Analysis
-
max time kernel
146s -
max time network
147s -
platform
windows7_x64 -
resource
win7-20240611-en -
resource tags
-
submitted
17-06-2024 17:48
General
-
Target
TeamzPAZ/Fortnite Checker TeamzPAZ.exe
-
Size
203KB
-
MD5
e8b7db8bfcbb200e704b65126660c529
-
SHA1
c69450b1f8d5ccb1743570d7a8091530493fc36d
-
SHA256
24cf8b07f7694cbfc67e79dd18d6c1fab296eec76120e269f96202e43aa4340a
-
SHA512
c5913c6548e1c76518d379928d239af028d11ee419fd5af1ee9a596e4c0c32581c60228569d589c85e0c23de2c71b713ebf9f9c0f89c1520cc373bb538556973
-
SSDEEP
6144:sLV6Bta6dtJmakIM5kcGLYiO5C3e6s7338vSz:sLV6Btpmk1YiOS1k3Tz
Malware Config
Signatures
-
NanoCore
NanoCore is a remote access tool (RAT) with a variety of capabilities.
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Checks whether UAC is enabled 1 TTPs 1 IoCs
-
Drops file in Program Files directory 2 IoCs
-
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 8 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\TeamzPAZ\Fortnite Checker TeamzPAZ.exe"C:\Users\Admin\AppData\Local\Temp\TeamzPAZ\Fortnite Checker TeamzPAZ.exe"1⤵
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"schtasks.exe" /create /f /tn "ISS Host" /xml "C:\Users\Admin\AppData\Local\Temp\tmpFD9.tmp"2⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\schtasks.exe"schtasks.exe" /create /f /tn "ISS Host Task" /xml "C:\Users\Admin\AppData\Local\Temp\tmp1066.tmp"2⤵
- Creates scheduled task(s)
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\tmp1066.tmpFilesize
1KB
MD53d1580c0395f6de62659467f5b7f1acf
SHA18e73a3885896cecca7ff799a272fc9ddfe06ea96
SHA2566f40196c42a171f24a3e16edeca664cdc5a2f7c150d468255b0e14ab10a2b714
SHA5127637c0d9b03227dffcb00a68d97ddce60bfc40ca0f8a7a4bbd700ea56be6d570908511dea5cab9f609a7da2e558e5298c482fd1e330af085f9c52867d5a847ea
-
C:\Users\Admin\AppData\Local\Temp\tmpFD9.tmpFilesize
1KB
MD59b41f89f066c08039443859eab9b59dc
SHA12b136b1fa13669ff9c3500f9606c0cdac3c3491d
SHA2568dded6ae15400906482f70c954d69b8fae3e5fa4ce2024159747293c7a370c42
SHA51214bef00beb49bb6703275dcf1c856ee6f5f3ba474c3b51d1af7432a814c3d0cc8c409d6229e3e26aaa08532decf3ffeab9d27c620c76f51ccc8b42543536246b
-
memory/2384-0-0x0000000074471000-0x0000000074472000-memory.dmpFilesize
4KB
-
memory/2384-1-0x0000000074470000-0x0000000074A1B000-memory.dmpFilesize
5.7MB
-
memory/2384-2-0x0000000074470000-0x0000000074A1B000-memory.dmpFilesize
5.7MB
-
memory/2384-10-0x0000000074470000-0x0000000074A1B000-memory.dmpFilesize
5.7MB