Analysis
- user interaction
yes - max time kernel
33s - max time network
40s - platform
windows10-2004_x64 - resource
win10v2004-20260911-en - resource tags
- submitted
11/10/2026, 16:18
General
- Target Fortnite-Titanum-Spoofer.exe
- Size 100.0MB
- Sample261011-tsahjsda97
- SHA256 d2bdead965460aad2a5df27d8d6b5212d437e045596d14bfb5d95c61bd6ecf83
Score
9/10
Malware Config
Signatures
- Enumerates VirtualBox registry keys 2 TTPs 8 IoCs
- Looks for VirtualBox Guest Additions in registry 2 TTPs 2 IoCs
- Looks for VMWare Tools registry key 2 TTPs 2 IoCs
- Looks for VMWare services registry key. 1 TTPs 2 IoCs
- Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
- Executes dropped EXE 2 IoCs
- Checks SCSI registry key(s) 3 TTPs 2 IoCs
SCSI information is often read in order to detect sandboxing environments.
- Enumerates system info in registry 2 TTPs 4 IoCs
- Suspicious behavior: EnumeratesProcesses 24 IoCs
- Suspicious use of WriteProcessMemory 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Fortnite-Titanum-Spoofer.exe"C:\Users\Admin\AppData\Local\Temp\Fortnite-Titanum-Spoofer.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\29xx30pyrrm0c2\us9rq9qafz.exeC:\Users\Admin\AppData\Local\Temp\29xx30pyrrm0c2\us9rq9qafz.exe2⤵
- Enumerates VirtualBox registry keys
- Looks for VirtualBox Guest Additions in registry
- Looks for VMWare Tools registry key
- Looks for VMWare services registry key.
- Checks BIOS information in registry
- Executes dropped EXE
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\WindowsUpdate\agent\Fortnite Spoofer.7178fb7d.exe"C:\Users\Admin\AppData\Roaming\WindowsUpdate\agent\Fortnite Spoofer.7178fb7d.exe"3⤵
- Enumerates VirtualBox registry keys
- Looks for VirtualBox Guest Additions in registry
- Looks for VMWare Tools registry key
- Looks for VMWare services registry key.
- Checks BIOS information in registry
- Executes dropped EXE
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
-
-
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
us9rq9qafz.exe
agent.log
agent.log
agent.log
agent.log
agent.log
agent.log
sandbox.log
memory/2056-7-0x00000001D3CA0000-0x00000001D3CAF000-memory.dmp
memory/2056-41-0x00000002A1770000-0x00000002A1784000-memory.dmp
memory/2056-73-0x00007FF77FEF0000-0x00007FF7827D9000-memory.dmp
memory/2100-123-0x00007FF7F6810000-0x00007FF7F90F9000-memory.dmp