Overview
overview
10Static
static
10TeamzPAZ/B....3.dll
windows7-x64
1TeamzPAZ/B....3.dll
windows10-2004-x64
1TeamzPAZ/F...AZ.exe
windows7-x64
10TeamzPAZ/F...AZ.exe
windows10-2004-x64
10TeamzPAZ/H...ck.dll
windows7-x64
1TeamzPAZ/H...ck.dll
windows10-2004-x64
1TeamzPAZ/MailKit.dll
windows7-x64
1TeamzPAZ/MailKit.dll
windows10-2004-x64
1TeamzPAZ/N...on.dll
windows7-x64
1TeamzPAZ/N...on.dll
windows10-2004-x64
1TeamzPAZ/xNet.dll
windows7-x64
1TeamzPAZ/xNet.dll
windows10-2004-x64
1Analysis
-
max time kernel
149s -
max time network
132s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
17-06-2024 17:48
Behavioral task
behavioral1
Sample
TeamzPAZ/Bunifu_UI_v1.5.3.dll
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
TeamzPAZ/Bunifu_UI_v1.5.3.dll
Resource
win10v2004-20240508-en
Behavioral task
behavioral3
Sample
TeamzPAZ/Fortnite Checker TeamzPAZ.exe
Resource
win7-20240611-en
Behavioral task
behavioral4
Sample
TeamzPAZ/Fortnite Checker TeamzPAZ.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral5
Sample
TeamzPAZ/HtmlAgilityPack.dll
Resource
win7-20240508-en
Behavioral task
behavioral6
Sample
TeamzPAZ/HtmlAgilityPack.dll
Resource
win10v2004-20240508-en
Behavioral task
behavioral7
Sample
TeamzPAZ/MailKit.dll
Resource
win7-20240611-en
Behavioral task
behavioral8
Sample
TeamzPAZ/MailKit.dll
Resource
win10v2004-20240611-en
Behavioral task
behavioral9
Sample
TeamzPAZ/Newtonsoft.Json.dll
Resource
win7-20240221-en
Behavioral task
behavioral10
Sample
TeamzPAZ/Newtonsoft.Json.dll
Resource
win10v2004-20240611-en
Behavioral task
behavioral11
Sample
TeamzPAZ/xNet.dll
Resource
win7-20240221-en
Behavioral task
behavioral12
Sample
TeamzPAZ/xNet.dll
Resource
win10v2004-20240508-en
General
-
Target
TeamzPAZ/Fortnite Checker TeamzPAZ.exe
-
Size
203KB
-
MD5
e8b7db8bfcbb200e704b65126660c529
-
SHA1
c69450b1f8d5ccb1743570d7a8091530493fc36d
-
SHA256
24cf8b07f7694cbfc67e79dd18d6c1fab296eec76120e269f96202e43aa4340a
-
SHA512
c5913c6548e1c76518d379928d239af028d11ee419fd5af1ee9a596e4c0c32581c60228569d589c85e0c23de2c71b713ebf9f9c0f89c1520cc373bb538556973
-
SSDEEP
6144:sLV6Bta6dtJmakIM5kcGLYiO5C3e6s7338vSz:sLV6Btpmk1YiOS1k3Tz
Malware Config
Signatures
-
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
Fortnite Checker TeamzPAZ.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\DDP Host = "C:\\Program Files (x86)\\DDP Host\\ddphost.exe" Fortnite Checker TeamzPAZ.exe -
Processes:
Fortnite Checker TeamzPAZ.exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA Fortnite Checker TeamzPAZ.exe -
Drops file in Program Files directory 2 IoCs
Processes:
Fortnite Checker TeamzPAZ.exedescription ioc process File created C:\Program Files (x86)\DDP Host\ddphost.exe Fortnite Checker TeamzPAZ.exe File opened for modification C:\Program Files (x86)\DDP Host\ddphost.exe Fortnite Checker TeamzPAZ.exe -
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
Processes:
schtasks.exeschtasks.exepid process 1028 schtasks.exe 2304 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 3 IoCs
Processes:
Fortnite Checker TeamzPAZ.exepid process 4512 Fortnite Checker TeamzPAZ.exe 4512 Fortnite Checker TeamzPAZ.exe 4512 Fortnite Checker TeamzPAZ.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
Fortnite Checker TeamzPAZ.exepid process 4512 Fortnite Checker TeamzPAZ.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
Fortnite Checker TeamzPAZ.exedescription pid process Token: SeDebugPrivilege 4512 Fortnite Checker TeamzPAZ.exe Token: SeDebugPrivilege 4512 Fortnite Checker TeamzPAZ.exe -
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
Fortnite Checker TeamzPAZ.exedescription pid process target process PID 4512 wrote to memory of 1028 4512 Fortnite Checker TeamzPAZ.exe schtasks.exe PID 4512 wrote to memory of 1028 4512 Fortnite Checker TeamzPAZ.exe schtasks.exe PID 4512 wrote to memory of 1028 4512 Fortnite Checker TeamzPAZ.exe schtasks.exe PID 4512 wrote to memory of 2304 4512 Fortnite Checker TeamzPAZ.exe schtasks.exe PID 4512 wrote to memory of 2304 4512 Fortnite Checker TeamzPAZ.exe schtasks.exe PID 4512 wrote to memory of 2304 4512 Fortnite Checker TeamzPAZ.exe schtasks.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\TeamzPAZ\Fortnite Checker TeamzPAZ.exe"C:\Users\Admin\AppData\Local\Temp\TeamzPAZ\Fortnite Checker TeamzPAZ.exe"1⤵
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"schtasks.exe" /create /f /tn "DDP Host" /xml "C:\Users\Admin\AppData\Local\Temp\tmp5B3F.tmp"2⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\schtasks.exe"schtasks.exe" /create /f /tn "DDP Host Task" /xml "C:\Users\Admin\AppData\Local\Temp\tmp5BCD.tmp"2⤵
- Creates scheduled task(s)
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\tmp5B3F.tmpFilesize
1KB
MD59b41f89f066c08039443859eab9b59dc
SHA12b136b1fa13669ff9c3500f9606c0cdac3c3491d
SHA2568dded6ae15400906482f70c954d69b8fae3e5fa4ce2024159747293c7a370c42
SHA51214bef00beb49bb6703275dcf1c856ee6f5f3ba474c3b51d1af7432a814c3d0cc8c409d6229e3e26aaa08532decf3ffeab9d27c620c76f51ccc8b42543536246b
-
C:\Users\Admin\AppData\Local\Temp\tmp5BCD.tmpFilesize
1KB
MD52271642ca970891700e3f48439739ed8
SHA1cd472df2349f7db9e1e460d0ee28acd97b8a8793
SHA2567aba66abbcb0b13455609174db23aed495a9adbef0e0acd28baa9c92445eda68
SHA5124669a4ef8ec28cdb852ffc1401576b1bf9a9d837797d7d92bc88c18b3097404f36854e50167b309706fef400cabc43c876569ce2797ba85eb169a2783b8fe807
-
memory/4512-0-0x0000000074822000-0x0000000074823000-memory.dmpFilesize
4KB
-
memory/4512-1-0x0000000074820000-0x0000000074DD1000-memory.dmpFilesize
5.7MB
-
memory/4512-2-0x0000000074820000-0x0000000074DD1000-memory.dmpFilesize
5.7MB
-
memory/4512-5-0x0000000074820000-0x0000000074DD1000-memory.dmpFilesize
5.7MB
-
memory/4512-11-0x0000000074820000-0x0000000074DD1000-memory.dmpFilesize
5.7MB
-
memory/4512-12-0x0000000074822000-0x0000000074823000-memory.dmpFilesize
4KB
-
memory/4512-13-0x0000000074820000-0x0000000074DD1000-memory.dmpFilesize
5.7MB
-
memory/4512-14-0x0000000074820000-0x0000000074DD1000-memory.dmpFilesize
5.7MB