkill /f /im BEServices.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:3328
- C:\Windows\system32\taskkill.exe
  taskkill /f /im BattleEye.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:4744
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c findstr /b ::: "C:\Users\Admin\AppData\Local\Temp\temp\temp\temp\temp\cleaners\FortniteCleaner.bat"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1932
- - C:\Windows\system32\findstr.exe
    findstr /b ::: "C:\Users\Admin\AppData\Local\Temp\temp\temp\temp\temp\cleaners\FortniteCleaner.bat"
    3⤵
    PID:3356

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads