Overview

overview

10

Static

static

10

Optimized_...te.exe

windows7-x64

7

Optimized_...te.exe

windows10-2004-x64

7

main.pyc

windows7-x64

3

main.pyc

windows10-2004-x64

3

Analysis

  • max time kernel
    44s
  • max time network
    22s
  • platform
    windows7_x64
  • resource
    win7-20240729-en
  • resource tags

    arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
  • submitted
    28/02/2025, 22:27

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    Optimized_Pack_For_Fortnite.exe

  • Size

    13.9MB

  • MD5

    c01591910301afefce57e78471009185

  • SHA1

    a1a7d3a97204acb1a64117fba984770abc5b6d3b

  • SHA256

    041f5db0a0c289c686db8adf4a72fc70ff2ab19339f7f10b3304dee8d327e47b

  • SHA512

    74d96bae1a0047c1741482ad2910e4e1b8dc519741cd1353c784b38c94de1c68575b611976032792a630fcfe1b4e4e27b54952e33c17b3b35e75005b2b882a40

  • SSDEEP

    196608:DC/lOqPnih8FXj+hYeB0sKYu/PaQhKDnO8NpHzgsAGKaRZtG7cvdStqlK2Gv0NQa:hqPnLFCjQ8DOETgsv/Gw+6KD0U/k

Score
7/10
upx

Malware Config

Signatures

  • Loads dropped DLL 1 IoCs
  • UPX packed file 2 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Optimized_Pack_For_Fortnite.exe
    "C:\Users\Admin\AppData\Local\Temp\Optimized_Pack_For_Fortnite.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1488
    • C:\Users\Admin\AppData\Local\Temp\Optimized_Pack_For_Fortnite.exe
      "C:\Users\Admin\AppData\Local\Temp\Optimized_Pack_For_Fortnite.exe"
      2⤵
      • Loads dropped DLL
      PID:3028
  • C:\Windows\explorer.exe
    "C:\Windows\explorer.exe"
    1⤵
      PID:2780

    Network

    MITRE ATT&CK Matrix

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\_MEI14882\python310.dll
      Filesize

      1.4MB

      MD5

      69d4f13fbaeee9b551c2d9a4a94d4458

      SHA1

      69540d8dfc0ee299a7ff6585018c7db0662aa629

      SHA256

      801317463bd116e603878c7c106093ba7db2bece11e691793e93065223fc7046

      SHA512

      8e632f141daf44bc470f8ee677c6f0fdcbcacbfce1472d928576bf7b9f91d6b76639d18e386d5e1c97e538a8fe19dd2d22ea47ae1acf138a0925e3c6dd156378

      Download Submit

    • memory/3028-92-0x000007FEF5BC0000-0x000007FEF602E000-memory.dmp

      Filesize

      4.4MB

      Download