Analysis
- user interaction
yes - max time kernel
24s - max time network
16s - platform
windows10-2004_x64 - resource
win10v2004-20260911-en - resource tags
arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
13/11/2026, 08:56
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
dogmanfortnite.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
4 signatures
150 seconds
Behavioral task
behavioral2
Sample
dogmanfortnite.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
1 signatures
150 seconds
General
- Target dogmanfortnite.exe
- Size 410KB
- Sample261113-kv5xsshx21
- SHA256 4e4e8e82b12d7ee43eb4ac12e2a001e28947c7c150b6440385cd92e9d557f758
- MD5 530969614b9040b01f3b53a036f2f9ad
- SHA1 7c77c5d05e5e2af1e79fba080f20db337586eac2
- SHA512 6df2de04e24aec544a4812e3c67c711873093cadcac855e8d3aa102b43fce27a4e2924b369355132be1821d95e2ab25db27909094b5d740b6c8ef9b40639ef66
- SSDEEP 6144:/bKbGSluQc9lNPX6J9wSsa8+5HCm3k46f8jUamF9cnvplUO2R:/+GkJ9IIU4iiCdJ
- TLSH T1BC948E58EFA408F6D5B7813CCDA38506EB72BC9A476297CB13945A662F233D05E3E710
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
- Drops file in Program Files directory 2 IoCs
description ioc Process File created C:\Program Files (x86)\Kaspersky Lab\Kaspersky Antivirus 21.3\office_antivirus.dll dogmanfortnite.exe File opened for modification C:\Program Files (x86)\Kaspersky Lab dogmanfortnite.exe - Modifies registry class 16 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{57C3D834-F47B-46BA-9924-83C2873B0686}\ = "OA_ComAntivirus Class" dogmanfortnite.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{57C3D834-F47B-46BA-9924-83C2873B0686}\Implemented Categories\{56FFCC30-D398-11D0-B2AE-00A0C908FA49} dogmanfortnite.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4B770032-31CA-43B1-AB0D-32C5FE2F82FA}\Version dogmanfortnite.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4B770032-31CA-43B1-AB0D-32C5FE2F82FA}\Version\ = "1.0" dogmanfortnite.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{57C3D834-F47B-46BA-9924-83C2873B0686} dogmanfortnite.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{57C3D834-F47B-46BA-9924-83C2873B0686}\InprocServer32\ = "C:\\Program Files (x86)\\Kaspersky Lab\\Kaspersky Antivirus 21.3\\office_antivirus.dll" dogmanfortnite.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{57C3D834-F47B-46BA-9924-83C2873B0686}\Version dogmanfortnite.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4B770032-31CA-43B1-AB0D-32C5FE2F82FA}\ = "AMSI_ComAntivirus Class" dogmanfortnite.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4B770032-31CA-43B1-AB0D-32C5FE2F82FA}\InprocServer32 dogmanfortnite.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{57C3D834-F47B-46BA-9924-83C2873B0686}\InprocServer32 dogmanfortnite.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{57C3D834-F47B-46BA-9924-83C2873B0686}\Version\ = "1.0" dogmanfortnite.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4B770032-31CA-43B1-AB0D-32C5FE2F82FA}\InprocServer32\ThreadingModel = "Both" dogmanfortnite.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{57C3D834-F47B-46BA-9924-83C2873B0686}\Implemented Categories dogmanfortnite.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{57C3D834-F47B-46BA-9924-83C2873B0686}\InprocServer32\ThreadingModel = "Apartment" dogmanfortnite.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4B770032-31CA-43B1-AB0D-32C5FE2F82FA} dogmanfortnite.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4B770032-31CA-43B1-AB0D-32C5FE2F82FA}\InprocServer32\ = "C:\\Program Files (x86)\\Kaspersky Lab\\Kaspersky Antivirus 21.3\\office_antivirus.dll" dogmanfortnite.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4712 dogmanfortnite.exe 4712 dogmanfortnite.exe 4712 dogmanfortnite.exe 4712 dogmanfortnite.exe 4712 dogmanfortnite.exe 4712 dogmanfortnite.exe 4712 dogmanfortnite.exe 4712 dogmanfortnite.exe 4712 dogmanfortnite.exe 4712 dogmanfortnite.exe 4712 dogmanfortnite.exe 4712 dogmanfortnite.exe 4712 dogmanfortnite.exe 4712 dogmanfortnite.exe 4712 dogmanfortnite.exe 4712 dogmanfortnite.exe 4712 dogmanfortnite.exe 4712 dogmanfortnite.exe 4712 dogmanfortnite.exe 4712 dogmanfortnite.exe 4712 dogmanfortnite.exe 4712 dogmanfortnite.exe 4712 dogmanfortnite.exe 4712 dogmanfortnite.exe 4712 dogmanfortnite.exe 4712 dogmanfortnite.exe 4712 dogmanfortnite.exe 4712 dogmanfortnite.exe 4712 dogmanfortnite.exe 4712 dogmanfortnite.exe 4712 dogmanfortnite.exe 4712 dogmanfortnite.exe 4712 dogmanfortnite.exe 4712 dogmanfortnite.exe 4712 dogmanfortnite.exe 4712 dogmanfortnite.exe 4712 dogmanfortnite.exe 4712 dogmanfortnite.exe 4712 dogmanfortnite.exe 4712 dogmanfortnite.exe 4712 dogmanfortnite.exe 4712 dogmanfortnite.exe 4712 dogmanfortnite.exe 4712 dogmanfortnite.exe 4712 dogmanfortnite.exe 4712 dogmanfortnite.exe 4712 dogmanfortnite.exe 4712 dogmanfortnite.exe 4712 dogmanfortnite.exe 4712 dogmanfortnite.exe 4712 dogmanfortnite.exe 4712 dogmanfortnite.exe 4712 dogmanfortnite.exe 4712 dogmanfortnite.exe 4712 dogmanfortnite.exe 4712 dogmanfortnite.exe 4712 dogmanfortnite.exe 4712 dogmanfortnite.exe 4712 dogmanfortnite.exe 4712 dogmanfortnite.exe 4712 dogmanfortnite.exe 4712 dogmanfortnite.exe 4712 dogmanfortnite.exe 4712 dogmanfortnite.exe