Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
120s -
max time network
125s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
21/01/2025, 17:54
Behavioral task
behavioral1
Sample
Fortnite Rift Cheat Client/Rift Client.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
Fortnite Rift Cheat Client/Rift Client.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral3
Sample
Fortnite Rift Cheat Client/Rift_Injector.dll
Resource
win7-20240903-en
Behavioral task
behavioral4
Sample
Fortnite Rift Cheat Client/Rift_Injector.dll
Resource
win10v2004-20241007-en
General
-
Target
Fortnite Rift Cheat Client/Rift Client.exe
-
Size
83.2MB
-
MD5
41d1ea4988bfecce6e65dc97a49aed13
-
SHA1
c9312b2bbafc62193ce29cbfc8ff516b5a1065f8
-
SHA256
1a9db52cc36a8f1f92505453f752cdfd925ef7321b330fe93022d707ddb43ab0
-
SHA512
aab46f4b6806a81cbde049b46eb52b2dd16243f7004ed47cab69859836f03c8690fdc6e291ad7878eda1ba209d0b8a702ce6636b6cb6a782de317c518b9e3eb2
-
SSDEEP
1572864:3VjlVW0Im7OkiqOv8im2ARxE71lhpBB8iYweyJulZUdgcrNWkWWUoyAb53:tbxIm7OknOv8i3KGLpnNpu4rX53
Malware Config
Signatures
-
Loads dropped DLL 1 IoCs
pid Process 1692 Rift Client.exe -
resource yara_rule behavioral1/files/0x0003000000020ae9-1268.dat upx behavioral1/memory/1692-1270-0x000007FEF5AD0000-0x000007FEF6195000-memory.dmp upx -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 1732 wrote to memory of 1692 1732 Rift Client.exe 30 PID 1732 wrote to memory of 1692 1732 Rift Client.exe 30 PID 1732 wrote to memory of 1692 1732 Rift Client.exe 30
Processes
-
C:\Users\Admin\AppData\Local\Temp\Fortnite Rift Cheat Client\Rift Client.exe"C:\Users\Admin\AppData\Local\Temp\Fortnite Rift Cheat Client\Rift Client.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1732 -
C:\Users\Admin\AppData\Local\Temp\Fortnite Rift Cheat Client\Rift Client.exe"C:\Users\Admin\AppData\Local\Temp\Fortnite Rift Cheat Client\Rift Client.exe"2⤵
- Loads dropped DLL
PID:1692
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.7MB
MD571070618402c15a2fad5ca70c9ef7297
SHA134fedbf17a57010c5cd20ef4e690616859cc8e68
SHA2567d35a191edb95ccd85ef05d645deeca3ed1febd9acd659569fab56ae06c1ebdf
SHA51281ef8749f5c3dbd586ddbbcf26cd6c80607a5cc9c26e31c912f454ca56013082174e2012a507739ec1e9c5a2f019bf0ca6bd3ce18880abdbff0ba5f8f3cbbf28