Analysis
- max time kernel
150s - max time network
130s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260710-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
09/08/2026, 07:32
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
Fortnite External.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
4 signatures
150 seconds
Behavioral task
behavioral2
Sample
Fortnite External.exe
Resource
win11ltsc2024-20260710-en
windows11-ltsc_2024-x64
4 signatures
150 seconds
General
- Target Fortnite External.exe
- Size 8.7MB
- Sample260809-jc9btsbn4s
- SHA256 886a7a86da04bf8a381e0fb1920f50132d602655e6849345b67b5d2f04fa6ec3
- MD5 8003b7eb1d13f4224ef8bdc50248c479
- SHA1 725ed3c1472c42347f59188e29288d035127a2a6
- SHA512 5ed23e55d5ccefd1f36d3c3f0639e1bf4541faa2a56c21194d060b579a1662e10c37c4ba4a266aae79f277f87039588e6eb6b7b77d6d34937e8df53db5e25fd5
- SSDEEP 98304:bfBUM21v52528IWw60orjd+bIqLChhYRliSEIpv35JuI:LyPv5d8IWfrjAMYChhYH8CJuI
- TLSH T14F969E4DAC570DDDF9CE9B386CAD72079C23B9B5162947BF4AEC09A5032A6800FD7247
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- Executes a command shell one-liner 1 TTPs 3 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 6016 cmd.exe 4764 cmd.exe 5772 cmd.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 5816 Fortnite External.exe 5816 Fortnite External.exe 5816 Fortnite External.exe 5816 Fortnite External.exe 5816 Fortnite External.exe 5816 Fortnite External.exe 5816 Fortnite External.exe 5816 Fortnite External.exe 5816 Fortnite External.exe 5816 Fortnite External.exe 5816 Fortnite External.exe 5816 Fortnite External.exe 5816 Fortnite External.exe 5816 Fortnite External.exe 5816 Fortnite External.exe 5816 Fortnite External.exe 5816 Fortnite External.exe 5816 Fortnite External.exe 5816 Fortnite External.exe 5816 Fortnite External.exe 5816 Fortnite External.exe 5816 Fortnite External.exe 5816 Fortnite External.exe 5816 Fortnite External.exe 5816 Fortnite External.exe 5816 Fortnite External.exe 5816 Fortnite External.exe 5816 Fortnite External.exe 5816 Fortnite External.exe 5816 Fortnite External.exe 5816 Fortnite External.exe 5816 Fortnite External.exe 5816 Fortnite External.exe 5816 Fortnite External.exe 5816 Fortnite External.exe 5816 Fortnite External.exe 5816 Fortnite External.exe 5816 Fortnite External.exe 5816 Fortnite External.exe 5816 Fortnite External.exe 5816 Fortnite External.exe 5816 Fortnite External.exe 5816 Fortnite External.exe 5816 Fortnite External.exe 5816 Fortnite External.exe 5816 Fortnite External.exe 5816 Fortnite External.exe 5816 Fortnite External.exe 5816 Fortnite External.exe 5816 Fortnite External.exe 5816 Fortnite External.exe 5816 Fortnite External.exe 5816 Fortnite External.exe 5816 Fortnite External.exe 5816 Fortnite External.exe 5816 Fortnite External.exe 5816 Fortnite External.exe 5816 Fortnite External.exe 5816 Fortnite External.exe 5816 Fortnite External.exe 5816 Fortnite External.exe 5816 Fortnite External.exe 5816 Fortnite External.exe 5816 Fortnite External.exe - Suspicious behavior: LoadsDriver 1 IoCs
pid Process 812 Process not Found - Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 5816 wrote to memory of 6016 5816 Fortnite External.exe 90 PID 5816 wrote to memory of 4764 5816 Fortnite External.exe 91 PID 5816 wrote to memory of 5772 5816 Fortnite External.exe 92
Processes
-
C:\Users\Admin\AppData\Local\Temp\Fortnite External.exe"C:\Users\Admin\AppData\Local\Temp\Fortnite External.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:5816 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cls2⤵
- Executes a command shell one-liner
PID:6016
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cls2⤵
- Executes a command shell one-liner
PID:4764
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cls2⤵
- Executes a command shell one-liner
PID:5772
-