Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

10

Fortnite R...nt.exe

windows7-x64

7

Fortnite R...nt.exe

windows10-2004-x64

9

Fortnite R...or.dll

windows7-x64

1

Fortnite R...or.dll

windows10-2004-x64

1

Resubmissions

22/01/2025, 09:01

250122-kyv7rsylbz 10

21/01/2025, 17:54

250121-wgt4xsvqht 10

Analysis

  • max time kernel
    120s
  • max time network
    125s
  • platform
    windows7_x64
  • resource
    win7-20240708-en
  • resource tags

    arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
  • submitted
    21/01/2025, 17:54

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    Fortnite Rift Cheat Client/Rift Client.exe

  • Size

    83.2MB

  • MD5

    41d1ea4988bfecce6e65dc97a49aed13

  • SHA1

    c9312b2bbafc62193ce29cbfc8ff516b5a1065f8

  • SHA256

    1a9db52cc36a8f1f92505453f752cdfd925ef7321b330fe93022d707ddb43ab0

  • SHA512

    aab46f4b6806a81cbde049b46eb52b2dd16243f7004ed47cab69859836f03c8690fdc6e291ad7878eda1ba209d0b8a702ce6636b6cb6a782de317c518b9e3eb2

  • SSDEEP

    1572864:3VjlVW0Im7OkiqOv8im2ARxE71lhpBB8iYweyJulZUdgcrNWkWWUoyAb53:tbxIm7OknOv8i3KGLpnNpu4rX53

Score
7/10
upx

Malware Config

Signatures

  • Loads dropped DLL 1 IoCs
  • UPX packed file 2 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Fortnite Rift Cheat Client\Rift Client.exe
    "C:\Users\Admin\AppData\Local\Temp\Fortnite Rift Cheat Client\Rift Client.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1732
    • C:\Users\Admin\AppData\Local\Temp\Fortnite Rift Cheat Client\Rift Client.exe
      "C:\Users\Admin\AppData\Local\Temp\Fortnite Rift Cheat Client\Rift Client.exe"
      2⤵
      • Loads dropped DLL
      PID:1692

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\_MEI17322\python312.dll
    Filesize

    1.7MB

    MD5

    71070618402c15a2fad5ca70c9ef7297

    SHA1

    34fedbf17a57010c5cd20ef4e690616859cc8e68

    SHA256

    7d35a191edb95ccd85ef05d645deeca3ed1febd9acd659569fab56ae06c1ebdf

    SHA512

    81ef8749f5c3dbd586ddbbcf26cd6c80607a5cc9c26e31c912f454ca56013082174e2012a507739ec1e9c5a2f019bf0ca6bd3ce18880abdbff0ba5f8f3cbbf28

    Download Submit

  • memory/1692-1270-0x000007FEF5AD0000-0x000007FEF6195000-memory.dmp

    Filesize

    6.8MB

    Download