Analysis
-
max time kernel
46s -
max time network
69s -
platform
windows10-2004_x64 -
resource
win10v2004-20250502-en -
resource tags
arch:x64arch:x86image:win10v2004-20250502-enlocale:en-usos:windows10-2004-x64system -
submitted
18/05/2025, 17:02
Static task
static1
General
-
Target
FortniteBurger_v2.exe
-
Size
12.1MB
-
MD5
e1727f481fd66463ed281daaeeaf675b
-
SHA1
641e44acf38b4272f2d37a824c9764fe1310b3fc
-
SHA256
7ab735a88ae95c23810f69d18ee078a19de1894d3beb1e2a512e0688d21c43bc
-
SHA512
23504a336dff888eeb9fd84d85dcf7ee434c41db8eec701473f06df06a62683a947d836b81f7a8de923b682cac769a2566870392ae5b834b9a48cb20e35e95e8
-
SSDEEP
98304:6ls29qm/Y3mDDDy/WTAjM7iHbaldePP84H+4jcFYT1iJFz8tgPv:6lZA3mDDDy/WTALOg8o+9qpiJFz8tgv
Malware Config
Signatures
-
Detect ZGRat V2 1 IoCs
resource yara_rule behavioral1/files/0x000800000002418f-58.dat family_zgrat_v2 -
Zgrat family
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-3623617754-4043701611-775564599-1000\Control Panel\International\Geo\Nation bcc73083789d4ef3911062cf77f0f0f6.exe -
Executes dropped EXE 2 IoCs
pid Process 2044 FortniteBurger_v2.exe 4420 bcc73083789d4ef3911062cf77f0f0f6.exe -
Loads dropped DLL 6 IoCs
pid Process 4072 FortniteBurger_v2.exe 4072 FortniteBurger_v2.exe 2044 FortniteBurger_v2.exe 2044 FortniteBurger_v2.exe 4420 bcc73083789d4ef3911062cf77f0f0f6.exe 4420 bcc73083789d4ef3911062cf77f0f0f6.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs 3 IoCs
flow ioc 27 raw.githubusercontent.com 28 raw.githubusercontent.com 30 raw.githubusercontent.com -
Suspicious use of NtSetInformationThreadHideFromDebugger 7 IoCs
pid Process 4420 bcc73083789d4ef3911062cf77f0f0f6.exe 4420 bcc73083789d4ef3911062cf77f0f0f6.exe 4420 bcc73083789d4ef3911062cf77f0f0f6.exe 4420 bcc73083789d4ef3911062cf77f0f0f6.exe 4420 bcc73083789d4ef3911062cf77f0f0f6.exe 4420 bcc73083789d4ef3911062cf77f0f0f6.exe 4420 bcc73083789d4ef3911062cf77f0f0f6.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3623617754-4043701611-775564599-1000_Classes\Local Settings bcc73083789d4ef3911062cf77f0f0f6.exe -
Modifies system certificate store 2 TTPs 4 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\C1D39B518B07FA46034EF27E20249D54D3E5E73F bcc73083789d4ef3911062cf77f0f0f6.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\C1D39B518B07FA46034EF27E20249D54D3E5E73F\Blob = 030000000100000014000000c1d39b518b07fa46034ef27e20249d54d3e5e73f2000000001000000930300003082038f30820277a003020102021000ec852b34650d1c829ce54e546a065b300d06092a864886f70d01010b05003060312b3029060355040b0c224372656174656420627920687474703a2f2f7777772e666964646c6572322e636f6d31183016060355040a0c0f444f5f4e4f545f54525553545f42433117301506035504030c0e466f72746e697465427572676572301e170d3235303531313030303030305a170d3335303531383137303330375a3060312b3029060355040b0c224372656174656420627920687474703a2f2f7777772e666964646c6572322e636f6d31183016060355040a0c0f444f5f4e4f545f54525553545f42433117301506035504030c0e466f72746e69746542757267657230820122300d06092a864886f70d01010105000382010f003082010a0282010100aa98e8ad3c3af6a8bd5f0f31e51324e0591fb18f5545000f28856901442806ef859eaaa950bdeb5dc43f5808cb182c95b1e26dd9c4e195a0b91a12013a440528eaf3f737e7f96ebfe5296b3f308b77b7433974ebdb33c3330570dcf15a4f468d487cce886ca74d6203dbbb0f2db2974e906fe94d95ff0eee8b293a7679ec4e8178da7ea04cc584e24f9cf9ea69cf5a0b77aca0e08fa69e7e40479132a35197a268971df4ecc52b3b7c34a648973a57829421d9341599032dab9e7d576b966cc3760a0385db87803fd676ab114d70cb71e9f83089df093f8ebdc67b5d56d4b9590a21fc3f1f249f1ce25d5a576e58192da332e913dd6cee1be61f4831351c7eb90203010001a345304330120603551d130101ff040830060101ff020100300e0603551d0f0101ff040403020204301d0603551d0e04160414bfee9f09ab65093b8e652810cbbce8f7736a9275300d06092a864886f70d01010b05000382010100117d670036e6421d4de076d104bab060ceaa3397153f3f47963cd5e1e3d64d0896a24771ca7a71ec4cb09ae2409ac4955b804f559fd4c7620166d8442b5d92cdfb7902f5847ff3920bd0a7d2aab9215b787ea7787f4ed3f985283ddf7ae2b3cc0786dce551ab53bf5e7ad470167d01a734e14bfcae42946e564fd58f2d1a44a21eeb3881a0b02071d8511d593b596f7f87fbcaf6afe4c2fbefb33a2d92b223c736539c479b5251b3263ee86a29e73ca7966e84b3e8ca06447d20d388ec7d2c26c2d288290f482f5890d9c5f9f38a8fb192e5887f2458b96850ad3aca98828529cd5ecc5120f58ce58954d8262f7f1f3aa968e170ec8e517eed8fecb90bfcf01a bcc73083789d4ef3911062cf77f0f0f6.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\C1D39B518B07FA46034EF27E20249D54D3E5E73F\Blob = 040000000100000010000000058a7a4e348673aff3efc819c4cea745140000000100000014000000bfee9f09ab65093b8e652810cbbce8f7736a9275030000000100000014000000c1d39b518b07fa46034ef27e20249d54d3e5e73f0f00000001000000200000009f4eb246671f03186186d369c88b575a681146ee8e697f3898928caa6a8e0512190000000100000010000000cd2ae34d560f5cf43cb5d087cf379ab42000000001000000930300003082038f30820277a003020102021000ec852b34650d1c829ce54e546a065b300d06092a864886f70d01010b05003060312b3029060355040b0c224372656174656420627920687474703a2f2f7777772e666964646c6572322e636f6d31183016060355040a0c0f444f5f4e4f545f54525553545f42433117301506035504030c0e466f72746e697465427572676572301e170d3235303531313030303030305a170d3335303531383137303330375a3060312b3029060355040b0c224372656174656420627920687474703a2f2f7777772e666964646c6572322e636f6d31183016060355040a0c0f444f5f4e4f545f54525553545f42433117301506035504030c0e466f72746e69746542757267657230820122300d06092a864886f70d01010105000382010f003082010a0282010100aa98e8ad3c3af6a8bd5f0f31e51324e0591fb18f5545000f28856901442806ef859eaaa950bdeb5dc43f5808cb182c95b1e26dd9c4e195a0b91a12013a440528eaf3f737e7f96ebfe5296b3f308b77b7433974ebdb33c3330570dcf15a4f468d487cce886ca74d6203dbbb0f2db2974e906fe94d95ff0eee8b293a7679ec4e8178da7ea04cc584e24f9cf9ea69cf5a0b77aca0e08fa69e7e40479132a35197a268971df4ecc52b3b7c34a648973a57829421d9341599032dab9e7d576b966cc3760a0385db87803fd676ab114d70cb71e9f83089df093f8ebdc67b5d56d4b9590a21fc3f1f249f1ce25d5a576e58192da332e913dd6cee1be61f4831351c7eb90203010001a345304330120603551d130101ff040830060101ff020100300e0603551d0f0101ff040403020204301d0603551d0e04160414bfee9f09ab65093b8e652810cbbce8f7736a9275300d06092a864886f70d01010b05000382010100117d670036e6421d4de076d104bab060ceaa3397153f3f47963cd5e1e3d64d0896a24771ca7a71ec4cb09ae2409ac4955b804f559fd4c7620166d8442b5d92cdfb7902f5847ff3920bd0a7d2aab9215b787ea7787f4ed3f985283ddf7ae2b3cc0786dce551ab53bf5e7ad470167d01a734e14bfcae42946e564fd58f2d1a44a21eeb3881a0b02071d8511d593b596f7f87fbcaf6afe4c2fbefb33a2d92b223c736539c479b5251b3263ee86a29e73ca7966e84b3e8ca06447d20d388ec7d2c26c2d288290f482f5890d9c5f9f38a8fb192e5887f2458b96850ad3aca98828529cd5ecc5120f58ce58954d8262f7f1f3aa968e170ec8e517eed8fecb90bfcf01a bcc73083789d4ef3911062cf77f0f0f6.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\C1D39B518B07FA46034EF27E20249D54D3E5E73F\Blob = 5c000000010000000400000000080000190000000100000010000000cd2ae34d560f5cf43cb5d087cf379ab40f00000001000000200000009f4eb246671f03186186d369c88b575a681146ee8e697f3898928caa6a8e0512030000000100000014000000c1d39b518b07fa46034ef27e20249d54d3e5e73f140000000100000014000000bfee9f09ab65093b8e652810cbbce8f7736a9275040000000100000010000000058a7a4e348673aff3efc819c4cea7452000000001000000930300003082038f30820277a003020102021000ec852b34650d1c829ce54e546a065b300d06092a864886f70d01010b05003060312b3029060355040b0c224372656174656420627920687474703a2f2f7777772e666964646c6572322e636f6d31183016060355040a0c0f444f5f4e4f545f54525553545f42433117301506035504030c0e466f72746e697465427572676572301e170d3235303531313030303030305a170d3335303531383137303330375a3060312b3029060355040b0c224372656174656420627920687474703a2f2f7777772e666964646c6572322e636f6d31183016060355040a0c0f444f5f4e4f545f54525553545f42433117301506035504030c0e466f72746e69746542757267657230820122300d06092a864886f70d01010105000382010f003082010a0282010100aa98e8ad3c3af6a8bd5f0f31e51324e0591fb18f5545000f28856901442806ef859eaaa950bdeb5dc43f5808cb182c95b1e26dd9c4e195a0b91a12013a440528eaf3f737e7f96ebfe5296b3f308b77b7433974ebdb33c3330570dcf15a4f468d487cce886ca74d6203dbbb0f2db2974e906fe94d95ff0eee8b293a7679ec4e8178da7ea04cc584e24f9cf9ea69cf5a0b77aca0e08fa69e7e40479132a35197a268971df4ecc52b3b7c34a648973a57829421d9341599032dab9e7d576b966cc3760a0385db87803fd676ab114d70cb71e9f83089df093f8ebdc67b5d56d4b9590a21fc3f1f249f1ce25d5a576e58192da332e913dd6cee1be61f4831351c7eb90203010001a345304330120603551d130101ff040830060101ff020100300e0603551d0f0101ff040403020204301d0603551d0e04160414bfee9f09ab65093b8e652810cbbce8f7736a9275300d06092a864886f70d01010b05000382010100117d670036e6421d4de076d104bab060ceaa3397153f3f47963cd5e1e3d64d0896a24771ca7a71ec4cb09ae2409ac4955b804f559fd4c7620166d8442b5d92cdfb7902f5847ff3920bd0a7d2aab9215b787ea7787f4ed3f985283ddf7ae2b3cc0786dce551ab53bf5e7ad470167d01a734e14bfcae42946e564fd58f2d1a44a21eeb3881a0b02071d8511d593b596f7f87fbcaf6afe4c2fbefb33a2d92b223c736539c479b5251b3263ee86a29e73ca7966e84b3e8ca06447d20d388ec7d2c26c2d288290f482f5890d9c5f9f38a8fb192e5887f2458b96850ad3aca98828529cd5ecc5120f58ce58954d8262f7f1f3aa968e170ec8e517eed8fecb90bfcf01a bcc73083789d4ef3911062cf77f0f0f6.exe -
Suspicious behavior: EnumeratesProcesses 24 IoCs
pid Process 4420 bcc73083789d4ef3911062cf77f0f0f6.exe 4420 bcc73083789d4ef3911062cf77f0f0f6.exe 4420 bcc73083789d4ef3911062cf77f0f0f6.exe 4420 bcc73083789d4ef3911062cf77f0f0f6.exe 4420 bcc73083789d4ef3911062cf77f0f0f6.exe 4420 bcc73083789d4ef3911062cf77f0f0f6.exe 4420 bcc73083789d4ef3911062cf77f0f0f6.exe 4420 bcc73083789d4ef3911062cf77f0f0f6.exe 4420 bcc73083789d4ef3911062cf77f0f0f6.exe 4420 bcc73083789d4ef3911062cf77f0f0f6.exe 4420 bcc73083789d4ef3911062cf77f0f0f6.exe 4420 bcc73083789d4ef3911062cf77f0f0f6.exe 4420 bcc73083789d4ef3911062cf77f0f0f6.exe 4420 bcc73083789d4ef3911062cf77f0f0f6.exe 4420 bcc73083789d4ef3911062cf77f0f0f6.exe 4420 bcc73083789d4ef3911062cf77f0f0f6.exe 4420 bcc73083789d4ef3911062cf77f0f0f6.exe 4420 bcc73083789d4ef3911062cf77f0f0f6.exe 4420 bcc73083789d4ef3911062cf77f0f0f6.exe 4420 bcc73083789d4ef3911062cf77f0f0f6.exe 4420 bcc73083789d4ef3911062cf77f0f0f6.exe 4420 bcc73083789d4ef3911062cf77f0f0f6.exe 4420 bcc73083789d4ef3911062cf77f0f0f6.exe 4420 bcc73083789d4ef3911062cf77f0f0f6.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 4420 bcc73083789d4ef3911062cf77f0f0f6.exe -
Suspicious use of FindShellTrayWindow 4 IoCs
pid Process 4420 bcc73083789d4ef3911062cf77f0f0f6.exe 4420 bcc73083789d4ef3911062cf77f0f0f6.exe 4420 bcc73083789d4ef3911062cf77f0f0f6.exe 4420 bcc73083789d4ef3911062cf77f0f0f6.exe -
Suspicious use of SendNotifyMessage 4 IoCs
pid Process 4420 bcc73083789d4ef3911062cf77f0f0f6.exe 4420 bcc73083789d4ef3911062cf77f0f0f6.exe 4420 bcc73083789d4ef3911062cf77f0f0f6.exe 4420 bcc73083789d4ef3911062cf77f0f0f6.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 1904 OpenWith.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 4072 wrote to memory of 2044 4072 FortniteBurger_v2.exe 90 PID 4072 wrote to memory of 2044 4072 FortniteBurger_v2.exe 90 PID 2044 wrote to memory of 4420 2044 FortniteBurger_v2.exe 91 PID 2044 wrote to memory of 4420 2044 FortniteBurger_v2.exe 91
Processes
-
C:\Users\Admin\AppData\Local\Temp\FortniteBurger_v2.exe"C:\Users\Admin\AppData\Local\Temp\FortniteBurger_v2.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:4072 -
C:\Users\Admin\AppData\Local\FortniteBurger2\Run\FortniteBurger_v2.exe"C:\Users\Admin\AppData\Local\FortniteBurger2\Run\FortniteBurger_v2.exe" --continue2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2044 -
C:\Users\Admin\AppData\Local\FortniteBurger2\Run\bcc73083789d4ef3911062cf77f0f0f6.exe"C:\Users\Admin\AppData\Local\FortniteBurger2\Run\bcc73083789d4ef3911062cf77f0f0f6.exe" --continue3⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Modifies registry class
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:4420
-
-
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
- Suspicious use of SetWindowsHookEx
PID:1904
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
588KB
MD584e6bd98e70d333ea1186bf123930781
SHA1a4eb740e713cfe5650ce2b86c1b4b219822d19df
SHA2565cf88cff4dfcce99457e26bb87d4e1e885747d7e54ee24df2e731b79893be388
SHA51254aa8a7bf4be7cad3e5e1c67ed9f6403592382b45ebe75b7898687b2818921d7fc0e97de69041265c864172590f3175ac9e1ced81c0ab9fbd7abef601b7bc0f6
-
Filesize
12.1MB
MD5e1727f481fd66463ed281daaeeaf675b
SHA1641e44acf38b4272f2d37a824c9764fe1310b3fc
SHA2567ab735a88ae95c23810f69d18ee078a19de1894d3beb1e2a512e0688d21c43bc
SHA51223504a336dff888eeb9fd84d85dcf7ee434c41db8eec701473f06df06a62683a947d836b81f7a8de923b682cac769a2566870392ae5b834b9a48cb20e35e95e8
-
Filesize
12.1MB
MD517811026ab6ada96515b958286d69eaf
SHA1c133865230d9d670edeee90688c49d577a38c6a5
SHA256a1e6277d87881c2109438af85fa21ff12c399c0b8b3c54b06f742ae3c51db938
SHA512cbbb56e1bc29fc7b6d59d10aedbcda5697c408f39166ef874d991f1b8edbd8ad2efcc1bed147656589edec6abb6deb4b606c1b7fa45355b26425c565ba141a46
-
C:\Users\Admin\AppData\Local\Temp\.net\FortniteBurger_v2\jG4I8EjH2Uht_bQwKhDNlmHg04VYWFo=\svchost.dll
Filesize522KB
MD5d34da837298440c94597fc11e35d8eac
SHA1074c8a4eebaff81019bce8eb5f25efdc54d7400c
SHA256e0b0c4da536b40be97aa04da748bc64b28c19ef7898f053c8e9f07db9fd7559a
SHA512bdf5ce3e07118773aaa7d6ff75ac3c5e71263e612da3c691d25d225f66a16fd8f8089d41a466e04e5677b1288ee4b1719eb200f5ed5c5c1dc05c49a59561b501
-
Filesize
2KB
MD53cd6a58a453dce2cf18c22e58e16ab57
SHA199f5a00d4b9add52100602e1bad473c5c81bde1f
SHA25692bfcd9bcdd45a4ea4e0e9f58e83503854c5e681ccd19d1c0e4529f33091bf6e
SHA512661b009954226062e0079dacddc3132ab6f13ed91a00f9d1482930e78a24feb0c51add77c71749b765612fe2735ed5b5c41d004c8cc397a4cec0eefb5a8ce5cd
-
Filesize
2KB
MD52cb51f0857e95ad6fe402ae7cb23b6d7
SHA19d2eedc7403c9c13c2ceb40bc821d83265219d81
SHA256fe39523c06c8e5a6d0a8a489f2b3f051f4e665200b264168c28339f6938820d5
SHA512ee893dd1d3e576be0b1a76ad7ccc2ab10ad2e3cab8c82ac8248d855cac062864a0dc1dd7940f9bb50250d995e103ea6daf5050a484f6967cd184117a6eaf20cc