24:I[7638,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/3l_wb6il5gi_h.js","/_next/static/chunks/136wug8odqdqr.js"],"SampleDetailWrapper"] 4c:I[27201,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js"],"IconMark"] 23:T48a,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Trojan.Agent Sample afb24fab9c0b… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample afb24fab9c0b…. Malware family: Trojan.Agent. Threat score 100/100. 21/28 AV engines flagged this file. 14 malicious and 25 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/afb24fab9c0b0f9e60d81bd7fd2d7999c842bf00b5bb9e0bf7347e36eacafad7","keywords":["Malicious","Trojan.Agent","malware analysis","sandbox report","threat intelligence","afb24fab9c0b0f9e60d81bd7fd2d7999c842bf00b5bb9e0bf7347e36eacafad7"],"about":{"@type":"SoftwareApplication","name":"Client.exe","applicationCategory":["peexe","assembly","executable"],"identifier":"afb24fab9c0b0f9e60d81bd7fd2d7999c842bf00b5bb9e0bf7347e36eacafad7","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Trojan.Agent","antivirusDetections":{"malicious":21,"total":28},"behavioralIndicators":{"malicious":14,"suspicious":25},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}25:T46a,Found string "SOFTWARE\Microsoft\Windows\CurrentVersion\Run" (Indicator: "software\microsoft\windows\currentversion\run"; in Source: "sample.bin"), Found string "SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run" (Indicator: "software\wow6432node\microsoft\windows\currentversion\run"; in Source: "sample.bin"), Found string "SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce" (Indicator: "software\microsoft\windows\currentversion\run"; in Source: "sample.bin"), Found string "SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce" (Indicator: "software\microsoft\windows\currentversion\runonce"; in Source: "sample.bin"), Found string "SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce" (Indicator: "software\wow6432node\microsoft\windows\currentversion\run"; in Source: "sample.bin"), Found string "SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce" (Indicator: "software\wow6432node\microsoft\windows\currentversion\runonce"; in Source: "sample.bin"), Found string "Software\Microsoft\Windows\CurrentVersion\Run" (Indicator: "software\microsoft\windows\currentversion\run"; in Source: "sample.bin")26:Tb6d,Found reference to API "Bundle already contains a key with a keyId for the passed in ring." (Indicator: "read"; Source: "sample.bin"), Found reference to API "Cannot register new digest OIDs after the data stream is opened" (Indicator: "open"; Source: "sample.bin"), Found reference to API "ReadString" (Indicator: "read"; Source: "sample.bin"), Found reference to API "WriteUInt64" (Indicator: "write"; Source: "sample.bin"), Found reference to API "PBEwithMD5and256bitAES-CBC-OpenSSL" (Indicator: "open"; Source: "sample.bin"), Found reference to API "Timestamp could not be parsed" (Indicator: "time"; Source: "sample.bin"), Found reference to API "Timestamp could not be parsed" (Indicator: "times"; Source: "sample.bin"), Found reference to API "Cannot write a " (Indicator: "write"; Source: "sample.bin"), Found reference to API "countSmallPrimes must be >= 30 for security reasons" (Indicator: "security"; Source: "sample.bin"), Found reference to API "Cannot configure new digests after the data stream is opened" (Indicator: "open"; Source: "sample.bin"), Found reference to API "created badly formatted response!" (Indicator: "creat"; Source: "sample.bin"), Found reference to API "Log created on " (Indicator: "creat"; Source: "sample.bin"), Found reference to API "CreateBuilder" (Indicator: "creat"; Source: "sample.bin"), Found reference to API "BraveSoftware\Brave-Browser\User Data\Local State" (Indicator: "stat"; Source: "sample.bin"), Found reference to API "exception reading compressed stream." (Indicator: "read"; Source: "sample.bin"), Found reference to API "Cannot use ReadInput() in blocking mode! Use Stream instead." (Indicator: "read"; Source: "sample.bin"), Found reference to API "RenamePath No permission" (Indicator: "rename"; Source: "sample.bin"), Found reference to API "Validation already attempted for round 3 payload for " (Indicator: "read"; Source: "sample.bin"), Found reference to API "The writer is in an incomplete state" (Indicator: "stat"; Source: "sample.bin"), Found reference to API "The writer is in an incomplete state" (Indicator: "write"; Source: "sample.bin"), Found reference to API "EXPORTER-Token-Binding" (Indicator: "bind"; Source: "sample.bin"), Found reference to API "error creating signature." (Indicator: "creat"; Source: "sample.bin"), Found reference to API "unknown object passed to Time" (Indicator: "time"; Source: "sample.bin"), Found reference to API ".bcl.TimeSpan" (Indicator: "time"; Source: "sample.bin"), Found reference to API ".bcl.TimeSpan" (Indicator: "times"; Source: "sample.bin"), Found reference to API "Cannot rename value: Error writing to the registry" (Indicator: "rename"; Source: "sample.bin"), Found reference to API "ThrowCannotCreateInstance" (Indicator: "creat"; Source: "sample.bin"), Found reference to API "dateTime" (Indicator: "time"; Source: "sample.bin")27:Ta9f,Found string "error recovering GOST3410_94 public key" (Indicator: "public key"; Source: "sample.bin"), Found string "Public key of issuer certificate of CRL could not be retrieved." (Indicator: "public key"; Source: "sample.bin"), Found string "Infinity is not a valid public key for ECDHC" (Indicator: "public key"; Source: "sample.bin"), Found string "EOF encountered in middle of Ed448 public key" (Indicator: "public key"; Source: "sample.bin"), Found string "OID is not a valid CryptoPro public key parameter set" (Indicator: "public key"; Source: "sample.bin"), Found string "RSA parameters should be for a public key" (Indicator: "public key"; Source: "sample.bin"), Found string "Expected private key" (Indicator: "private key"; Source: "sample.bin"), Found string "Invalid y for GOST3410 public key" (Indicator: "public key"; Source: "sample.bin"), Found string "Attribute certificate issuer is also a public key certificate issuer." (Indicator: "public key"; Source: "sample.bin"), Found string "Expected a private key" (Indicator: "private key"; Source: "sample.bin"), Found string "algorithm identifier in public key not recognised: " (Indicator: "public key"; Source: "sample.bin"), Found string "ECDHC public key has wrong domain parameters" (Indicator: "public key"; Source: "sample.bin"), Found string "cannot extract MQV ephemeral public key: " (Indicator: "public key"; Source: "sample.bin"), Found string "error recovering GOST3410_2012 public key" (Indicator: "public key"; Source: "sample.bin"), Found string "Expected public key" (Indicator: "public key"; Source: "sample.bin"), Found string "[PRIVATE KEY LOCATION: "{0}"]" (Indicator: "private key"; Source: "sample.bin"), Found string "invalid length for GOST3410_2012 public key" (Indicator: "public key"; Source: "sample.bin"), Found string "EOF encountered in middle of Ed25519 private key" (Indicator: "private key"; Source: "sample.bin"), Found string "Expected RSA private key" (Indicator: "private key"; Source: "sample.bin"), Found string "Public key certificate for attribute certificate cannot be searched." (Indicator: "public key"; Source: "sample.bin"), Found string "Public key certificate specified in base certificate ID for attribute certificate cannot be found." (Indicator: "public key"; Source: "sample.bin"), Found string "invalid length for GOST3410_2001 public key" (Indicator: "public key"; Source: "sample.bin"), Found string "EOF encountered in middle of Ed448 private key" (Indicator: "private key"; Source: "sample.bin"), Found string "error recovering GOST3410_2001 public key" (Indicator: "public key"; Source: "sample.bin"), Found string " Trusted CA Public Key: " (Indicator: "public key"; Source: "sample.bin")28:T7df,Found string "SHA3-256WITHECDSA" (Indicator: "ecdsa"; Source: "sample.bin"), Found string "withCVC-ECDSA" (Indicator: "ecdsa"; Source: "sample.bin"), Found string "PBEwithMD5and256bitAES-CBC-OpenSSL" (Indicator: "aes"; Source: "sample.bin"), Found string "SHA-512WITHPLAIN-ECDSA" (Indicator: "ecdsa"; Source: "sample.bin"), Found string "can't mix ECDSA with anything but SHA family digests" (Indicator: "ecdsa"; Source: "sample.bin"), Found string "SHA-384WITHECDSA" (Indicator: "ecdsa"; Source: "sample.bin"), Found string "CVC-ECDSAWITHSHA384" (Indicator: "ecdsa"; Source: "sample.bin"), Found string "SHA1/ECDSA" (Indicator: "ecdsa"; Source: "sample.bin"), Found string "SHA-384withECDSA" (Indicator: "ecdsa"; Source: "sample.bin"), Found string "SHA-1/CVC-ECDSA" (Indicator: "ecdsa"; Source: "sample.bin"), Found string "ECDSAWITHSHA512" (Indicator: "ecdsa"; Source: "sample.bin"), Found string "PLAIN-ECDSAWITHSHA-256" (Indicator: "ecdsa"; Source: "sample.bin"), Found string "exception decoding URL safe base64 string: " (Indicator: "base64"; Source: "sample.bin"), Found string "invalid parameter passed to AES init - " (Indicator: "aes"; Source: "sample.bin"), Found string "SHA3-384WITHECDSA" (Indicator: "ecdsa"; Source: "sample.bin"), Found string "PLAIN-ECDSAWITHSHA-224" (Indicator: "ecdsa"; Source: "sample.bin"), Found string "SHA-1withCVC-ECDSA" (Indicator: "ecdsa"; Source: "sample.bin"), Found string "AESCMAC" (Indicator: "aes"; Source: "sample.bin"), Found string "SHA1WITHCVC-ECDSA" (Indicator: "ecdsa"; Source: "sample.bin"), Found string "PLAIN-ECDSAWITHSHA1" (Indicator: "ecdsa"; Source: "sample.bin"), Found string "SHA-256/ECDSA" (Indicator: "ecdsa"; Source: "sample.bin"), Found string "SHA256/CVC-ECDSA" (Indicator: "ecdsa"; Source: "sample.bin"), Found string "SHA-512/CVC-ECDSA" (Indicator: "ecdsa"; Source: "sample.bin"), Found string "SHA-384WITHPLAIN-ECDSA" (Indicator: "ecdsa"; Source: "sample.bin"), Found string "SHA224WITHPLAIN-ECDSA" (Indicator: "ecdsa"; Source: "sample.bin")29:T553,"BraveSoftware\Brave-Browser\User Data\Local State" (Indicator: "bravesoftware\brave-browser\user data") in Source: sample.bin, "Opera Software\Opera GX Stable\Login Data" (Indicator: "opera software\opera gx stable\login data") in Source: sample.bin, "Yandex\YandexBrowser\User Data\Default\Ya Passman Data" (Indicator: "yandex\yandexbrowser\user data") in Source: sample.bin, "Microsoft\Edge\User Data\Default\Login Data" (Indicator: "microsoft\edge\user data") in Source: sample.bin, "Yandex\YandexBrowser\User Data\Local State" (Indicator: "yandex\yandexbrowser\user data") in Source: sample.bin, "Google\Chrome\User Data\Default\Login Data" (Indicator: "google\chrome\user data") in Source: sample.bin, "Opera Software\Opera Stable\Login Data" (Indicator: "opera software\opera stable\login data") in Source: sample.bin, "Microsoft\Edge\User Data\Local State" (Indicator: "microsoft\edge\user data") in Source: sample.bin, "BraveSoftware\Brave-Browser\User Data\Default\Login Data" (Indicator: "bravesoftware\brave-browser\user data") in Source: sample.bin, "Mozilla\Firefox\Profiles" (Indicator: "mozilla\firefox\") in Source: sample.bin, "Google\Chrome\User Data\Local State" (Indicator: "google\chrome\user data") in Source: sample.bin, "Opera Software\Opera Stable\Local State" (Indicator: "opera software\opera stable\local state") in Source: sample.bin2a:T8a1,Found reference to "SHA512WITHXMSSMT" (Indicator: "SHA512"; Source: "sample.bin"), Found reference to "HMAC-SHA3-384" (Indicator: "HMAC"; Source: "sample.bin"), Found reference to "SHA512(256)" (Indicator: "SHA512"; Source: "sample.bin"), Found reference to "CVC-ECDSAWITHSHA384" (Indicator: "SHA384"; Source: "sample.bin"), Found reference to "SHA384WITHECNR" (Indicator: "SHA384"; Source: "sample.bin"), Found reference to "ECDSAWITHSHA512" (Indicator: "SHA512"; Source: "sample.bin"), Found reference to "RC2MAC" (Indicator: "RC2"; Source: "sample.bin"), Found reference to "HMAC-SHA384" (Indicator: "HMAC"; Source: "sample.bin"), Found reference to "HMAC-SHA384" (Indicator: "SHA384"; Source: "sample.bin"), Found reference to "PBEWITHHMACSHA" (Indicator: "HMAC"; Source: "sample.bin"), Found reference to "HMAC" (Indicator: "HMAC"; Source: "sample.bin"), Found reference to "RC2MAC/CFB8" (Indicator: "RC2"; Source: "sample.bin"), Found reference to "PBEWITHHMACSHA-224" (Indicator: "HMAC"; Source: "sample.bin"), Found reference to "PBEWITHHMACTIGER" (Indicator: "HMAC"; Source: "sample.bin"), Found reference to "SHA512WITHRSA/PSS" (Indicator: "SHA512"; Source: "sample.bin"), Found reference to "HMAC-MD5" (Indicator: "HMAC"; Source: "sample.bin"), Found reference to "PBEwithMD5andRC2-CBC" (Indicator: "RC2"; Source: "sample.bin"), Found reference to "PBEWITHHMACSHA1" (Indicator: "HMAC"; Source: "sample.bin"), Found reference to "PBEWITHHMACSHA1" (Indicator: "HMACSHA1"; Source: "sample.bin"), Found reference to "signatureAndHashAlgorithm" (Indicator: "HashAlgorithm"; Source: "sample.bin"), Found reference to "HashAlgorithm." (Indicator: "HashAlgorithm"; Source: "sample.bin"), Found reference to "PBEWITHHMACSHA-256" (Indicator: "HMAC"; Source: "sample.bin"), Found reference to "HMAC-SHA256" (Indicator: "HMAC"; Source: "sample.bin"), Found reference to "HMAC-SHA224" (Indicator: "HMAC"; Source: "sample.bin"), Found reference to "CVC-ECDSAWITHSHA512" (Indicator: "SHA512"; Source: "sample.bin"), Found reference to "SHA384WITHRSASSA-PSS" (Indicator: "SHA384"; Source: "sample.bin"), Found reference to "HKDF parameters required for HkdfBytesGenerator" (Indicator: "HKDF"; Source: "sample.bin")2b:Ta47,Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "SizeOf" in "afb24fab9c0b0f9e60d81bd7fd2d7999c842bf00b5bb9e0bf7347e36eacafad7" Observed namespace "System.IO.MemoryStream" and TypeReference ".ctor" in "afb24fab9c0b0f9e60d81bd7fd2d7999c842bf00b5bb9e0bf7347e36eacafad7" Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "GetDelegateForFunctionPointer" in "afb24fab9c0b0f9e60d81bd7fd2d7999c842bf00b5bb9e0bf7347e36eacafad7" Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "AllocHGlobal" in "afb24fab9c0b0f9e60d81bd7fd2d7999c842bf00b5bb9e0bf7347e36eacafad7" Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "Copy" in "afb24fab9c0b0f9e60d81bd7fd2d7999c842bf00b5bb9e0bf7347e36eacafad7" Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "FreeHGlobal" in "afb24fab9c0b0f9e60d81bd7fd2d7999c842bf00b5bb9e0bf7347e36eacafad7" Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "PtrToStructure" in "afb24fab9c0b0f9e60d81bd7fd2d7999c842bf00b5bb9e0bf7347e36eacafad7" Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "GetLastWin32Error" in "afb24fab9c0b0f9e60d81bd7fd2d7999c842bf00b5bb9e0bf7347e36eacafad7" Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "ReleaseComObject" in "afb24fab9c0b0f9e60d81bd7fd2d7999c842bf00b5bb9e0bf7347e36eacafad7" Observed namespace "System.IO.MemoryStream" and TypeReference "ToArray" in "afb24fab9c0b0f9e60d81bd7fd2d7999c842bf00b5bb9e0bf7347e36eacafad7" Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "AllocCoTaskMem" in "afb24fab9c0b0f9e60d81bd7fd2d7999c842bf00b5bb9e0bf7347e36eacafad7" Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "StructureToPtr" in "afb24fab9c0b0f9e60d81bd7fd2d7999c842bf00b5bb9e0bf7347e36eacafad7" Observed namespace "System.IO.MemoryStream" and TypeReference "GetBuffer" in "afb24fab9c0b0f9e60d81bd7fd2d7999c842bf00b5bb9e0bf7347e36eacafad7" Observed namespace "System.IO.MemoryStream" and TypeReference "Dispose" in "afb24fab9c0b0f9e60d81bd7fd2d7999c842bf00b5bb9e0bf7347e36eacafad7" Observed namespace "System.IO.MemoryStream" and TypeReference "WriteTo" in "afb24fab9c0b0f9e60d81bd7fd2d7999c842bf00b5bb9e0bf7347e36eacafad7" Observed namespace "System.IO.MemoryStream" and TypeReference "get_Capacity" in "afb24fab9c0b0f9e60d81bd7fd2d7999c842bf00b5bb9e0bf7347e36eacafad7" Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "SizeOf" in "fortnitemap.exe.bin"2c:Tee5,Observed namespace "System.Security.Cryptography.RSACryptoServiceProvider" and TypeReference "VerifyHash" in "afb24fab9c0b0f9e60d81bd7fd2d7999c842bf00b5bb9e0bf7347e36eacafad7" Observed namespace "System.Security.Cryptography.DSA" and TypeReference "ExportParameters" in "afb24fab9c0b0f9e60d81bd7fd2d7999c842bf00b5bb9e0bf7347e36eacafad7" Observed namespace "System.Security.Cryptography.DSAParameters" and TypeReference "Seed" in "afb24fab9c0b0f9e60d81bd7fd2d7999c842bf00b5bb9e0bf7347e36eacafad7" Observed namespace "System.Security.Cryptography.DSAParameters" and TypeReference "Counter" in "afb24fab9c0b0f9e60d81bd7fd2d7999c842bf00b5bb9e0bf7347e36eacafad7" Observed namespace "System.Security.Cryptography.DSAParameters" and TypeReference "P" in "afb24fab9c0b0f9e60d81bd7fd2d7999c842bf00b5bb9e0bf7347e36eacafad7" Observed namespace "System.Security.Cryptography.DSAParameters" and TypeReference "Q" in "afb24fab9c0b0f9e60d81bd7fd2d7999c842bf00b5bb9e0bf7347e36eacafad7" Observed namespace "System.Security.Cryptography.DSAParameters" and TypeReference "G" in "afb24fab9c0b0f9e60d81bd7fd2d7999c842bf00b5bb9e0bf7347e36eacafad7" Observed namespace "System.Security.Cryptography.DSAParameters" and TypeReference "Y" in "afb24fab9c0b0f9e60d81bd7fd2d7999c842bf00b5bb9e0bf7347e36eacafad7" Observed namespace "System.Security.Cryptography.DSAParameters" and TypeReference "X" in "afb24fab9c0b0f9e60d81bd7fd2d7999c842bf00b5bb9e0bf7347e36eacafad7" Observed namespace "System.Security.Cryptography.RSA" and TypeReference "ExportParameters" in "afb24fab9c0b0f9e60d81bd7fd2d7999c842bf00b5bb9e0bf7347e36eacafad7" Observed namespace "System.Security.Cryptography.RSAParameters" and TypeReference "Modulus" in "afb24fab9c0b0f9e60d81bd7fd2d7999c842bf00b5bb9e0bf7347e36eacafad7" Observed namespace "System.Security.Cryptography.RSAParameters" and TypeReference "Exponent" in "afb24fab9c0b0f9e60d81bd7fd2d7999c842bf00b5bb9e0bf7347e36eacafad7" Observed namespace "System.Security.Cryptography.RSAParameters" and TypeReference "D" in "afb24fab9c0b0f9e60d81bd7fd2d7999c842bf00b5bb9e0bf7347e36eacafad7" Observed namespace "System.Security.Cryptography.RSAParameters" and TypeReference "P" in "afb24fab9c0b0f9e60d81bd7fd2d7999c842bf00b5bb9e0bf7347e36eacafad7" Observed namespace "System.Security.Cryptography.RSAParameters" and TypeReference "Q" in "afb24fab9c0b0f9e60d81bd7fd2d7999c842bf00b5bb9e0bf7347e36eacafad7" Observed namespace "System.Security.Cryptography.RSAParameters" and TypeReference "DP" in "afb24fab9c0b0f9e60d81bd7fd2d7999c842bf00b5bb9e0bf7347e36eacafad7" Observed namespace "System.Security.Cryptography.RSAParameters" and TypeReference "DQ" in "afb24fab9c0b0f9e60d81bd7fd2d7999c842bf00b5bb9e0bf7347e36eacafad7" Observed namespace "System.Security.Cryptography.RSAParameters" and TypeReference "InverseQ" in "afb24fab9c0b0f9e60d81bd7fd2d7999c842bf00b5bb9e0bf7347e36eacafad7" Observed namespace "System.Security.Cryptography.RSACryptoServiceProvider" and TypeReference ".ctor" in "afb24fab9c0b0f9e60d81bd7fd2d7999c842bf00b5bb9e0bf7347e36eacafad7" Observed namespace "System.Security.Cryptography.RSA" and TypeReference "ImportParameters" in "afb24fab9c0b0f9e60d81bd7fd2d7999c842bf00b5bb9e0bf7347e36eacafad7" Observed namespace "System.Security.Cryptography.RSACryptoServiceProvider" and TypeReference "VerifyHash" in "fortnitemap.exe.bin" Observed namespace "System.Security.Cryptography.DSA" and TypeReference "ExportParameters" in "fortnitemap.exe.bin" Observed namespace "System.Security.Cryptography.DSAParameters" and TypeReference "Seed" in "fortnitemap.exe.bin" Observed namespace "System.Security.Cryptography.DSAParameters" and TypeReference "Counter" in "fortnitemap.exe.bin" Observed namespace "System.Security.Cryptography.DSAParameters" and TypeReference "P" in "fortnitemap.exe.bin"2d:T56a,The analysis contains indicators for cyrpto or data obfuscation(base64/decrypt) which can hide information. Matched sigs: Contains CRYPTO related strings Matched sigs: Contains ability to use Cryptographic classes Matched sigs: Contains ability to perform AES/RC4 encryption (API string) Matched sigs: Contains key cryptographic functions (API string) Matched sigs: Contains ability to import cryptographic keys (seen in ransomware) Matched sigs: Contains ability to perform Base64 encoding/decoding Matched sigs: Contains reference to cryptographic keys Matched sigs: Contains ability to use Microsoft's Enhanced Cryptographic Provider Matched sigs: Contains ability to perform decryption (API string) Matched sigs: Reads the cryptographic machine GUID Matched sigs: Contains ability to decode string content at runtime (Dotnet) Matched sigs: Contains ability to perform symmetric crypto operations Matched sigs: Contains ability to perform crypto operations Matched sigs: Dotnet file contains encryption/decryption functions Matched sigs: Contains ability to perform CryptoStream operations (Dotnet) Matched sigs: YARA signature match - AES encryption Matched sigs: Contains ability to perform asymmetric crypto operations Matched sigs: Contains ability to perform symmetric encryption (Dotnet) Matched sigs: Contains ability to perform symmetric decryption (Dotnet)2e:T4d5,Found string "SELECT * FROM Win32_BIOS" (Indicator: "select * from "; File: "afb24fab9c0b0f9e60d81bd7fd2d7999c842bf00b5bb9e0bf7347e36eacafad7") Found string "SELECT * FROM Win32_BaseBoard" (Indicator: "select * from "; File: "afb24fab9c0b0f9e60d81bd7fd2d7999c842bf00b5bb9e0bf7347e36eacafad7") Found string "SELECT * FROM Win32_Processor" (Indicator: "select * from "; File: "afb24fab9c0b0f9e60d81bd7fd2d7999c842bf00b5bb9e0bf7347e36eacafad7") Found string "Select * From Win32_ComputerSystem" (Indicator: "select * from "; File: "afb24fab9c0b0f9e60d81bd7fd2d7999c842bf00b5bb9e0bf7347e36eacafad7") Found string "SELECT * FROM Win32_DisplayConfiguration" (Indicator: "select * from "; File: "afb24fab9c0b0f9e60d81bd7fd2d7999c842bf00b5bb9e0bf7347e36eacafad7") Found string "SELECT * FROM Win32_OperatingSystem WHERE Primary='true'" (Indicator: "select * from "; File: "afb24fab9c0b0f9e60d81bd7fd2d7999c842bf00b5bb9e0bf7347e36eacafad7") Found string "SELECT * FROM AntivirusProduct" (Indicator: "select * from "; File: "afb24fab9c0b0f9e60d81bd7fd2d7999c842bf00b5bb9e0bf7347e36eacafad7") Found string "SELECT * FROM FirewallProduct" (Indicator: "select * from "; File: "afb24fab9c0b0f9e60d81bd7fd2d7999c842bf00b5bb9e0bf7347e36eacafad7")2f:T36ee,"afb24fab9c0b0f9e60d81bd7fd2d7999c842bf00b5bb9e0bf7347e36eacafad7.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00003644) "afb24fab9c0b0f9e60d81bd7fd2d7999c842bf00b5bb9e0bf7347e36eacafad7.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00003644) "afb24fab9c0b0f9e60d81bd7fd2d7999c842bf00b5bb9e0bf7347e36eacafad7.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00003644) "afb24fab9c0b0f9e60d81bd7fd2d7999c842bf00b5bb9e0bf7347e36eacafad7.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00003644) "afb24fab9c0b0f9e60d81bd7fd2d7999c842bf00b5bb9e0bf7347e36eacafad7.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00003644) "afb24fab9c0b0f9e60d81bd7fd2d7999c842bf00b5bb9e0bf7347e36eacafad7.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00003644) "afb24fab9c0b0f9e60d81bd7fd2d7999c842bf00b5bb9e0bf7347e36eacafad7.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00003644) "afb24fab9c0b0f9e60d81bd7fd2d7999c842bf00b5bb9e0bf7347e36eacafad7.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00003644) "afb24fab9c0b0f9e60d81bd7fd2d7999c842bf00b5bb9e0bf7347e36eacafad7.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00003644) "afb24fab9c0b0f9e60d81bd7fd2d7999c842bf00b5bb9e0bf7347e36eacafad7.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00003644) "afb24fab9c0b0f9e60d81bd7fd2d7999c842bf00b5bb9e0bf7347e36eacafad7.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00003644) "afb24fab9c0b0f9e60d81bd7fd2d7999c842bf00b5bb9e0bf7347e36eacafad7.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00003644) "afb24fab9c0b0f9e60d81bd7fd2d7999c842bf00b5bb9e0bf7347e36eacafad7.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00003644) "afb24fab9c0b0f9e60d81bd7fd2d7999c842bf00b5bb9e0bf7347e36eacafad7.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00003644) "afb24fab9c0b0f9e60d81bd7fd2d7999c842bf00b5bb9e0bf7347e36eacafad7.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00003644) "afb24fab9c0b0f9e60d81bd7fd2d7999c842bf00b5bb9e0bf7347e36eacafad7.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00003644) "afb24fab9c0b0f9e60d81bd7fd2d7999c842bf00b5bb9e0bf7347e36eacafad7.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00003644) "afb24fab9c0b0f9e60d81bd7fd2d7999c842bf00b5bb9e0bf7347e36eacafad7.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00003644) "afb24fab9c0b0f9e60d81bd7fd2d7999c842bf00b5bb9e0bf7347e36eacafad7.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00003644) "afb24fab9c0b0f9e60d81bd7fd2d7999c842bf00b5bb9e0bf7347e36eacafad7.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00003644) "afb24fab9c0b0f9e60d81bd7fd2d7999c842bf00b5bb9e0bf7347e36eacafad7.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00003644) "afb24fab9c0b0f9e60d81bd7fd2d7999c842bf00b5bb9e0bf7347e36eacafad7.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00003644) "afb24fab9c0b0f9e60d81bd7fd2d7999c842bf00b5bb9e0bf7347e36eacafad7.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00003644) "afb24fab9c0b0f9e60d81bd7fd2d7999c842bf00b5bb9e0bf7347e36eacafad7.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00003644) "afb24fab9c0b0f9e60d81bd7fd2d7999c842bf00b5bb9e0bf7347e36eacafad7.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00003644) "afb24fab9c0b0f9e60d81bd7fd2d7999c842bf00b5bb9e0bf7347e36eacafad7.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00003644) "afb24fab9c0b0f9e60d81bd7fd2d7999c842bf00b5bb9e0bf7347e36eacafad7.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00003644) "afb24fab9c0b0f9e60d81bd7fd2d7999c842bf00b5bb9e0bf7347e36eacafad7.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00003644) "afb24fab9c0b0f9e60d81bd7fd2d7999c842bf00b5bb9e0bf7347e36eacafad7.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00003644) "afb24fab9c0b0f9e60d81bd7fd2d7999c842bf00b5bb9e0bf7347e36eacafad7.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00003644) "afb24fab9c0b0f9e60d81bd7fd2d7999c842bf00b5bb9e0bf7347e36eacafad7.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00003644) "afb24fab9c0b0f9e60d81bd7fd2d7999c842bf00b5bb9e0bf7347e36eacafad7.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00003644) "afb24fab9c0b0f9e60d81bd7fd2d7999c842bf00b5bb9e0bf7347e36eacafad7.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00003644) "afb24fab9c0b0f9e60d81bd7fd2d7999c842bf00b5bb9e0bf7347e36eacafad7.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00003644) "afb24fab9c0b0f9e60d81bd7fd2d7999c842bf00b5bb9e0bf7347e36eacafad7.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00003644) "afb24fab9c0b0f9e60d81bd7fd2d7999c842bf00b5bb9e0bf7347e36eacafad7.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00003644) "afb24fab9c0b0f9e60d81bd7fd2d7999c842bf00b5bb9e0bf7347e36eacafad7.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00003644) "afb24fab9c0b0f9e60d81bd7fd2d7999c842bf00b5bb9e0bf7347e36eacafad7.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00003644) "afb24fab9c0b0f9e60d81bd7fd2d7999c842bf00b5bb9e0bf7347e36eacafad7.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00003644) "afb24fab9c0b0f9e60d81bd7fd2d7999c842bf00b5bb9e0bf7347e36eacafad7.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00003644) "afb24fab9c0b0f9e60d81bd7fd2d7999c842bf00b5bb9e0bf7347e36eacafad7.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00003644) "afb24fab9c0b0f9e60d81bd7fd2d7999c842bf00b5bb9e0bf7347e36eacafad7.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00003644) "afb24fab9c0b0f9e60d81bd7fd2d7999c842bf00b5bb9e0bf7347e36eacafad7.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00003644) "afb24fab9c0b0f9e60d81bd7fd2d7999c842bf00b5bb9e0bf7347e36eacafad7.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00003644) "afb24fab9c0b0f9e60d81bd7fd2d7999c842bf00b5bb9e0bf7347e36eacafad7.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00003644) "afb24fab9c0b0f9e60d81bd7fd2d7999c842bf00b5bb9e0bf7347e36eacafad7.exe" called "GetProcAddress" with a parameter GetExitCodeProcess (UID: 00000000-00003644) "afb24fab9c0b0f9e60d81bd7fd2d7999c842bf00b5bb9e0bf7347e36eacafad7.exe" called "GetProcAddress" with a parameter GetExitCodeProcessW (UID: 00000000-00003644) "afb24fab9c0b0f9e60d81bd7fd2d7999c842bf00b5bb9e0bf7347e36eacafad7.exe" called "GetProcAddress" with a parameter EventRegister (UID: 00000000-00003644) "afb24fab9c0b0f9e60d81bd7fd2d7999c842bf00b5bb9e0bf7347e36eacafad7.exe" called "GetProcAddress" with a parameter EventSetInformation (UID: 00000000-00003644) "afb24fab9c0b0f9e60d81bd7fd2d7999c842bf00b5bb9e0bf7347e36eacafad7.exe" called "GetProcAddress" with a parameter GetWindowThreadProcessId (UID: 00000000-00003644) "afb24fab9c0b0f9e60d81bd7fd2d7999c842bf00b5bb9e0bf7347e36eacafad7.exe" called "GetProcAddress" with a parameter PostMessage (UID: 00000000-00003644) "afb24fab9c0b0f9e60d81bd7fd2d7999c842bf00b5bb9e0bf7347e36eacafad7.exe" called "GetProcAddress" with a parameter PostMessageW (UID: 00000000-00003644) "afb24fab9c0b0f9e60d81bd7fd2d7999c842bf00b5bb9e0bf7347e36eacafad7.exe" called "GetProcAddress" with a parameter OleInitialize (UID: 00000000-00003644) "afb24fab9c0b0f9e60d81bd7fd2d7999c842bf00b5bb9e0bf7347e36eacafad7.exe" called "GetProcAddress" with a parameter CoRegisterMessageFilter (UID: 00000000-00003644) "afb24fab9c0b0f9e60d81bd7fd2d7999c842bf00b5bb9e0bf7347e36eacafad7.exe" called "GetProcAddress" with a parameter PeekMessage (UID: 00000000-00003644) "afb24fab9c0b0f9e60d81bd7fd2d7999c842bf00b5bb9e0bf7347e36eacafad7.exe" called "GetProcAddress" with a parameter PeekMessageW (UID: 00000000-00003644) "afb24fab9c0b0f9e60d81bd7fd2d7999c842bf00b5bb9e0bf7347e36eacafad7.exe" called "GetProcAddress" with a parameter IsWindowUnicode (UID: 00000000-00003644) "afb24fab9c0b0f9e60d81bd7fd2d7999c842bf00b5bb9e0bf7347e36eacafad7.exe" called "GetProcAddress" with a parameter GetMessageW (UID: 00000000-00003644) "afb24fab9c0b0f9e60d81bd7fd2d7999c842bf00b5bb9e0bf7347e36eacafad7.exe" called "GetProcAddress" with a parameter TranslateMessage (UID: 00000000-00003644) "afb24fab9c0b0f9e60d81bd7fd2d7999c842bf00b5bb9e0bf7347e36eacafad7.exe" called "GetProcAddress" with a parameter DispatchMessageW (UID: 00000000-00003644) "afb24fab9c0b0f9e60d81bd7fd2d7999c842bf00b5bb9e0bf7347e36eacafad7.exe" called "GetProcAddress" with a parameter WaitMessage (UID: 00000000-00003644) "afb24fab9c0b0f9e60d81bd7fd2d7999c842bf00b5bb9e0bf7347e36eacafad7.exe" called "GetProcAddress" with a parameter PostThreadMessage (UID: 00000000-00003644) "afb24fab9c0b0f9e60d81bd7fd2d7999c842bf00b5bb9e0bf7347e36eacafad7.exe" called "GetProcAddress" with a parameter PostThreadMessageW (UID: 00000000-00003644) "afb24fab9c0b0f9e60d81bd7fd2d7999c842bf00b5bb9e0bf7347e36eacafad7.exe" called "GetProcAddress" with a parameter GetMessageA (UID: 00000000-00003644) "afb24fab9c0b0f9e60d81bd7fd2d7999c842bf00b5bb9e0bf7347e36eacafad7.exe" called "GetProcAddress" with a parameter DestroyIcon (UID: 00000000-00003644) "afb24fab9c0b0f9e60d81bd7fd2d7999c842bf00b5bb9e0bf7347e36eacafad7.exe" called "GetProcAddress" with a parameter IsWindowVisible (UID: 00000000-00003644) "afb24fab9c0b0f9e60d81bd7fd2d7999c842bf00b5bb9e0bf7347e36eacafad7.exe" called "GetProcAddress" with a parameter GetCurrentThreadId (UID: 00000000-00003644) "afb24fab9c0b0f9e60d81bd7fd2d7999c842bf00b5bb9e0bf7347e36eacafad7.exe" called "GetProcAddress" with a parameter OleUninitialize (UID: 00000000-00003644) "afb24fab9c0b0f9e60d81bd7fd2d7999c842bf00b5bb9e0bf7347e36eacafad7.exe" called "GetProcAddress" with a parameter CloseHandle (UID: 00000000-00003644) "afb24fab9c0b0f9e60d81bd7fd2d7999c842bf00b5bb9e0bf7347e36eacafad7.exe" called "GetProcAddress" with a parameter CoGetContextToken (UID: 00000000-00003644) "afb24fab9c0b0f9e60d81bd7fd2d7999c842bf00b5bb9e0bf7347e36eacafad7.exe" called "GetProcAddress" with a parameter SetClassLongPtr (UID: 00000000-00003644) "afb24fab9c0b0f9e60d81bd7fd2d7999c842bf00b5bb9e0bf7347e36eacafad7.exe" called "GetProcAddress" with a parameter SetClassLongPtrW (UID: 00000000-00003644) "afb24fab9c0b0f9e60d81bd7fd2d7999c842bf00b5bb9e0bf7347e36eacafad7.exe" called "GetProcAddress" with a parameter UnregisterClass (UID: 00000000-00003644) "afb24fab9c0b0f9e60d81bd7fd2d7999c842bf00b5bb9e0bf7347e36eacafad7.exe" called "GetProcAddress" with a parameter UnregisterClassW (UID: 00000000-00003644) "afb24fab9c0b0f9e60d81bd7fd2d7999c842bf00b5bb9e0bf7347e36eacafad7.exe" called "GetProcAddress" with a parameter IsWindow (UID: 00000000-00003644) "afb24fab9c0b0f9e60d81bd7fd2d7999c842bf00b5bb9e0bf7347e36eacafad7.exe" called "GetProcAddress" with a parameter GetProcAddress (UID: 00000000-00003644) "afb24fab9c0b0f9e60d81bd7fd2d7999c842bf00b5bb9e0bf7347e36eacafad7.exe" called "GetProcAddress" with a parameter DefWindowProcW (UID: 00000000-00003644) "afb24fab9c0b0f9e60d81bd7fd2d7999c842bf00b5bb9e0bf7347e36eacafad7.exe" called "GetProcAddress" with a parameter SetWindowLongPtr (UID: 00000000-00003644) "afb24fab9c0b0f9e60d81bd7fd2d7999c842bf00b5bb9e0bf7347e36eacafad7.exe" called "GetProcAddress" with a parameter SetWindowLongPtrW (UID: 00000000-00003644) "afb24fab9c0b0f9e60d81bd7fd2d7999c842bf00b5bb9e0bf7347e36eacafad7.exe" called "GetProcAddress" with a parameter DestroyWindow (UID: 00000000-00003644) "afb24fab9c0b0f9e60d81bd7fd2d7999c842bf00b5bb9e0bf7347e36eacafad7.exe" called "GetProcAddress" with a parameter DestroyWindowW (UID: 00000000-00003644) "afb24fab9c0b0f9e60d81bd7fd2d7999c842bf00b5bb9e0bf7347e36eacafad7.exe" called "GetProcAddress" with a parameter EventUnregister (UID: 00000000-00003644) "afb24fab9c0b0f9e60d81bd7fd2d7999c842bf00b5bb9e0bf7347e36eacafad7.exe" called "GetProcAddress" with a parameter CertFreeCertificateContext (UID: 00000000-00003644) "afb24fab9c0b0f9e60d81bd7fd2d7999c842bf00b5bb9e0bf7347e36eacafad7.exe" called "GetProcAddress" with a parameter CreateActCtxW (UID: 00000000-00003644) "afb24fab9c0b0f9e60d81bd7fd2d7999c842bf00b5bb9e0bf7347e36eacafad7.exe" called "GetProcAddress" with a parameter AddRefActCtx (UID: 00000000-00003644) "afb24fab9c0b0f9e60d81bd7fd2d7999c842bf00b5bb9e0bf7347e36eacafad7.exe" called "GetProcAddress" with a parameter ReleaseActCtx (UID: 00000000-00003644) "afb24fab9c0b0f9e60d81bd7fd2d7999c842bf00b5bb9e0bf7347e36eacafad7.exe" called "GetProcAddress" with a parameter ActivateActCtx (UID: 00000000-00003644) "afb24fab9c0b0f9e60d81bd7fd2d7999c842bf00b5bb9e0bf7347e36eacafad7.exe" called "GetProcAddress" with a parameter DeactivateActCtx (UID: 00000000-00003644) "afb24fab9c0b0f9e60d81bd7fd2d7999c842bf00b5bb9e0bf7347e36eacafad7.exe" called "GetProcAddress" with a parameter GetCurrentActCtx (UID: 00000000-00003644) "afb24fab9c0b0f9e60d81bd7fd2d7999c842bf00b5bb9e0bf7347e36eacafad7.exe" called "GetProcAddress" with a parameter QueryActCtxW (UID: 00000000-00003644)30:T5c6,Found reference to API (Indicator: "CreateDC"; File: "afb24fab9c0b0f9e60d81bd7fd2d7999c842bf00b5bb9e0bf7347e36eacafad7") Found reference to API (Indicator: "DeleteDC"; File: "afb24fab9c0b0f9e60d81bd7fd2d7999c842bf00b5bb9e0bf7347e36eacafad7") Found reference to API (Indicator: "CryptHashData"; File: "afb24fab9c0b0f9e60d81bd7fd2d7999c842bf00b5bb9e0bf7347e36eacafad7") Found reference to API (Indicator: "GetCurrentThreadId"; File: "afb24fab9c0b0f9e60d81bd7fd2d7999c842bf00b5bb9e0bf7347e36eacafad7") Found reference to API (Indicator: "GetWindowThreadProcessId"; File: "afb24fab9c0b0f9e60d81bd7fd2d7999c842bf00b5bb9e0bf7347e36eacafad7") Found reference to API (Indicator: "GetProcessById"; File: "afb24fab9c0b0f9e60d81bd7fd2d7999c842bf00b5bb9e0bf7347e36eacafad7") Found reference to API (Indicator: "SeDebugPrivilege"; Source: "00000000-00003644.00000000.98170.029D0000.00000004.mdmp, 00000000-00003644.00000001.100092.029D0000.00000004.mdmp, 00000000-00003644.00000002.102012.029D0000.00000004.mdmp") Found reference to API (Indicator: "CryptImportKey"; Source: "00000000-00003644.00000000.98170.029D0000.00000004.mdmp, 00000000-00003644.00000001.100092.029D0000.00000004.mdmp, 00000000-00003644.00000002.102012.029D0000.00000004.mdmp") Found reference to API (Indicator: "CryptDecrypt"; Source: "00000000-00003644.00000000.98170.029D0000.00000004.mdmp, 00000000-00003644.00000001.100092.029D0000.00000004.mdmp, 00000000-00003644.00000002.102012.029D0000.00000004.mdmp")31:T410,Observed namespace "Microsoft.Win32.RegistryKey" and TypeReference "SetValue" in "afb24fab9c0b0f9e60d81bd7fd2d7999c842bf00b5bb9e0bf7347e36eacafad7" Observed namespace "Microsoft.Win32.RegistryKey" and TypeReference "DeleteValue" in "afb24fab9c0b0f9e60d81bd7fd2d7999c842bf00b5bb9e0bf7347e36eacafad7" Observed namespace "Microsoft.Win32.RegistryKey" and TypeReference "CreateSubKey" in "afb24fab9c0b0f9e60d81bd7fd2d7999c842bf00b5bb9e0bf7347e36eacafad7" Observed namespace "Microsoft.Win32.RegistryKey" and TypeReference "DeleteSubKeyTree" in "afb24fab9c0b0f9e60d81bd7fd2d7999c842bf00b5bb9e0bf7347e36eacafad7" Observed namespace "Microsoft.Win32.RegistryKey" and TypeReference "SetValue" in "fortnitemap.exe.bin" Observed namespace "Microsoft.Win32.RegistryKey" and TypeReference "DeleteValue" in "fortnitemap.exe.bin" Observed namespace "Microsoft.Win32.RegistryKey" and TypeReference "CreateSubKey" in "fortnitemap.exe.bin" Observed namespace "Microsoft.Win32.RegistryKey" and TypeReference "DeleteSubKeyTree" in "fortnitemap.exe.bin"32:T614,Observed namespace "Microsoft.Win32.RegistryKey" and TypeReference "GetSubKeyNames" in "afb24fab9c0b0f9e60d81bd7fd2d7999c842bf00b5bb9e0bf7347e36eacafad7" Observed namespace "Microsoft.Win32.RegistryKey" and TypeReference "GetValueNames" in "afb24fab9c0b0f9e60d81bd7fd2d7999c842bf00b5bb9e0bf7347e36eacafad7" Observed namespace "Microsoft.Win32.RegistryKey" and TypeReference "GetValueKind" in "afb24fab9c0b0f9e60d81bd7fd2d7999c842bf00b5bb9e0bf7347e36eacafad7" Observed namespace "Microsoft.Win32.RegistryKey" and TypeReference "GetValue" in "afb24fab9c0b0f9e60d81bd7fd2d7999c842bf00b5bb9e0bf7347e36eacafad7" Observed namespace "Microsoft.Win32.RegistryKey" and TypeReference "OpenBaseKey" in "afb24fab9c0b0f9e60d81bd7fd2d7999c842bf00b5bb9e0bf7347e36eacafad7" Observed namespace "Microsoft.Win32.RegistryKey" and TypeReference "OpenSubKey" in "afb24fab9c0b0f9e60d81bd7fd2d7999c842bf00b5bb9e0bf7347e36eacafad7" Observed namespace "Microsoft.Win32.RegistryKey" and TypeReference "GetSubKeyNames" in "fortnitemap.exe.bin" Observed namespace "Microsoft.Win32.RegistryKey" and TypeReference "GetValueNames" in "fortnitemap.exe.bin" Observed namespace "Microsoft.Win32.RegistryKey" and TypeReference "GetValueKind" in "fortnitemap.exe.bin" Observed namespace "Microsoft.Win32.RegistryKey" and TypeReference "GetValue" in "fortnitemap.exe.bin" Observed namespace "Microsoft.Win32.RegistryKey" and TypeReference "OpenBaseKey" in "fortnitemap.exe.bin" Observed namespace "Microsoft.Win32.RegistryKey" and TypeReference "OpenSubKey" in "fortnitemap.exe.bin"33:Tb53,Observed unmanaged function "LoadLibrary" in "afb24fab9c0b0f9e60d81bd7fd2d7999c842bf00b5bb9e0bf7347e36eacafad7" Observed unmanaged function "FreeLibrary" in "afb24fab9c0b0f9e60d81bd7fd2d7999c842bf00b5bb9e0bf7347e36eacafad7" Observed unmanaged function "GetProcAddress" in "afb24fab9c0b0f9e60d81bd7fd2d7999c842bf00b5bb9e0bf7347e36eacafad7" Observed unmanaged function "QueryFullProcessImageName" in "afb24fab9c0b0f9e60d81bd7fd2d7999c842bf00b5bb9e0bf7347e36eacafad7" Observed unmanaged function "BitBlt" in "afb24fab9c0b0f9e60d81bd7fd2d7999c842bf00b5bb9e0bf7347e36eacafad7" Observed unmanaged function "CreateDC" in "afb24fab9c0b0f9e60d81bd7fd2d7999c842bf00b5bb9e0bf7347e36eacafad7" Observed unmanaged function "DeleteDC" in "afb24fab9c0b0f9e60d81bd7fd2d7999c842bf00b5bb9e0bf7347e36eacafad7" Observed unmanaged function "GetLastInputInfo" in "afb24fab9c0b0f9e60d81bd7fd2d7999c842bf00b5bb9e0bf7347e36eacafad7" Observed unmanaged function "SetCursorPos" in "afb24fab9c0b0f9e60d81bd7fd2d7999c842bf00b5bb9e0bf7347e36eacafad7" Observed unmanaged function "GetMessageExtraInfo" in "afb24fab9c0b0f9e60d81bd7fd2d7999c842bf00b5bb9e0bf7347e36eacafad7" Observed unmanaged function "SendInput" in "afb24fab9c0b0f9e60d81bd7fd2d7999c842bf00b5bb9e0bf7347e36eacafad7" Observed unmanaged function "SystemParametersInfo" in "afb24fab9c0b0f9e60d81bd7fd2d7999c842bf00b5bb9e0bf7347e36eacafad7" Observed unmanaged function "PostMessage" in "afb24fab9c0b0f9e60d81bd7fd2d7999c842bf00b5bb9e0bf7347e36eacafad7" Observed unmanaged function "OpenDesktop" in "afb24fab9c0b0f9e60d81bd7fd2d7999c842bf00b5bb9e0bf7347e36eacafad7" Observed unmanaged function "CloseDesktop" in "afb24fab9c0b0f9e60d81bd7fd2d7999c842bf00b5bb9e0bf7347e36eacafad7" Observed unmanaged function "EnumDesktopWindows" in "afb24fab9c0b0f9e60d81bd7fd2d7999c842bf00b5bb9e0bf7347e36eacafad7" Observed unmanaged function "IsWindowVisible" in "afb24fab9c0b0f9e60d81bd7fd2d7999c842bf00b5bb9e0bf7347e36eacafad7" Observed unmanaged function "GetForegroundWindow" in "afb24fab9c0b0f9e60d81bd7fd2d7999c842bf00b5bb9e0bf7347e36eacafad7" Observed unmanaged function "GetWindowText" in "afb24fab9c0b0f9e60d81bd7fd2d7999c842bf00b5bb9e0bf7347e36eacafad7" Observed unmanaged function "GetExtendedTcpTable" in "afb24fab9c0b0f9e60d81bd7fd2d7999c842bf00b5bb9e0bf7347e36eacafad7" Observed unmanaged function "SetTcpEntry" in "afb24fab9c0b0f9e60d81bd7fd2d7999c842bf00b5bb9e0bf7347e36eacafad7" Observed unmanaged function "CryptAcquireContext" in "afb24fab9c0b0f9e60d81bd7fd2d7999c842bf00b5bb9e0bf7347e36eacafad7" Observed unmanaged function "CryptCreateHash" in "afb24fab9c0b0f9e60d81bd7fd2d7999c842bf00b5bb9e0bf7347e36eacafad7" Observed unmanaged function "CryptHashData" in "afb24fab9c0b0f9e60d81bd7fd2d7999c842bf00b5bb9e0bf7347e36eacafad7" Observed unmanaged function "CryptDestroyHash" in "afb24fab9c0b0f9e60d81bd7fd2d7999c842bf00b5bb9e0bf7347e36eacafad7"34:T414,"SELECT Caption FROM Win32_OperatingSystem" (Source: afb24fab9c0b0f9e60d81bd7fd2d7999c842bf00b5bb9e0bf7347e36eacafad7, Indicator: "select caption from win32_operatingsystem") "SELECT * FROM Win32_BIOS" (Source: 6000239-_~_, Indicator: "select * from win32_bios") "SELECT * FROM Win32_BaseBoard" (Source: 600023a-_~_, Indicator: "select * from win32_baseboard") "SELECT * FROM Win32_Processor" (Source: 600023b-_~_, Indicator: "select * from win32_processor") "Select * From Win32_ComputerSystem" (Source: 600023c-_~_, Indicator: "select * from win32_computersystem") "SELECT * FROM Win32_DisplayConfiguration" (Source: 600023d-_~_, Indicator: "select * from win32_displayconfiguration") "SELECT * FROM Win32_OperatingSystem WHERE Primary='true'" (Source: 6000269-_~_, Indicator: "select * from win32_operatingsystem where primary='true'") "SELECT * FROM AntivirusProduct" (Source: 600026b-_~_, Indicator: "select * from antivirusproduct") "SELECT * FROM FirewallProduct" (Source: 600026c-_~_, Indicator: "select * from firewallproduct")35:T94f,"afb24fab9c0b0f9e60d81bd7fd2d7999c842bf00b5bb9e0bf7347e36eacafad7" file has an entrypoint instructions - "jmp dword ptr [0x402000],add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al," "fortnitemap.exe.bin" file has an entrypoint instructions - "jmp dword ptr [0x402000],add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,"36:T923,"afb24fab9c0b0f9e60d81bd7fd2d7999c842bf00b5bb9e0bf7347e36eacafad7.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\RPC"; Key: ""; Value: "") "afb24fab9c0b0f9e60d81bd7fd2d7999c842bf00b5bb9e0bf7347e36eacafad7.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\COMPUTERNAME\ACTIVECOMPUTERNAME"; Key: ""; Value: "") "afb24fab9c0b0f9e60d81bd7fd2d7999c842bf00b5bb9e0bf7347e36eacafad7.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\SETUP"; Key: ""; Value: "") "afb24fab9c0b0f9e60d81bd7fd2d7999c842bf00b5bb9e0bf7347e36eacafad7.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\AFB24FAB9C0B0F9E60D81BD7FD2D7999C842BF00B5BB9E0BF7347E36EACAFAD7.EXE"; Key: ""; Value: "") "afb24fab9c0b0f9e60d81bd7fd2d7999c842bf00b5bb9e0bf7347e36eacafad7.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS NT\RPC"; Key: ""; Value: "") "afb24fab9c0b0f9e60d81bd7fd2d7999c842bf00b5bb9e0bf7347e36eacafad7.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER\SEGMENT HEAP"; Key: ""; Value: "") "afb24fab9c0b0f9e60d81bd7fd2d7999c842bf00b5bb9e0bf7347e36eacafad7.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: ""; Value: "") "afb24fab9c0b0f9e60d81bd7fd2d7999c842bf00b5bb9e0bf7347e36eacafad7.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: ""; Value: "") "afb24fab9c0b0f9e60d81bd7fd2d7999c842bf00b5bb9e0bf7347e36eacafad7.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SAFEBOOT\OPTION"; Key: ""; Value: "") "afb24fab9c0b0f9e60d81bd7fd2d7999c842bf00b5bb9e0bf7347e36eacafad7.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SRP\GP\DLL"; Key: ""; Value: "") "afb24fab9c0b0f9e60d81bd7fd2d7999c842bf00b5bb9e0bf7347e36eacafad7.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: ""; Value: "") "afb24fab9c0b0f9e60d81bd7fd2d7999c842bf00b5bb9e0bf7347e36eacafad7.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: ""; Value: "") "afb24fab9c0b0f9e60d81bd7fd2d7999c842bf00b5bb9e0bf7347e36eacafad7.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\FILESYSTEM"; Key: ""; Value: "")37:Tcee,"afb24fab9c0b0f9e60d81bd7fd2d7999c842bf00b5bb9e0bf7347e36eacafad7.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\RPC"; Key: "MAXRPCSIZE"; Value: "") "afb24fab9c0b0f9e60d81bd7fd2d7999c842bf00b5bb9e0bf7347e36eacafad7.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\COMPUTERNAME\ACTIVECOMPUTERNAME"; Key: "COMPUTERNAME"; Value: "") "afb24fab9c0b0f9e60d81bd7fd2d7999c842bf00b5bb9e0bf7347e36eacafad7.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\SETUP"; Key: "OOBEINPROGRESS"; Value: "") "afb24fab9c0b0f9e60d81bd7fd2d7999c842bf00b5bb9e0bf7347e36eacafad7.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\SETUP"; Key: "SYSTEMSETUPINPROGRESS"; Value: "") "afb24fab9c0b0f9e60d81bd7fd2d7999c842bf00b5bb9e0bf7347e36eacafad7.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\RPC"; Key: "IDLETIMERWINDOW"; Value: "") "afb24fab9c0b0f9e60d81bd7fd2d7999c842bf00b5bb9e0bf7347e36eacafad7.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: "RESOURCEPOLICIES"; Value: "") "afb24fab9c0b0f9e60d81bd7fd2d7999c842bf00b5bb9e0bf7347e36eacafad7.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: ""; Value: "") "afb24fab9c0b0f9e60d81bd7fd2d7999c842bf00b5bb9e0bf7347e36eacafad7.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED"; Value: "") "afb24fab9c0b0f9e60d81bd7fd2d7999c842bf00b5bb9e0bf7347e36eacafad7.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\FILESYSTEM"; Key: "LONGPATHSENABLED"; Value: "") "afb24fab9c0b0f9e60d81bd7fd2d7999c842bf00b5bb9e0bf7347e36eacafad7.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\.NETFRAMEWORK"; Key: "INSTALLROOT"; Value: "") "afb24fab9c0b0f9e60d81bd7fd2d7999c842bf00b5bb9e0bf7347e36eacafad7.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\.NETFRAMEWORK"; Key: "CLRLOADLOGDIR"; Value: "") "afb24fab9c0b0f9e60d81bd7fd2d7999c842bf00b5bb9e0bf7347e36eacafad7.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\LSA\FIPSALGORITHMPOLICY"; Key: "ENABLED"; Value: "") "afb24fab9c0b0f9e60d81bd7fd2d7999c842bf00b5bb9e0bf7347e36eacafad7.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\LSA"; Key: "FIPSALGORITHMPOLICY"; Value: "") "afb24fab9c0b0f9e60d81bd7fd2d7999c842bf00b5bb9e0bf7347e36eacafad7.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\LSA\FIPSALGORITHMPOLICY"; Key: "MDMENABLED"; Value: "") "afb24fab9c0b0f9e60d81bd7fd2d7999c842bf00b5bb9e0bf7347e36eacafad7.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\OLE"; Key: "PAGEALLOCATORUSESYSTEMHEAP"; Value: "") "afb24fab9c0b0f9e60d81bd7fd2d7999c842bf00b5bb9e0bf7347e36eacafad7.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\OLE"; Key: "PAGEALLOCATORSYSTEMHEAPISPRIVATE"; Value: "") "afb24fab9c0b0f9e60d81bd7fd2d7999c842bf00b5bb9e0bf7347e36eacafad7.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\OLE"; Key: "AGGRESSIVEMTATESTING"; Value: "") "afb24fab9c0b0f9e60d81bd7fd2d7999c842bf00b5bb9e0bf7347e36eacafad7.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\GRE_INITIALIZE"; Key: "DISABLEMETAFILES"; Value: "")38:T629,"afb24fab9c0b0f9e60d81bd7fd2d7999c842bf00b5bb9e0bf7347e36eacafad7.exe" reads file "c:\windows\microsoft.net\framework64\v4.0.30319\config\machine.config" "afb24fab9c0b0f9e60d81bd7fd2d7999c842bf00b5bb9e0bf7347e36eacafad7.exe" reads file "c:\windows\assembly\nativeimages_v4.0.30319_64\mscorlib\fe2524177eb3088c77be666722039f52\mscorlib.ni.dll.aux" "afb24fab9c0b0f9e60d81bd7fd2d7999c842bf00b5bb9e0bf7347e36eacafad7.exe" reads file "c:\windows\assembly\nativeimages_v4.0.30319_64\system\e43dd9c73ab5615e461bf5109c3facd6\system.ni.dll.aux" "afb24fab9c0b0f9e60d81bd7fd2d7999c842bf00b5bb9e0bf7347e36eacafad7.exe" reads file "c:\windows\assembly\nativeimages_v4.0.30319_64\system.windows.forms\b138f79dea860272ebe6694d9b73f656\system.windows.forms.ni.dll.aux" "afb24fab9c0b0f9e60d81bd7fd2d7999c842bf00b5bb9e0bf7347e36eacafad7.exe" reads file "c:\windows\assembly\nativeimages_v4.0.30319_64\system.drawing\ece80f2e3752a779e894fd45d8f27e64\system.drawing.ni.dll.aux" "afb24fab9c0b0f9e60d81bd7fd2d7999c842bf00b5bb9e0bf7347e36eacafad7.exe" reads file "c:\windows\assembly\nativeimages_v4.0.30319_64\system.configuration\4beb1eeca20b27d4bd1bb9880f03cc2a\system.configuration.ni.dll.aux" "afb24fab9c0b0f9e60d81bd7fd2d7999c842bf00b5bb9e0bf7347e36eacafad7.exe" reads file "c:\windows\assembly\nativeimages_v4.0.30319_64\system.core\0d59b0e237d7519417de10cd84bda4e7\system.core.ni.dll.aux" "afb24fab9c0b0f9e60d81bd7fd2d7999c842bf00b5bb9e0bf7347e36eacafad7.exe" reads file "c:\windows\assembly\nativeimages_v4.0.30319_64\system.xml\5ee35debfc22f727e70e4479ddcbc045\system.xml.ni.dll.aux"39:T5bc,"afb24fab9c0b0f9e60d81bd7fd2d7999c842bf00b5bb9e0bf7347e36eacafad7.exe" trying to touch file "C:\Windows\System32\mscoree.dll" "afb24fab9c0b0f9e60d81bd7fd2d7999c842bf00b5bb9e0bf7347e36eacafad7.exe" trying to touch file "C:\Windows\System32\MSCOREE.DLL.LOCAL" "afb24fab9c0b0f9e60d81bd7fd2d7999c842bf00b5bb9e0bf7347e36eacafad7.exe" trying to touch file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscoreei.dll" "afb24fab9c0b0f9e60d81bd7fd2d7999c842bf00b5bb9e0bf7347e36eacafad7.exe" trying to touch file "C:\Windows\System32\KernelBase.dll" "afb24fab9c0b0f9e60d81bd7fd2d7999c842bf00b5bb9e0bf7347e36eacafad7.exe" trying to touch file "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\CLR.DLL" "afb24fab9c0b0f9e60d81bd7fd2d7999c842bf00b5bb9e0bf7347e36eacafad7.exe" trying to touch file "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorwks.dll" "afb24fab9c0b0f9e60d81bd7fd2d7999c842bf00b5bb9e0bf7347e36eacafad7.exe" trying to touch file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\clr.dll" "afb24fab9c0b0f9e60d81bd7fd2d7999c842bf00b5bb9e0bf7347e36eacafad7.exe" trying to touch file "C:\Windows\System32\imm32.dll" "afb24fab9c0b0f9e60d81bd7fd2d7999c842bf00b5bb9e0bf7347e36eacafad7.exe" trying to touch file "C:\AFB24FAB9C0B0F9E60D81BD7FD2D7999C842BF00B5BB9E0BF7347E36EACAFAD7.EXE.CONFIG" "afb24fab9c0b0f9e60d81bd7fd2d7999c842bf00b5bb9e0bf7347e36eacafad7.exe" trying to touch file "C:\afb24fab9c0b0f9e60d81bd7fd2d7999c842bf00b5bb9e0bf7347e36eacafad7.exe"3a:Td1a,"afb24fab9c0b0f9e60d81bd7fd2d7999c842bf00b5bb9e0bf7347e36eacafad7.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\CLR.DLL" "afb24fab9c0b0f9e60d81bd7fd2d7999c842bf00b5bb9e0bf7347e36eacafad7.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\VCRUNTIME140_CLR0400.DLL" "afb24fab9c0b0f9e60d81bd7fd2d7999c842bf00b5bb9e0bf7347e36eacafad7.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\UCRTBASE_CLR0400.DLL" "afb24fab9c0b0f9e60d81bd7fd2d7999c842bf00b5bb9e0bf7347e36eacafad7.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSCOREE.DLL" "afb24fab9c0b0f9e60d81bd7fd2d7999c842bf00b5bb9e0bf7347e36eacafad7.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\OLE32.DLL" "afb24fab9c0b0f9e60d81bd7fd2d7999c842bf00b5bb9e0bf7347e36eacafad7.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\API-MS-WIN-CORE-WINRT-L1-1-0.DLL" "afb24fab9c0b0f9e60d81bd7fd2d7999c842bf00b5bb9e0bf7347e36eacafad7.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\BCRYPT.DLL" "afb24fab9c0b0f9e60d81bd7fd2d7999c842bf00b5bb9e0bf7347e36eacafad7.exe" trying to access non-existent file "C:\CRYPTSP.DLL" "afb24fab9c0b0f9e60d81bd7fd2d7999c842bf00b5bb9e0bf7347e36eacafad7.exe" trying to access non-existent file "C:\CRYPTBASE.DLL" "afb24fab9c0b0f9e60d81bd7fd2d7999c842bf00b5bb9e0bf7347e36eacafad7.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\PSAPI.DLL" "afb24fab9c0b0f9e60d81bd7fd2d7999c842bf00b5bb9e0bf7347e36eacafad7.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\UXTHEME.DLL" "afb24fab9c0b0f9e60d81bd7fd2d7999c842bf00b5bb9e0bf7347e36eacafad7.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\SHELL32.DLL" "afb24fab9c0b0f9e60d81bd7fd2d7999c842bf00b5bb9e0bf7347e36eacafad7.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\CRYPT32.DLL" "afb24fab9c0b0f9e60d81bd7fd2d7999c842bf00b5bb9e0bf7347e36eacafad7.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\CRYPT32.DLL" "afb24fab9c0b0f9e60d81bd7fd2d7999c842bf00b5bb9e0bf7347e36eacafad7.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\CRYPT32.DLL" "afb24fab9c0b0f9e60d81bd7fd2d7999c842bf00b5bb9e0bf7347e36eacafad7.exe" trying to access non-existent file "C:\SSPICLI.DLL" "afb24fab9c0b0f9e60d81bd7fd2d7999c842bf00b5bb9e0bf7347e36eacafad7.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Roaming\SubDir\FORTNITEMAP.EXE" "afb24fab9c0b0f9e60d81bd7fd2d7999c842bf00b5bb9e0bf7347e36eacafad7.exe" trying to access non-existent file "C:\SCHTASKS.EXE" "afb24fab9c0b0f9e60d81bd7fd2d7999c842bf00b5bb9e0bf7347e36eacafad7.exe" trying to access non-existent file "C:\schtasks.exe" "afb24fab9c0b0f9e60d81bd7fd2d7999c842bf00b5bb9e0bf7347e36eacafad7.exe" trying to access non-existent file "C:\FLTLIB.DLL"3b:T6c4,"afb24fab9c0b0f9e60d81bd7fd2d7999c842bf00b5bb9e0bf7347e36eacafad7.exe" trying to access non-existent file "C:\Windows\System32\MSCOREE.DLL.LOCAL" "afb24fab9c0b0f9e60d81bd7fd2d7999c842bf00b5bb9e0bf7347e36eacafad7.exe" trying to access non-existent file "C:\AFB24FAB9C0B0F9E60D81BD7FD2D7999C842BF00B5BB9E0BF7347E36EACAFAD7.EXE.CONFIG" "afb24fab9c0b0f9e60d81bd7fd2d7999c842bf00b5bb9e0bf7347e36eacafad7.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\FUSION.LOCALGAC" "afb24fab9c0b0f9e60d81bd7fd2d7999c842bf00b5bb9e0bf7347e36eacafad7.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\AFB24FAB9C0B0F9E60D81BD7FD2D7999C842BF00B5BB9E0BF7347E36EACAFAD7.EXE.LOG" "afb24fab9c0b0f9e60d81bd7fd2d7999c842bf00b5bb9e0bf7347e36eacafad7.exe" trying to access non-existent file "C:\Windows\assembly\NativeImages_v4.0.30319_64\CLIENT" "afb24fab9c0b0f9e60d81bd7fd2d7999c842bf00b5bb9e0bf7347e36eacafad7.exe" trying to access non-existent file "C:\AFB24FAB9C0B0F9E60D81BD7FD2D7999C842BF00B5BB9E0BF7347E36EACAFAD7.INI" "afb24fab9c0b0f9e60d81bd7fd2d7999c842bf00b5bb9e0bf7347e36eacafad7.exe" trying to access non-existent file "C:\Windows\assembly\GAC\PUBLISHERPOLICY.TME" "afb24fab9c0b0f9e60d81bd7fd2d7999c842bf00b5bb9e0bf7347e36eacafad7.exe" trying to access non-existent file "C:\AFB24FAB9C0B0F9E60D81BD7FD2D7999C842BF00B5BB9E0BF7347E36EACAFAD7.EXE.LOCAL" "afb24fab9c0b0f9e60d81bd7fd2d7999c842bf00b5bb9e0bf7347e36eacafad7.exe" trying to access non-existent file "C:\ProgramData\Microsoft\Crypto\OIDINFO" "afb24fab9c0b0f9e60d81bd7fd2d7999c842bf00b5bb9e0bf7347e36eacafad7.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Roaming\SUBDIR"3c:Td09,Observed Namespace "System.Net.Sockets.Socket" and MemberReference ".ctor" in "afb24fab9c0b0f9e60d81bd7fd2d7999c842bf00b5bb9e0bf7347e36eacafad7" Observed Namespace "System.Net.Sockets.Socket" and MemberReference "BeginConnect" in "afb24fab9c0b0f9e60d81bd7fd2d7999c842bf00b5bb9e0bf7347e36eacafad7" Observed Namespace "System.Net.Sockets.Socket" and MemberReference "EndConnect" in "afb24fab9c0b0f9e60d81bd7fd2d7999c842bf00b5bb9e0bf7347e36eacafad7" Observed Namespace "System.Net.Sockets.Socket" and MemberReference "get_Connected" in "afb24fab9c0b0f9e60d81bd7fd2d7999c842bf00b5bb9e0bf7347e36eacafad7" Observed Namespace "System.Net.Sockets.Socket" and MemberReference "BeginReceive" in "afb24fab9c0b0f9e60d81bd7fd2d7999c842bf00b5bb9e0bf7347e36eacafad7" Observed Namespace "System.Net.Sockets.Socket" and MemberReference "get_LocalEndPoint" in "afb24fab9c0b0f9e60d81bd7fd2d7999c842bf00b5bb9e0bf7347e36eacafad7" Observed Namespace "System.Net.Sockets.Socket" and MemberReference "EndReceive" in "afb24fab9c0b0f9e60d81bd7fd2d7999c842bf00b5bb9e0bf7347e36eacafad7" Observed Namespace "System.Net.Sockets.Socket" and MemberReference "Close" in "afb24fab9c0b0f9e60d81bd7fd2d7999c842bf00b5bb9e0bf7347e36eacafad7" Observed Namespace "System.Net.Sockets.Socket" and MemberReference "Send" in "afb24fab9c0b0f9e60d81bd7fd2d7999c842bf00b5bb9e0bf7347e36eacafad7" Observed Namespace "System.Net.Sockets.Socket" and MemberReference "Connect" in "afb24fab9c0b0f9e60d81bd7fd2d7999c842bf00b5bb9e0bf7347e36eacafad7" Observed Namespace "System.Net.Sockets.NetworkStream" and MemberReference ".ctor" in "afb24fab9c0b0f9e60d81bd7fd2d7999c842bf00b5bb9e0bf7347e36eacafad7" Observed Namespace "System.Net.Sockets.Socket" and MemberReference "Dispose" in "afb24fab9c0b0f9e60d81bd7fd2d7999c842bf00b5bb9e0bf7347e36eacafad7" Observed Namespace "System.Net.Sockets.Socket" and MemberReference "IOControl" in "afb24fab9c0b0f9e60d81bd7fd2d7999c842bf00b5bb9e0bf7347e36eacafad7" Observed Namespace "System.Net.Sockets.Socket" and MemberReference "get_OSSupportsIPv6" in "afb24fab9c0b0f9e60d81bd7fd2d7999c842bf00b5bb9e0bf7347e36eacafad7" Observed Namespace "System.Net.Sockets.SocketException" and MemberReference "get_SocketErrorCode" in "afb24fab9c0b0f9e60d81bd7fd2d7999c842bf00b5bb9e0bf7347e36eacafad7" Observed Namespace "System.Net.Sockets.Socket" and MemberReference ".ctor" in "fortnitemap.exe.bin" Observed Namespace "System.Net.Sockets.Socket" and MemberReference "BeginConnect" in "fortnitemap.exe.bin" Observed Namespace "System.Net.Sockets.Socket" and MemberReference "EndConnect" in "fortnitemap.exe.bin" Observed Namespace "System.Net.Sockets.Socket" and MemberReference "get_Connected" in "fortnitemap.exe.bin" Observed Namespace "System.Net.Sockets.Socket" and MemberReference "BeginReceive" in "fortnitemap.exe.bin" Observed Namespace "System.Net.Sockets.Socket" and MemberReference "get_LocalEndPoint" in "fortnitemap.exe.bin" Observed Namespace "System.Net.Sockets.Socket" and MemberReference "EndReceive" in "fortnitemap.exe.bin" Observed Namespace "System.Net.Sockets.Socket" and MemberReference "Close" in "fortnitemap.exe.bin" Observed Namespace "System.Net.Sockets.Socket" and MemberReference "Send" in "fortnitemap.exe.bin" Observed Namespace "System.Net.Sockets.Socket" and MemberReference "Connect" in "fortnitemap.exe.bin"3d:T923,Observed Namespace "System.Net.WebClient" and MemberReference ".ctor" in "afb24fab9c0b0f9e60d81bd7fd2d7999c842bf00b5bb9e0bf7347e36eacafad7" Observed Namespace "System.Net.WebClient" and MemberReference "set_Proxy" in "afb24fab9c0b0f9e60d81bd7fd2d7999c842bf00b5bb9e0bf7347e36eacafad7" Observed Namespace "System.Net.WebClient" and MemberReference "add_DownloadFileCompleted" in "afb24fab9c0b0f9e60d81bd7fd2d7999c842bf00b5bb9e0bf7347e36eacafad7" Observed Namespace "System.Net.WebClient" and MemberReference "get_IsBusy" in "afb24fab9c0b0f9e60d81bd7fd2d7999c842bf00b5bb9e0bf7347e36eacafad7" Observed Namespace "System.Net.WebClient" and MemberReference "CancelAsync" in "afb24fab9c0b0f9e60d81bd7fd2d7999c842bf00b5bb9e0bf7347e36eacafad7" Observed Namespace "System.Net.WebClient" and MemberReference "DownloadFileAsync" in "afb24fab9c0b0f9e60d81bd7fd2d7999c842bf00b5bb9e0bf7347e36eacafad7" Observed Namespace "System.Net.WebClient" and MemberReference "remove_DownloadFileCompleted" in "afb24fab9c0b0f9e60d81bd7fd2d7999c842bf00b5bb9e0bf7347e36eacafad7" Observed Namespace "System.Net.HttpWebRequest" and MemberReference "set_UserAgent" in "afb24fab9c0b0f9e60d81bd7fd2d7999c842bf00b5bb9e0bf7347e36eacafad7" Observed Namespace "System.Net.HttpWebRequest" and MemberReference "set_AllowAutoRedirect" in "afb24fab9c0b0f9e60d81bd7fd2d7999c842bf00b5bb9e0bf7347e36eacafad7" Observed Namespace "System.Net.WebClient" and MemberReference ".ctor" in "fortnitemap.exe.bin" Observed Namespace "System.Net.WebClient" and MemberReference "set_Proxy" in "fortnitemap.exe.bin" Observed Namespace "System.Net.WebClient" and MemberReference "add_DownloadFileCompleted" in "fortnitemap.exe.bin" Observed Namespace "System.Net.WebClient" and MemberReference "get_IsBusy" in "fortnitemap.exe.bin" Observed Namespace "System.Net.WebClient" and MemberReference "CancelAsync" in "fortnitemap.exe.bin" Observed Namespace "System.Net.WebClient" and MemberReference "DownloadFileAsync" in "fortnitemap.exe.bin" Observed Namespace "System.Net.WebClient" and MemberReference "remove_DownloadFileCompleted" in "fortnitemap.exe.bin" Observed Namespace "System.Net.HttpWebRequest" and MemberReference "set_UserAgent" in "fortnitemap.exe.bin" Observed Namespace "System.Net.HttpWebRequest" and MemberReference "set_AllowAutoRedirect" in "fortnitemap.exe.bin"3e:T60c,Observed Namespace "System.Net.Sockets.Socket" and MemberReference "BeginConnect" in "afb24fab9c0b0f9e60d81bd7fd2d7999c842bf00b5bb9e0bf7347e36eacafad7" Observed Namespace "System.Net.Sockets.Socket" and MemberReference "EndConnect" in "afb24fab9c0b0f9e60d81bd7fd2d7999c842bf00b5bb9e0bf7347e36eacafad7" Observed Namespace "System.Net.Sockets.Socket" and MemberReference "get_Connected" in "afb24fab9c0b0f9e60d81bd7fd2d7999c842bf00b5bb9e0bf7347e36eacafad7" Observed Namespace "System.Net.Sockets.Socket" and MemberReference "BeginReceive" in "afb24fab9c0b0f9e60d81bd7fd2d7999c842bf00b5bb9e0bf7347e36eacafad7" Observed Namespace "System.Net.Sockets.Socket" and MemberReference "EndReceive" in "afb24fab9c0b0f9e60d81bd7fd2d7999c842bf00b5bb9e0bf7347e36eacafad7" Observed Namespace "System.Net.Sockets.Socket" and MemberReference "Connect" in "afb24fab9c0b0f9e60d81bd7fd2d7999c842bf00b5bb9e0bf7347e36eacafad7" Observed Namespace "System.Net.Sockets.Socket" and MemberReference "BeginConnect" in "fortnitemap.exe.bin" Observed Namespace "System.Net.Sockets.Socket" and MemberReference "EndConnect" in "fortnitemap.exe.bin" Observed Namespace "System.Net.Sockets.Socket" and MemberReference "get_Connected" in "fortnitemap.exe.bin" Observed Namespace "System.Net.Sockets.Socket" and MemberReference "BeginReceive" in "fortnitemap.exe.bin" Observed Namespace "System.Net.Sockets.Socket" and MemberReference "EndReceive" in "fortnitemap.exe.bin" Observed Namespace "System.Net.Sockets.Socket" and MemberReference "Connect" in "fortnitemap.exe.bin"3f:Ta43,Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "SizeOf" in "afb24fab9c0b0f9e60d81bd7fd2d7999c842bf00b5bb9e0bf7347e36eacafad7" Observed namespace "System.IO.MemoryStream" and TypeReference ".ctor" in "afb24fab9c0b0f9e60d81bd7fd2d7999c842bf00b5bb9e0bf7347e36eacafad7" Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "GetDelegateForFunctionPointer" in "afb24fab9c0b0f9e60d81bd7fd2d7999c842bf00b5bb9e0bf7347e36eacafad7" Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "AllocHGlobal" in "afb24fab9c0b0f9e60d81bd7fd2d7999c842bf00b5bb9e0bf7347e36eacafad7" Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "Copy" in "afb24fab9c0b0f9e60d81bd7fd2d7999c842bf00b5bb9e0bf7347e36eacafad7" Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "FreeHGlobal" in "afb24fab9c0b0f9e60d81bd7fd2d7999c842bf00b5bb9e0bf7347e36eacafad7" Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "PtrToStructure" in "afb24fab9c0b0f9e60d81bd7fd2d7999c842bf00b5bb9e0bf7347e36eacafad7" Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "GetLastWin32Error" in "afb24fab9c0b0f9e60d81bd7fd2d7999c842bf00b5bb9e0bf7347e36eacafad7" Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "ReleaseComObject" in "afb24fab9c0b0f9e60d81bd7fd2d7999c842bf00b5bb9e0bf7347e36eacafad7" Observed namespace "System.IO.MemoryStream" and TypeReference "ToArray" in "afb24fab9c0b0f9e60d81bd7fd2d7999c842bf00b5bb9e0bf7347e36eacafad7" Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "AllocCoTaskMem" in "afb24fab9c0b0f9e60d81bd7fd2d7999c842bf00b5bb9e0bf7347e36eacafad7" Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "StructureToPtr" in "afb24fab9c0b0f9e60d81bd7fd2d7999c842bf00b5bb9e0bf7347e36eacafad7" Observed namespace "System.IO.MemoryStream" and TypeReference "GetBuffer" in "afb24fab9c0b0f9e60d81bd7fd2d7999c842bf00b5bb9e0bf7347e36eacafad7" Observed namespace "System.IO.MemoryStream" and TypeReference "Dispose" in "afb24fab9c0b0f9e60d81bd7fd2d7999c842bf00b5bb9e0bf7347e36eacafad7" Observed namespace "System.IO.MemoryStream" and TypeReference "WriteTo" in "afb24fab9c0b0f9e60d81bd7fd2d7999c842bf00b5bb9e0bf7347e36eacafad7" Observed namespace "System.IO.MemoryStream" and TypeReference "get_Capacity" in "afb24fab9c0b0f9e60d81bd7fd2d7999c842bf00b5bb9e0bf7347e36eacafad7" Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "SizeOf" in "fortnitemap.exe"40:T2fc4,Found XOR loop in file "fortnitemap.exe" at offset 258202; code bytes = 30d0 Found XOR loop in file "fortnitemap.exe" at offset 259603; code bytes = 30d0 Found XOR loop in file "fortnitemap.exe" at offset 990241; code bytes = 30d0 Found XOR loop in file "fortnitemap.exe" at offset 1770740; code bytes = 30d0 Found XOR loop in file "fortnitemap.exe" at offset 1896163; code bytes = 30d0 Found XOR loop in file "fortnitemap.exe" at offset 3482087; code bytes = 30d0 Found XOR loop in file "fortnitemap.exe" at offset 3493217; code bytes = 30d0 Found XOR loop in file "fortnitemap.exe" at offset 3521728; code bytes = 30d0 Found XOR loop in file "fortnitemap.exe" at offset 3523126; code bytes = 30d0 Found XOR loop in file "fortnitemap.exe" at offset 1259439; code bytes = 33c1 Found XOR loop in file "fortnitemap.exe" at offset 1259547; code bytes = 33c1 Found XOR loop in file "fortnitemap.exe" at offset 1482808; code bytes = 33c1 Found XOR loop in file "fortnitemap.exe" at offset 1841690; code bytes = 33c1 Found XOR loop in file "fortnitemap.exe" at offset 1841744; code bytes = 33c1 Found XOR loop in file "fortnitemap.exe" at offset 1848494; code bytes = 33c1 Found XOR loop in file "fortnitemap.exe" at offset 1848566; code bytes = 33c1 Found XOR loop in file "fortnitemap.exe" at offset 1864046; code bytes = 33c1 Found XOR loop in file "fortnitemap.exe" at offset 1864082; code bytes = 33c1 Found XOR loop in file "fortnitemap.exe" at offset 1864100; code bytes = 33c1 Found XOR loop in file "fortnitemap.exe" at offset 1864316; code bytes = 33c1 Found XOR loop in file "fortnitemap.exe" at offset 1864388; code bytes = 33c1 Found XOR loop in file "fortnitemap.exe" at offset 1864604; code bytes = 33c1 Found XOR loop in file "fortnitemap.exe" at offset 1864622; code bytes = 33c1 Found XOR loop in file "fortnitemap.exe" at offset 1864640; code bytes = 33c1 Found XOR loop in file "fortnitemap.exe" at offset 1864658; code bytes = 33c1 Found XOR loop in file "fortnitemap.exe" at offset 1864676; code bytes = 33c1 Found XOR loop in file "fortnitemap.exe" at offset 1865000; code bytes = 33c1 Found XOR loop in file "fortnitemap.exe" at offset 1865162; code bytes = 33c1 Found XOR loop in file "fortnitemap.exe" at offset 1865378; code bytes = 33c1 Found XOR loop in file "fortnitemap.exe" at offset 1865648; code bytes = 33c1 Found XOR loop in file "fortnitemap.exe" at offset 1865666; code bytes = 33c1 Found XOR loop in file "fortnitemap.exe" at offset 1877384; code bytes = 33c1 Found XOR loop in file "fortnitemap.exe" at offset 1877402; code bytes = 33c1 Found XOR loop in file "fortnitemap.exe" at offset 1877420; code bytes = 33c1 Found XOR loop in file "fortnitemap.exe" at offset 1877438; code bytes = 33c1 Found XOR loop in file "fortnitemap.exe" at offset 1877474; code bytes = 33c1 Found XOR loop in file "fortnitemap.exe" at offset 1930952; code bytes = 33c1 Found XOR loop in file "fortnitemap.exe" at offset 1967816; code bytes = 33c1 Found XOR loop in file "fortnitemap.exe" at offset 2000036; code bytes = 33c1 Found XOR loop in file "fortnitemap.exe" at offset 2000054; code bytes = 33c1 Found XOR loop in file "fortnitemap.exe" at offset 2000180; code bytes = 33c1 Found XOR loop in file "fortnitemap.exe" at offset 2018324; code bytes = 33c1 Found XOR loop in file "fortnitemap.exe" at offset 2018666; code bytes = 33c1 Found XOR loop in file "fortnitemap.exe" at offset 2018846; code bytes = 33c1 Found XOR loop in file "fortnitemap.exe" at offset 3434946; code bytes = 33c1 Found XOR loop in file "fortnitemap.exe" at offset 3507889; code bytes = 33c1 Found XOR loop in file "fortnitemap.exe" at offset 3553855; code bytes = 33c1 Found XOR loop in file "fortnitemap.exe" at offset 312990; code bytes = 8030 Found XOR loop in file "fortnitemap.exe" at offset 733714; code bytes = 8030 Found XOR loop in file "fortnitemap.exe" at offset 1028021; code bytes = 8030 Found XOR loop in file "fortnitemap.exe" at offset 1190651; code bytes = 8030 Found XOR loop in file "fortnitemap.exe" at offset 1227510; code bytes = 8030 Found XOR loop in file "fortnitemap.exe" at offset 1347553; code bytes = 8030 Found XOR loop in file "fortnitemap.exe" at offset 1382402; code bytes = 8030 Found XOR loop in file "fortnitemap.exe" at offset 1395450; code bytes = 8030 Found XOR loop in file "fortnitemap.exe" at offset 1407626; code bytes = 8030 Found XOR loop in file "fortnitemap.exe" at offset 1498080; code bytes = 8030 Found XOR loop in file "fortnitemap.exe" at offset 1522495; code bytes = 8030 Found XOR loop in file "fortnitemap.exe" at offset 1529421; code bytes = 8030 Found XOR loop in file "fortnitemap.exe" at offset 1614875; code bytes = 8030 Found XOR loop in file "fortnitemap.exe" at offset 1619515; code bytes = 8030 Found XOR loop in file "fortnitemap.exe" at offset 1626045; code bytes = 8030 Found XOR loop in file "fortnitemap.exe" at offset 1632265; code bytes = 8030 Found XOR loop in file "fortnitemap.exe" at offset 1638625; code bytes = 8030 Found XOR loop in file "fortnitemap.exe" at offset 1653995; code bytes = 8030 Found XOR loop in file "fortnitemap.exe" at offset 1657595; code bytes = 8030 Found XOR loop in file "fortnitemap.exe" at offset 1680145; code bytes = 8030 Found XOR loop in file "fortnitemap.exe" at offset 1680845; code bytes = 8030 Found XOR loop in file "fortnitemap.exe" at offset 1691365; code bytes = 8030 Found XOR loop in file "fortnitemap.exe" at offset 2401016; code bytes = 8030 Found XOR loop in file "fortnitemap.exe" at offset 3140596; code bytes = 8030 Found XOR loop in file "fortnitemap.exe" at offset 3160933; code bytes = 8030 Found XOR loop in file "fortnitemap.exe" at offset 3196698; code bytes = 8030 Found XOR loop in file "fortnitemap.exe" at offset 3372001; code bytes = 8030 Found XOR loop in file "fortnitemap.exe" at offset 3430842; code bytes = 8030 Found XOR loop in file "fortnitemap.exe" at offset 3432408; code bytes = 8030 Found XOR loop in file "fortnitemap.exe" at offset 3453387; code bytes = 8030 Found XOR loop in file "fortnitemap.exe" at offset 3474708; code bytes = 8030 Found XOR loop in file "fortnitemap.exe" at offset 3508153; code bytes = 8030 Found XOR loop in file "fortnitemap.exe" at offset 3527450; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 258202; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 259603; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 990241; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1770740; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1896163; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3482087; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3493217; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3521728; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3523126; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1259439; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1259547; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1482808; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1841690; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1841744; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1848494; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1848566; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1864046; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1864082; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1864100; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1864316; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1864388; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1864604; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1864622; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1864640; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1864658; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1864676; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1865000; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1865162; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1865378; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1865648; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1865666; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1877384; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1877402; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1877420; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1877438; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1877474; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1930952; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1967816; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2000036; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2000054; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2000180; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2018324; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2018666; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2018846; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3434946; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3507889; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3553855; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 312990; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 733714; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1028021; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1190651; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1227510; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1347553; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1382402; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1395450; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1407626; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1498080; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1522495; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1529421; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1614875; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1619515; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1626045; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1632265; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1638625; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1653995; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1657595; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1680145; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1680845; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1691365; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2401016; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3140596; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3160933; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3196698; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3372001; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3430842; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3432408; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3453387; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3474708; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3508153; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3527450; code bytes = 803041:T839,"afb24fab9c0b0f9e60d81bd7fd2d7999c842bf00b5bb9e0bf7347e36eacafad7.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b2031000030002c0030002c002c0031003000330030000d000a0000002c0030002c0040003100360066003200330038002c003200370036002c0031006300300031003000300030003000300036003000300030003000300030003000310030003000300030003000300062003100310064003000 (UID: 00000000-00004144) "afb24fab9c0b0f9e60d81bd7fd2d7999c842bf00b5bb9e0bf7347e36eacafad7.exe" called "GetVersionExA" with parameter 9c0000000600000001000000b11d00000200000053657276696365205061636b2031000000000000000000000200000000000000d8eb3a77d89624000060fd7f9a5c287700f0fd7fe0e116004460fd7f00000000400000003f0000001d0000000060fd7fd4e11600c15c287760822f771d0000000060fd7f9a5c287700f0fd7ff8e116005789277780832f7713172a75d8eb3a77 (UID: 00000000-00004144) "afb24fab9c0b0f9e60d81bd7fd2d7999c842bf00b5bb9e0bf7347e36eacafad7.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b20310000ed4b2b77000037770000000000000000f000377702000000000000008800000095e1237714e21600459d3c7700005f00000000008000000002000000000017009c1d687328e216006c22687380000000d3226873dcf0687344e21600741d6873dcf068730000000074e3160000000000 (UID: 00000000-00004144) "afb24fab9c0b0f9e60d81bd7fd2d7999c842bf00b5bb9e0bf7347e36eacafad7.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b20310000d14b2b77000037770000000000000000f000377702000000000000008800000095e1237738e21600459d3c7700005f00000000008000000002000000000017009c1d68734ce216006c22687380000000d3226873dcf0687368e21600741d6873dcf068730000000098e3160000000000 (UID: 00000000-00004144) "fortnitemap.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b203100007700500072006f006300650073007300490064002c0030002c0030002c002c006500630030000d000a00000065006c00330032002e0064006c006c002c0022003200350032003a00310034003a00330033002e0037003600310022002c00520058003d0030002c00500058003d003000 (UID: 00000000-00003776)42:T5fc,Observed namespace "Microsoft.Win32.RegistryKey" and TypeReference "GetSubKeyNames" in "afb24fab9c0b0f9e60d81bd7fd2d7999c842bf00b5bb9e0bf7347e36eacafad7" Observed namespace "Microsoft.Win32.RegistryKey" and TypeReference "GetValueNames" in "afb24fab9c0b0f9e60d81bd7fd2d7999c842bf00b5bb9e0bf7347e36eacafad7" Observed namespace "Microsoft.Win32.RegistryKey" and TypeReference "GetValueKind" in "afb24fab9c0b0f9e60d81bd7fd2d7999c842bf00b5bb9e0bf7347e36eacafad7" Observed namespace "Microsoft.Win32.RegistryKey" and TypeReference "GetValue" in "afb24fab9c0b0f9e60d81bd7fd2d7999c842bf00b5bb9e0bf7347e36eacafad7" Observed namespace "Microsoft.Win32.RegistryKey" and TypeReference "OpenBaseKey" in "afb24fab9c0b0f9e60d81bd7fd2d7999c842bf00b5bb9e0bf7347e36eacafad7" Observed namespace "Microsoft.Win32.RegistryKey" and TypeReference "OpenSubKey" in "afb24fab9c0b0f9e60d81bd7fd2d7999c842bf00b5bb9e0bf7347e36eacafad7" Observed namespace "Microsoft.Win32.RegistryKey" and TypeReference "GetSubKeyNames" in "fortnitemap.exe" Observed namespace "Microsoft.Win32.RegistryKey" and TypeReference "GetValueNames" in "fortnitemap.exe" Observed namespace "Microsoft.Win32.RegistryKey" and TypeReference "GetValueKind" in "fortnitemap.exe" Observed namespace "Microsoft.Win32.RegistryKey" and TypeReference "GetValue" in "fortnitemap.exe" Observed namespace "Microsoft.Win32.RegistryKey" and TypeReference "OpenBaseKey" in "fortnitemap.exe" Observed namespace "Microsoft.Win32.RegistryKey" and TypeReference "OpenSubKey" in "fortnitemap.exe"43:T11c2,"afb24fab9c0b0f9e60d81bd7fd2d7999c842bf00b5bb9e0bf7347e36eacafad7.exe" failed to load missing module "api-ms-win-core-fibers-l1-1-1" - [base:0; Status:c0000135] "afb24fab9c0b0f9e60d81bd7fd2d7999c842bf00b5bb9e0bf7347e36eacafad7.exe" failed to load missing module "api-ms-win-core-localization-l1-2-1" - [base:0; Status:c0000135] "afb24fab9c0b0f9e60d81bd7fd2d7999c842bf00b5bb9e0bf7347e36eacafad7.exe" failed to load missing module "api-ms-win-appmodel-runtime-l1-1-2.dll" - [base:0; Status:c0000135] "afb24fab9c0b0f9e60d81bd7fd2d7999c842bf00b5bb9e0bf7347e36eacafad7.exe" failed to load missing module "api-ms-win-appmodel-runtime-l1-1-0.dll" - [base:0; Status:c0000135] "afb24fab9c0b0f9e60d81bd7fd2d7999c842bf00b5bb9e0bf7347e36eacafad7.exe" failed to load missing module "api-ms-win-core-quirks-l1-1-0.dll" - [base:0; Status:c0000135] "afb24fab9c0b0f9e60d81bd7fd2d7999c842bf00b5bb9e0bf7347e36eacafad7.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoree.dll" - [base:0; Status:c0000135] "afb24fab9c0b0f9e60d81bd7fd2d7999c842bf00b5bb9e0bf7347e36eacafad7.exe" failed to load missing module "%WINDIR%\system32\combase.dll" - [base:0; Status:c0000135] "afb24fab9c0b0f9e60d81bd7fd2d7999c842bf00b5bb9e0bf7347e36eacafad7.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\ole32.dll" - [base:0; Status:c0000135] "afb24fab9c0b0f9e60d81bd7fd2d7999c842bf00b5bb9e0bf7347e36eacafad7.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll" - [base:0; Status:c0000135] "afb24fab9c0b0f9e60d81bd7fd2d7999c842bf00b5bb9e0bf7347e36eacafad7.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\psapi.dll" - [base:0; Status:c0000135] "afb24fab9c0b0f9e60d81bd7fd2d7999c842bf00b5bb9e0bf7347e36eacafad7.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\uxtheme.dll" - [base:0; Status:c0000135] "afb24fab9c0b0f9e60d81bd7fd2d7999c842bf00b5bb9e0bf7347e36eacafad7.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll" - [base:0; Status:c0000135] "afb24fab9c0b0f9e60d81bd7fd2d7999c842bf00b5bb9e0bf7347e36eacafad7.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\crypt32.dll" - [base:0; Status:c0000135] "afb24fab9c0b0f9e60d81bd7fd2d7999c842bf00b5bb9e0bf7347e36eacafad7.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\CRYPT32.dll" - [base:0; Status:c0000135] "afb24fab9c0b0f9e60d81bd7fd2d7999c842bf00b5bb9e0bf7347e36eacafad7.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\crypt32" - [base:0; Status:c0000135] "fortnitemap.exe" failed to load missing module "api-ms-win-core-fibers-l1-1-1" - [base:0; Status:c0000135] "fortnitemap.exe" failed to load missing module "api-ms-win-core-localization-l1-2-1" - [base:0; Status:c0000135] "fortnitemap.exe" failed to load missing module "api-ms-win-appmodel-runtime-l1-1-2.dll" - [base:0; Status:c0000135] "fortnitemap.exe" failed to load missing module "api-ms-win-appmodel-runtime-l1-1-0.dll" - [base:0; Status:c0000135] "fortnitemap.exe" failed to load missing module "api-ms-win-core-quirks-l1-1-0.dll" - [base:0; Status:c0000135] "fortnitemap.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoree.dll" - [base:0; Status:c0000135] "fortnitemap.exe" failed to load missing module "%WINDIR%\system32\combase.dll" - [base:0; Status:c0000135] "fortnitemap.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\ole32.dll" - [base:0; Status:c0000135] "fortnitemap.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll" - [base:0; Status:c0000135] "fortnitemap.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\psapi.dll" - [base:0; Status:c0000135] "fortnitemap.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\uxtheme.dll" - [base:0; Status:c0000135] "fortnitemap.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll" - [base:0; Status:c0000135]44:Te6c,Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll" [Source: 00000000-00004144-00000C2B-203151017] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\clr.dll" [Source: 00000000-00004144-00000C2B-203525221] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoree.dll" [Source: 00000000-00004144-00000C2B-204761135] Observed system executable string:"%WINDIR%\system32\combase.dll" [Source: 00000000-00004144-00000C2B-205116132] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\mscorlib\36eaccfde177c2e7b93b8dbdde4e012a\mscorlib.ni.dll" [Source: 00000000-00004144-00000C2B-205365943] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\ole32.dll" [Source: 00000000-00004144-00000C2B-205470136] Observed system executable string:"%WINDIR%\system32\uxtheme.dll" [Source: 00000000-00004144-00000C2B-205616180] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\clrjit.dll" [Source: 00000000-00004144-00000C2B-206044394] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\System\2c3c912ea8f058f9d04c4650128feb3f\System.ni.dll" [Source: 00000000-00004144-00000C2B-206129138] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Drawing\f7568d7f1b9d356f64779b4c0927cfb3\System.Drawing.ni.dll" [Source: 00000000-00004144-00000C2B-206216131] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Windows.Forms\c9a4cbc00f690a9e3cddfc400f6e85bb\System.Windows.Forms.ni.dll" [Source: 00000000-00004144-00000C2B-206314877] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\nlssorting.dll" [Source: 00000000-00004144-00000C2B-206553750] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Core\31fae3290fad30c31c98651462d22724\System.Core.ni.dll" [Source: 00000000-00004144-00000C2B-206634522] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Configuration\96f7edb07b12303f0ec2595c7f3778c7\System.Configuration.ni.dll" [Source: 00000000-00004144-00000C2B-206704572] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Xml\15af16d373cf0528cb74fc73d365fdbf\System.Xml.ni.dll" [Source: 00000000-00004144-00000C2B-206784998] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll" [Source: 00000000-00004144-00000C2B-207255453] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\psapi.dll" [Source: 00000000-00004144-00000C2B-207694327] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\uxtheme.dll" [Source: 00000000-00004144-00000C2B-208061590] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll" [Source: 00000000-00004144-00000C2B-208599367] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\crypt32.dll" [Source: 00000000-00004144-00000C2B-266604289] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\CRYPT32.dll" [Source: 00000000-00004144-00000C2B-266823364] Observed system executable string:"%WINDIR%\system32\cryptnet.dll" [Source: 00000000-00004144-00000C2B-267300535] Observed system executable string:"%WINDIR%\system32\dsrole.dll" [Source: 00000000-00004144-00000C2B-268648265]45:T524,Found string ";Integrated Security=SSPI;AttachDBFilename=|DataDirectory|aspnetdb.mdf;User Instance=true" providerName="System.Data.SqlClient"/>" (Indicator: "System.Data.SqlClient"; Source: "00000000-00003776.00000000.81007.00340000.00000004.mdmp 00000000-00003776.00000001.82929.00340000.00000004.mdmp 00000000-00003776.00000002.84852.00340000.00000004.mdmp"), Found string "" (Indicator: "System.Data.SqlClient"; Source: "00000000-00003776.00000000.81007.00340000.00000004.mdmp"), Found string "System.Data.SqlClient"/>" (Indicator: "System.Data.SqlClient"; Source: "00000000-00004144.00000000.76590.00170000.00000004.mdmp, 00000000-00004144.00000001.78513.00170000.00000004.mdmp, 00000000-00004144.00000002.80434.00170000.00000004.mdmp, 00000000-00004144.00000003.80690.00170000.00000004.mdmp") Found string "" (Indicator: "System.Data.SqlClient"; Source: "00000000-00004744.00000001.88362.00240000.00000004.mdmp")46:Teac,"afb24fab9c0b0f9e60d81bd7fd2d7999c842bf00b5bb9e0bf7347e36eacafad7.exe" called "FindFirstFileW" with parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll (UID: 00000000-00004144) "afb24fab9c0b0f9e60d81bd7fd2d7999c842bf00b5bb9e0bf7347e36eacafad7.exe" called "FindFirstFileW" with parameter %WINDIR%\Microsoft.NET\Framework\\* (UID: 00000000-00004144) "afb24fab9c0b0f9e60d81bd7fd2d7999c842bf00b5bb9e0bf7347e36eacafad7.exe" called "FindNextFileW" with parameter .. (UID: 00000000-00004144) "afb24fab9c0b0f9e60d81bd7fd2d7999c842bf00b5bb9e0bf7347e36eacafad7.exe" called "FindNextFileW" with parameter NETFXSBS10.exe (UID: 00000000-00004144) "afb24fab9c0b0f9e60d81bd7fd2d7999c842bf00b5bb9e0bf7347e36eacafad7.exe" called "FindNextFileW" with parameter netfxsbs12.hkf (UID: 00000000-00004144) "afb24fab9c0b0f9e60d81bd7fd2d7999c842bf00b5bb9e0bf7347e36eacafad7.exe" called "FindNextFileW" with parameter sbscmp10.dll (UID: 00000000-00004144) "afb24fab9c0b0f9e60d81bd7fd2d7999c842bf00b5bb9e0bf7347e36eacafad7.exe" called "FindNextFileW" with parameter sbscmp20_mscorwks.dll (UID: 00000000-00004144) "afb24fab9c0b0f9e60d81bd7fd2d7999c842bf00b5bb9e0bf7347e36eacafad7.exe" called "FindNextFileW" with parameter sbscmp20_perfcounter.dll (UID: 00000000-00004144) "afb24fab9c0b0f9e60d81bd7fd2d7999c842bf00b5bb9e0bf7347e36eacafad7.exe" called "FindNextFileW" with parameter sbs_diasymreader.dll (UID: 00000000-00004144) "afb24fab9c0b0f9e60d81bd7fd2d7999c842bf00b5bb9e0bf7347e36eacafad7.exe" called "FindNextFileW" with parameter sbs_iehost.dll (UID: 00000000-00004144) "afb24fab9c0b0f9e60d81bd7fd2d7999c842bf00b5bb9e0bf7347e36eacafad7.exe" called "FindNextFileW" with parameter sbs_microsoft.jscript.dll (UID: 00000000-00004144) "afb24fab9c0b0f9e60d81bd7fd2d7999c842bf00b5bb9e0bf7347e36eacafad7.exe" called "FindNextFileW" with parameter sbs_microsoft.vsa.vb.codedomprocessor.dll (UID: 00000000-00004144) "afb24fab9c0b0f9e60d81bd7fd2d7999c842bf00b5bb9e0bf7347e36eacafad7.exe" called "FindNextFileW" with parameter sbs_mscordbi.dll (UID: 00000000-00004144) "afb24fab9c0b0f9e60d81bd7fd2d7999c842bf00b5bb9e0bf7347e36eacafad7.exe" called "FindNextFileW" with parameter sbs_mscorrc.dll (UID: 00000000-00004144) "afb24fab9c0b0f9e60d81bd7fd2d7999c842bf00b5bb9e0bf7347e36eacafad7.exe" called "FindNextFileW" with parameter sbs_mscorsec.dll (UID: 00000000-00004144) "afb24fab9c0b0f9e60d81bd7fd2d7999c842bf00b5bb9e0bf7347e36eacafad7.exe" called "FindNextFileW" with parameter sbs_system.configuration.install.dll (UID: 00000000-00004144) "afb24fab9c0b0f9e60d81bd7fd2d7999c842bf00b5bb9e0bf7347e36eacafad7.exe" called "FindNextFileW" with parameter sbs_system.data.dll (UID: 00000000-00004144) "afb24fab9c0b0f9e60d81bd7fd2d7999c842bf00b5bb9e0bf7347e36eacafad7.exe" called "FindNextFileW" with parameter sbs_system.enterpriseservices.dll (UID: 00000000-00004144) "afb24fab9c0b0f9e60d81bd7fd2d7999c842bf00b5bb9e0bf7347e36eacafad7.exe" called "FindNextFileW" with parameter sbs_VsaVb7rt.dll (UID: 00000000-00004144) "afb24fab9c0b0f9e60d81bd7fd2d7999c842bf00b5bb9e0bf7347e36eacafad7.exe" called "FindNextFileW" with parameter sbs_wminet_utils.dll (UID: 00000000-00004144) "afb24fab9c0b0f9e60d81bd7fd2d7999c842bf00b5bb9e0bf7347e36eacafad7.exe" called "FindNextFileW" with parameter SharedReg12.dll (UID: 00000000-00004144) "afb24fab9c0b0f9e60d81bd7fd2d7999c842bf00b5bb9e0bf7347e36eacafad7.exe" called "FindNextFileW" with parameter v1.0.3705 (UID: 00000000-00004144) "afb24fab9c0b0f9e60d81bd7fd2d7999c842bf00b5bb9e0bf7347e36eacafad7.exe" called "FindNextFileW" with parameter v1.1.4322 (UID: 00000000-00004144) "afb24fab9c0b0f9e60d81bd7fd2d7999c842bf00b5bb9e0bf7347e36eacafad7.exe" called "FindNextFileW" with parameter v2.0.50727 (UID: 00000000-00004144)47:Te8c,Gma.System.MouseKeyHook.Implementation.KeyListener::.ctor(Gma.System.MouseKeyHook.Implementation.Subscribe) at 5462e80e464d9b44b4f0226f0b6d5c2b-6000999-ctor Gma.System.MouseKeyHook.Implementation.MouseListener::.ctor(Gma.System.MouseKeyHook.Implementation.Subscribe) at 5462e80e464d9b44b4f0226f0b6d5c2b-600099c-ctor Gma.System.MouseKeyHook.Implementation.BaseListener::set_Handle(Gma.System.MouseKeyHook.WinApi.HookResult) at 5462e80e464d9b44b4f0226f0b6d5c2b-60009a3-ctor Gma.System.MouseKeyHook.Implementation.BaseListener::get_Handle() at 5462e80e464d9b44b4f0226f0b6d5c2b-60009a6-BaseListener~Dispose Gma.System.MouseKeyHook.Implementation.KeyListener::.ctor(Gma.System.MouseKeyHook.Implementation.Subscribe) at 5462e80e464d9b44b4f0226f0b6d5c2b-60009ac-ctor Gma.System.MouseKeyHook.Implementation.MouseListener::.ctor(Gma.System.MouseKeyHook.Implementation.Subscribe) at 5462e80e464d9b44b4f0226f0b6d5c2b-60009af-ctor Gma.System.MouseKeyHook.Implementation.GlobalMouseListener::IsDoubleClick(Gma.System.MouseKeyHook.MouseEventExtArgs) at 5462e80e464d9b44b4f0226f0b6d5c2b-60009b0-GlobalMouseListener~ProcessDown Gma.System.MouseKeyHook.Implementation.MouseListener::ProcessUp(Gma.System.MouseKeyHook.MouseEventExtArgs&) at 5462e80e464d9b44b4f0226f0b6d5c2b-60009b1-GlobalMouseListener~ProcessUp Gma.System.MouseKeyHook.Implementation.EventFacade::GetKeyListener() at 5462e80e464d9b44b4f0226f0b6d5c2b-60009b9-EventFacade~add_KeyDown Gma.System.MouseKeyHook.Implementation.EventFacade::GetKeyListener() at 5462e80e464d9b44b4f0226f0b6d5c2b-60009ba-EventFacade~remove_KeyDown Gma.System.MouseKeyHook.Implementation.EventFacade::GetKeyListener() at 5462e80e464d9b44b4f0226f0b6d5c2b-60009bb-EventFacade~add_KeyPress Gma.System.MouseKeyHook.Implementation.EventFacade::GetKeyListener() at 5462e80e464d9b44b4f0226f0b6d5c2b-60009bc-EventFacade~remove_KeyPress Gma.System.MouseKeyHook.Implementation.EventFacade::GetKeyListener() at 5462e80e464d9b44b4f0226f0b6d5c2b-60009bd-EventFacade~add_KeyUp Gma.System.MouseKeyHook.Implementation.EventFacade::GetKeyListener() at 5462e80e464d9b44b4f0226f0b6d5c2b-60009be-EventFacade~remove_KeyUp Gma.System.MouseKeyHook.Implementation.EventFacade::GetMouseListener() at 5462e80e464d9b44b4f0226f0b6d5c2b-60009bf-EventFacade~add_MouseMove Gma.System.MouseKeyHook.Implementation.EventFacade::GetMouseListener() at 5462e80e464d9b44b4f0226f0b6d5c2b-60009c0-EventFacade~remove_MouseMove Gma.System.MouseKeyHook.Implementation.EventFacade::GetMouseListener() at 5462e80e464d9b44b4f0226f0b6d5c2b-60009c1-EventFacade~add_MouseMoveExt Gma.System.MouseKeyHook.Implementation.EventFacade::GetMouseListener() at 5462e80e464d9b44b4f0226f0b6d5c2b-60009c2-EventFacade~remove_MouseMoveExt Gma.System.MouseKeyHook.Implementation.EventFacade::GetMouseListener() at 5462e80e464d9b44b4f0226f0b6d5c2b-60009c3-EventFacade~add_MouseClick Gma.System.MouseKeyHook.Implementation.EventFacade::GetMouseListener() at 5462e80e464d9b44b4f0226f0b6d5c2b-60009c4-EventFacade~remove_MouseClick Gma.System.MouseKeyHook.Implementation.EventFacade::GetMouseListener() at 5462e80e464d9b44b4f0226f0b6d5c2b-60009c5-EventFacade~add_MouseDown Gma.System.MouseKeyHook.Implementation.EventFacade::GetMouseListener() at 5462e80e464d9b44b4f0226f0b6d5c2b-60009c6-EventFacade~remove_MouseDown Gma.System.MouseKeyHook.Implementation.EventFacade::GetMouseListener() at 5462e80e464d9b44b4f0226f0b6d5c2b-60009c7-EventFacade~add_MouseDownExt Gma.System.MouseKeyHook.Implementation.EventFacade::GetMouseListener() at 5462e80e464d9b44b4f0226f0b6d5c2b-60009c8-EventFacade~remove_MouseDownExt Gma.System.MouseKeyHook.Implementation.EventFacade::GetMouseListener() at 5462e80e464d9b44b4f0226f0b6d5c2b-60009c9-EventFacade~add_MouseUp48:Ted3,岓㌿ꇛ繡涧〟粅톂⯮百ళ骸灹䢙幧뱵昧::set_Handle(System.Net.Sockets.Socket) at 5462e80e464d9b44b4f0226f0b6d5c2b-6000055-ctor System.Net.Sockets.Socket::EndConnect(System.IAsyncResult) at 5462e80e464d9b44b4f0226f0b6d5c2b-6000056-_~_ System.Net.Sockets.Socket::EndReceive(System.IAsyncResult) at 5462e80e464d9b44b4f0226f0b6d5c2b-6000057-_~_ System.Net.Sockets.Socket::Close() at 5462e80e464d9b44b4f0226f0b6d5c2b-6000058-_~_ System.Net.Sockets.Socket::Send(System.Byte[]) at 5462e80e464d9b44b4f0226f0b6d5c2b-6000059-_~_ 䈓<蠘昘䛁�ᮾ잵ﬣ䈚퐑펾斁ꥯ䐡곲애潪왔::SetKeepAliveEx(System.Net.Sockets.Socket,System.UInt32,System.UInt32) at 5462e80e464d9b44b4f0226f0b6d5c2b-6000140-_~_ System.Type::GetMethod(System.String,System.Reflection.BindingFlags) at 5462e80e464d9b44b4f0226f0b6d5c2b-6000357-Helpers~GetInstanceMethod System.Type::GetMethod(System.String,System.Reflection.BindingFlags) at 5462e80e464d9b44b4f0226f0b6d5c2b-6000358-Helpers~GetStaticMethod System.Type::GetMethod(System.String,System.Reflection.BindingFlags,System.Reflection.Binder,System.Type[],System.Reflection.ParameterModifier[]) at 5462e80e464d9b44b4f0226f0b6d5c2b-6000359-Helpers~GetStaticMethod System.Type::GetMethod(System.String,System.Reflection.BindingFlags,System.Reflection.Binder,System.Type[],System.Reflection.ParameterModifier[]) at 5462e80e464d9b44b4f0226f0b6d5c2b-600035a-Helpers~GetInstanceMethod System.Type::GetConstructor(System.Reflection.BindingFlags,System.Reflection.Binder,System.Type[],System.Reflection.ParameterModifier[]) at 5462e80e464d9b44b4f0226f0b6d5c2b-6000364-Helpers~GetConstructor System.Type::GetConstructors(System.Reflection.BindingFlags) at 5462e80e464d9b44b4f0226f0b6d5c2b-6000365-Helpers~GetConstructors System.Type::GetProperty(System.String,System.Reflection.BindingFlags) at 5462e80e464d9b44b4f0226f0b6d5c2b-6000366-Helpers~GetProperty System.Type::GetProperties(System.Reflection.BindingFlags) at 5462e80e464d9b44b4f0226f0b6d5c2b-6000368-Helpers~GetInstanceFieldsAndProperties System.Type::GetMethod(System.String,System.Reflection.BindingFlags,System.Reflection.Binder,System.Type[],System.Reflection.ParameterModifier[]) at 5462e80e464d9b44b4f0226f0b6d5c2b-6000508-DefaultValueDecorator~EmitBeq System.Type::GetProperties(System.Reflection.BindingFlags) at 5462e80e464d9b44b4f0226f0b6d5c2b-600057b-MapDecorator_3~GetIndexerSetter System.Type::GetMethod(System.String,System.Reflection.BindingFlags,System.Reflection.Binder,System.Type[],System.Reflection.ParameterModifier[]) at 5462e80e464d9b44b4f0226f0b6d5c2b-600059d-ParseableSerializer~TryCreate System.Type::GetMethod(System.String,System.Reflection.BindingFlags,System.Reflection.Binder,System.Type[],System.Reflection.ParameterModifier[]) at 5462e80e464d9b44b4f0226f0b6d5c2b-600059e-ParseableSerializer~GetCustomToString System.Type::GetMethods(System.Reflection.BindingFlags) at 5462e80e464d9b44b4f0226f0b6d5c2b-60005f0-SurrogateSerializer~HasCast System.Type::GetMethod(System.String,System.Reflection.BindingFlags) at 5462e80e464d9b44b4f0226f0b6d5c2b-6000635-EmitWrite System.Type::GetMethod(System.String,System.Reflection.BindingFlags) at 5462e80e464d9b44b4f0226f0b6d5c2b-600063b-EmitCreateInstance System.Type::GetMembers(System.Reflection.BindingFlags) at 5462e80e464d9b44b4f0226f0b6d5c2b-60006c7-MetaType~ApplyDefaultBehaviourImpl System.Type::GetMember(System.String,System.Reflection.BindingFlags) at 5462e80e464d9b44b4f0226f0b6d5c2b-60006e6-MetaType~AddField System.Type::GetMethod(System.String,System.Reflection.BindingFlags) at 5462e80e464d9b44b4f0226f0b6d5c2b-6000746-RuntimeTypeModel~Override System.Type::GetMethod(System.String,System.Reflection.BindingFlags) at 5462e80e464d9b44b4f0226f0b6d5c2b-600074b-RuntimeTypeModel~WriteGetKeyImpl49:T428,YARA signature "INDICATOR_SUSPICIOUS_Binary_References_Browsers" matched file "sample.bin" as "Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers." YARA signature "INDICATOR_SUSPICIOUS_GENInfoStealer" matched file "sample.bin" as "Detects executables containing common artifacts observed in infostealers" YARA signature "INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA" matched file "sample.bin" as "Detects Windows executables referencing non-Windows User-Agents" YARA signature "INDICATOR_SUSPICIOUS_Binary_References_Browsers" matched file "fortnitemap.exe.2324321180" as "Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers." YARA signature "INDICATOR_SUSPICIOUS_GENInfoStealer" matched file "fortnitemap.exe.2324321180" as "Detects executables containing common artifacts observed in infostealers" YARA signature "INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA" matched file "fortnitemap.exe.2324321180" as "Detects Windows executables referencing non-Windows User-Agents"4a:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AREREREREREZmZmZmd1V3d0d3d3d3dkRmZmZmZ3dnd3dHj/iP+IZGdmZmdmZ3Znd3R4eIiIeGZ3Z3ZndmZkZnd0RERERGZnd3d3dmZnh3ZmdEREZmZmZnd3d3dmZ4h2ZmRERndmZmZ3dnZnd3Z4dmZkREZmZmd3d3ZmZmZnd3h2ZERGZmZ3dnZ3ZmZmZnd4hkRERmZmZmZ3d2ZmZ3Z3d3ZERGZmZnZ3d3d3Znd2d3d2RER3d3d2Z3d3d3Z3Znd3ZkRGd3d2d3d3h3d3d3dmZnZERnZ3dmZmZ4iHd3d3d3d3REZ3d3d3ZniIiIiHd2Z3dkRGd3d3d3eIdmiIh3d3d2RERnd3d3d4iGd3iId3d2dkRGZ3d3d3eIhnZ4iHd3d3dkRnZ3Z3d3iId4iIh3d3d3dEZ3d3d3d4iIiId4h3d3d3RGd3eIh3d4h4iIiId3d3dkRndnZ3d3d4h3iIiHd3d3ZEZ3d2Zmd3d3d3d4h3d3JkREZ2ZmZnd3d3d3czd3d3dEREZ2ZzZ3d3d3d3d3Mzd3RERGd2Zmd3d2d3d3dzMzdkRERnZ3Z3Z3d3d3d3d3dzdERERmZ3d3d3d3d3d3MzM2REREZ3ZndnZ3Znd3dzd3dkRERGdmdnd3d2ZmZ3d3d2ZERERGZndmZEZGZEZERGZERERERERGREREREREREREREQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==4b:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AREREREREREZmZmZmd1V3d0d3d3d3dkRmZmZmZ3dnd3dHj/iP+IZGdmZmdmZ3Znd3R4eIiIeGZ3Z3ZndmZkZnd0RERERGZnd3d3dmZnh3ZmdEREZmZmZnd3d3dmZ4h2ZmRERndmZmZ3dnZnd3Z4dmZkREZmZmd3d3ZmZmZnd3h2ZERGZmZ3dnZ3ZmZmZnd4hkRERmZmZmZ3d2ZmZ3Z3d3ZERGZmZnZ3d3d3Znd2d3d2RER3d3d2Z3d3d3Z3Znd3ZkRGd3d2d3d3h3d3d3dmZnZERnZ3dmZmZ4iHd3d3d3d3REZ3d3d3ZniIiIiHd2Z3dkRGd3d3d3eIdmiIh3d3d2RERnd3d3d4iGd3iId3d2dkRGZ3d3d3eIhnZ4iHd3d3dkRnZ3Z3d3iId4iIh3d3d3dEZ3d3d3d4iIiId4h3d3d3RGd3eIh3d4h4iIiId3d3dkRndnZ3d3d4h3iIiHd3d3ZEZ3d2Zmd3d3d3d4h3d3JkREZ2ZmZnd3d3d3czd3d3dEREZ2ZzZ3d3d3d3d3Mzd3RERGd2Zmd3d2d3d3dzMzdkRERnZ3Z3Z3d3d3d3d3dzdERERmZ3d3d3d3d3d3MzM2REREZ3ZndnZ3Znd3dzd3dkRERGdmdnd3d2ZmZ3d3d2ZERERGZndmZEZGZEZERGZERERERERGREREREREREREREQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==1b:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$23"}}],["$","$L24",null,{"initialData":{"schema_version":"1.0.15","sha256":"afb24fab9c0b0f9e60d81bd7fd2d7999c842bf00b5bb9e0bf7347e36eacafad7","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"SUCCESS","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":100,"unified_at_epoch_ms":1791280565362,"unified_at":"2026-10-06T09:56:05.362Z","metadata":{"hashes":{"sha256":"afb24fab9c0b0f9e60d81bd7fd2d7999c842bf00b5bb9e0bf7347e36eacafad7","sha1":"599e0a1630cc02a29a34e26a4fc810b7899412fd","md5":"5462e80e464d9b44b4f0226f0b6d5c2b","sha512":"b2a591f8d062d4adab4360fdd1a23a1989f22cb303085e4f6125cf55782bda56ca3f2e183e439b68a5c93c19e56fdebafeb3ecb6fbf271cc886a24600add8371","ssdeep":"98304:2vo22SsaNYfdPBldt6+dBcjHjgRJ6znwIC:I97jySnw","ssdeep_chunks":["98304:2vo22Ss","98304:vo22Ssa","98304:o22SsaN","98304:22SsaNY","98304:2SsaNYf","98304:SsaNYfd","98304:saNYfdP","98304:aNYfdPB","98304:NYfdPBl","98304:YfdPBld","98304:fdPBldt","98304:dPBldt6","98304:PBldt6+","98304:Bldt6+d","98304:ldt6+dB","98304:dt6+dBc","98304:t6+dBcj","98304:6+dBcjH","98304:+dBcjHj","98304:dBcjHjg","98304:BcjHjgR","98304:cjHjgRJ","98304:jHjgRJ6","98304:HjgRJ6z","98304:jgRJ6zn","98304:gRJ6znw","98304:RJ6znwI","98304:J6znwIC","196608:2vo22Ss","196608:vo22Ssa","196608:o22SsaN","196608:22SsaNY","196608:2SsaNYf","196608:SsaNYfd","196608:saNYfdP","196608:aNYfdPB","196608:NYfdPBl","196608:YfdPBld","196608:fdPBldt","196608:dPBldt6","196608:PBldt6+","196608:Bldt6+d","196608:ldt6+dB","196608:dt6+dBc","196608:t6+dBcj","196608:6+dBcjH","196608:+dBcjHj","196608:dBcjHjg","196608:BcjHjgR","196608:cjHjgRJ","196608:jHjgRJ6","196608:HjgRJ6z","196608:jgRJ6zn","196608:gRJ6znw","196608:RJ6znwI","196608:J6znwIC","98304:I97jySn","98304:97jySnw"],"imphash":"f34d5f2d4577ed6d9ceec516c1f5a744","pehash":"d4070cd91031e2e3b37c3f56fa941c9b0eeff4d8"},"file_info":{"file_name":"Client.exe","file_type":["peexe","assembly","executable"],"file_type_id":".NET exe","file_size":3560448,"entropy":6.32,"compile_timestamp":"2023-03-12T16:16:39","is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1704959410000,"last_seen":1788776881000,"last_multi_scan":1788776881000},"pe_metadata":{"is_dll":false,"is_packed":false,"section_count":3,"import_count":0,"export_count":0,"embedded_file_count":10,"sections":[{"name":".text","virtual_address":"0x2000","virtual_size":3261444,"raw_size":3261952},{"name":".rsrc","virtual_address":"0x320000","virtual_size":297448,"raw_size":297472},{"name":".reloc","virtual_address":"0x36a000","virtual_size":12,"raw_size":512}],"section_names":[".text",".rsrc",".reloc"],"imported_dlls":null,"imported_functions":null}},"detections":{"summary":{"verdict":"malicious","score":100,"tags":["commodity","rat","quasar","opensource","targeted","criminal","njrat","evasive"]},"stats":{"av":{"malicious_count":21,"suspicious_count":0,"total_engines":28},"attributions":{"malware_families_count":2,"threat_actors_count":1,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":73},"sandbox_signatures":{"informative_count":173,"suspicious_count":25,"malicious_count":14,"total":212},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"ahnlab":{"name":"AhnLab","success":true,"verdict":"malicious","threat_name":"Backdoor/Win32.QuasarRAT","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"malicious","threat_name":"Trojan/MSIL.Quasar","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"aurora":{"name":"Aurora","success":true,"verdict":"malicious","threat_name":"Malware_-10","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"malicious","threat_name":"TR/Quasar.A","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"malicious","threat_name":"Gen:Variant.Application.Fca.3927","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"clamav":{"name":"ClamAV","success":true,"verdict":"malicious","threat_name":"Win.Malware.Generic-9883083-0","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"cmc":{"name":"CMC","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"malicious","threat_name":"win/malicious_confidence_100% (W)","status":"malicious","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"malicious","threat_name":"Trojan.Agent (A)","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"malicious","threat_name":"a variant of MSIL/Agent.CLQ trojan","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"filseclab":{"name":"Filseclab","success":true,"verdict":"malicious","threat_name":"Trojan.MSIL.Quasar.gen.uwon","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"gridinsoft":{"name":"Gridinsoft","success":true,"verdict":"malicious","threat_name":"Spy.Win32.Keylogger.dd!n","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"malicious","threat_name":"Trojan/MSIL.Obfuscated.g!crit","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"malicious","threat_name":"Trojan ( 005b1c021 )","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"lionic":{"name":"Lionic","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"netgate":{"name":"NETGATE","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"scrutiny":{"name":"Scrutiny","success":true,"verdict":"malicious","threat_name":"Malware","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sentinelone":{"name":"SentinelOne","success":true,"verdict":"malicious","threat_name":"YARA","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"malicious","threat_name":"Troj/Quasar-AF","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trellix":{"name":"Trellix","success":true,"verdict":"malicious","threat_name":"Quasar!5462E80E464D","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"varist":{"name":"Varist","success":true,"verdict":"malicious","threat_name":"W32/MSIL_Troj.BTX.gen!Eldorado","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.MSIL.MJ","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"xcitium":{"name":"Xcitium","success":true,"verdict":"malicious","threat_name":"Malware","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"malicious","threat_name":"Trojan.Agent.Win32.3843608","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"Trojan.Agent","sources":[{"report_type":"quickscan","report_id":""}]},{"value":"Quasar","sources":[{"report_type":"qsp","report_id":""}]}],"threat_actors":[{"value":"BLIND SPIDER","sources":[{"report_type":"qsp","report_id":""}]}]},"mitre_attacks":[{"tactic":"Defense Evasion","technique":"Obfuscated Files or Information","attack_id":"T1027","attack_id_wiki":"https://attack.mitre.org/techniques/T1027","identifiers":[{"type":"informative","value":"Contains ability to perform crypto operations"},{"type":"informative","value":"Contains CRYPTO related strings"},{"type":"informative","value":"Contains ability to perform CryptoStream operations (Dotnet)"},{"type":"informative","value":"Matched Compiler/Packer signature (DIE)"},{"type":"informative","value":"Shows ability to obfuscate file or information"},{"type":"suspicious","value":"YARA signature match - MD5 algorithm"},{"type":"informative","value":"Found a cryptographic related string in Linux binary"},{"type":"informative","value":"Contains key cryptographic functions (API string)"},{"type":"informative","value":"Contains ability to perform AES/RC4 encryption (API string)"},{"type":"informative","value":"Dotnet file contains encryption/decryption functions"},{"type":"informative","value":"Contains ability to perform symmetric encryption (Dotnet)"},{"type":"informative","value":"YARA signature match - AES encryption"},{"type":"informative","value":"Loads the Bcrypt module DLL"},{"type":"informative","value":"Contains ability to use Cryptographic classes"},{"type":"informative","value":"Dotnet code contains ability to generate random numbers"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6836a5da950abe50e709d27c"},{"report_type":"sandbox","report_id":"6a9e91b0d972b9c71504dfdf"}]},{"tactic":"Collection","technique":"Data from Local System","attack_id":"T1005","attack_id_wiki":"https://attack.mitre.org/techniques/T1005","identifiers":[{"type":"informative","value":"May execute SQL queries"},{"type":"informative","value":"Calls an API typically used to copy file from one location to another"},{"type":"suspicious","value":"Found browser information locations related strings"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6836a5da950abe50e709d27c"},{"report_type":"sandbox","report_id":"6a9e91b0d972b9c71504dfdf"}]},{"tactic":"Discovery","technique":"Query Registry","attack_id":"T1012","attack_id_wiki":"https://attack.mitre.org/techniques/T1012","identifiers":[{"type":"informative","value":"Opens registry keys"},{"type":"informative","value":"Dotnet code contains ability to query registry"},{"type":"informative","value":"Found registry location strings in memory"},{"type":"informative","value":".NET code is able to query registry"},{"type":"informative","value":"Contains registry location strings"},{"type":"informative","value":"Queries registry keys"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6836a5da950abe50e709d27c"},{"report_type":"sandbox","report_id":"6a9e91b0d972b9c71504dfdf"}]},{"tactic":"Discovery","technique":"Security Software Discovery","attack_id":"T1518.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1518/001","identifiers":[{"type":"informative","value":"Possibly checks for the presence of an Antivirus engine"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6836a5da950abe50e709d27c"},{"report_type":"sandbox","report_id":"6a9e91b0d972b9c71504dfdf"}]},{"tactic":"Credential Access","technique":"Credentials from Password Stores","attack_id":"T1555","attack_id_wiki":"https://attack.mitre.org/techniques/T1555","identifiers":[{"type":"informative","value":"Contains string like password/secret"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6836a5da950abe50e709d27c"},{"report_type":"sandbox","report_id":"6a9e91b0d972b9c71504dfdf"}]},{"tactic":"Discovery","technique":"System Information Discovery","attack_id":"T1082","attack_id_wiki":"https://attack.mitre.org/techniques/T1082","identifiers":[{"type":"informative","value":"Reads the cryptographic machine GUID"},{"type":"informative","value":"References to WMI query strings used for information discovery"},{"type":"informative","value":"Contains ability to gather system environment details"},{"type":"informative","value":"Calls an API typically used to retrieve OS information"},{"type":"informative","value":"Able to gather system file/directory information (.NET)"},{"type":"informative","value":"Calls an API typically used to get system version information"},{"type":"informative","value":"Reads information about supported languages"},{"type":"informative","value":"Reads the active computer name"},{"type":"informative","value":"Contains ability to query the machine version"},{"type":"informative","value":"Contains ability to retrieve the OS information (API string)"},{"type":"informative","value":"Queries volume information"},{"type":"informative","value":"Calls an API typically used to get product type"},{"type":"informative","value":"Contains ability to retrieve information about the current system"},{"type":"informative","value":"Contains ability to read software policies"},{"type":"informative","value":"Contains ability to gather system information (Dotnet)"},{"type":"informative","value":"Found system command-related strings"},{"type":"informative","value":"Attempts to call APIs to gather system and hardware detail"},{"type":"informative","value":"Able to discover operating system information (API string)"},{"type":"suspicious","value":"Contains ability to retrieve information about the current system"},{"type":"informative","value":"Able to obtain MAC address in .NET file"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6836a5da950abe50e709d27c"},{"report_type":"sandbox","report_id":"6a9e91b0d972b9c71504dfdf"}]},{"tactic":"Discovery","technique":"Internet Connection Discovery","attack_id":"T1016.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1016/001","identifiers":[{"type":"informative","value":"Able to check internet connectivity using ping command"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a9e91b0d972b9c71504dfdf"}]},{"tactic":"Impact","technique":"System Shutdown/Reboot","attack_id":"T1529","attack_id_wiki":"https://attack.mitre.org/techniques/T1529","identifiers":[{"type":"informative","value":"Contains ability to shutdown system"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6836a5da950abe50e709d27c"},{"report_type":"sandbox","report_id":"6a9e91b0d972b9c71504dfdf"}]},{"tactic":"Execution","technique":"Windows Management Instrumentation","attack_id":"T1047","attack_id_wiki":"https://attack.mitre.org/techniques/T1047","identifiers":[{"type":"suspicious","value":"Found a reference to a WMI query string known to be used for VM detection"},{"type":"informative","value":"Contains ability to execute a WMI query"},{"type":"informative","value":"Contains ability to execute WMI queries (Dotnet)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6836a5da950abe50e709d27c"},{"report_type":"sandbox","report_id":"6a9e91b0d972b9c71504dfdf"}]},{"tactic":"Impact","technique":"Data Encrypted for Impact","attack_id":"T1486","attack_id_wiki":"https://attack.mitre.org/techniques/T1486","identifiers":[{"type":"informative","value":"Contains reference to cryptographic keys"},{"type":"informative","value":"Contains reference to crypto DLLs"},{"type":"informative","value":"Able to access crypto-related API (String)"},{"type":"informative","value":"Contains ability to perform encryption (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6836a5da950abe50e709d27c"},{"report_type":"sandbox","report_id":"6a9e91b0d972b9c71504dfdf"}]},{"tactic":"Collection","technique":"Data from Information Repositories","attack_id":"T1213","attack_id_wiki":"https://attack.mitre.org/techniques/T1213","identifiers":[{"type":"informative","value":"Able to perform SQL operations"},{"type":"informative","value":"Contains SQL queries"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6836a5da950abe50e709d27c"},{"report_type":"sandbox","report_id":"6a9e91b0d972b9c71504dfdf"}]},{"tactic":"Execution","technique":"Native API","attack_id":"T1106","attack_id_wiki":"https://attack.mitre.org/techniques/T1106","identifiers":[{"type":"informative","value":"Contains native function calls (syscalls strings)"},{"type":"suspicious","value":"Input file contains API references not part of its Import Address Table (IAT)"},{"type":"informative","value":"Contains ability to execute Windows APIs"},{"type":"informative","value":"Calls an API typically used to retrieve function addresses"},{"type":"informative","value":"Found Native API in Dotnet file"},{"type":"informative","value":"Contains ability to execute application (Dotnet)"},{"type":"informative","value":"Contains ability to start a process (Dotnet)"},{"type":"informative","value":"Input file contains API references not part of its Import Address Table (IAT)"},{"type":"informative","value":"Dotnet source code contains suspicious native API"},{"type":"informative","value":"Calls an API typically used to load a resource in memory"},{"type":"informative","value":"Calls an API typically used to create a process"},{"type":"informative","value":".NET source code contains suspicious native API"},{"type":"informative","value":"Able to execute application (.NET)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6836a5da950abe50e709d27c"},{"report_type":"sandbox","report_id":"6a9e91b0d972b9c71504dfdf"}]},{"tactic":"Persistence","technique":"Boot or Logon Autostart Execution","attack_id":"T1547","attack_id_wiki":"https://attack.mitre.org/techniques/T1547","identifiers":[{"type":"suspicious","value":"Found registry location strings which can modify auto-execute functionality"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6836a5da950abe50e709d27c"},{"report_type":"sandbox","report_id":"6a9e91b0d972b9c71504dfdf"}]},{"tactic":"Credential Access","technique":"Credentials In Files","attack_id":"T1552.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1552/001","identifiers":[{"type":"malicious","value":"Found FTP credentials location strings"},{"type":"suspicious","value":"Identified FTP credentials location strings"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6836a5da950abe50e709d27c"},{"report_type":"sandbox","report_id":"6a9e91b0d972b9c71504dfdf"}]},{"tactic":"Command and Control","technique":"Encrypted Channel","attack_id":"T1573","attack_id_wiki":"https://attack.mitre.org/techniques/T1573","identifiers":[{"type":"informative","value":"Possibly tries to communicate over SSL connection (HTTPS)"},{"type":"informative","value":"Able to use Microsoft's Enhanced Cryptographic Provider"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6836a5da950abe50e709d27c"},{"report_type":"sandbox","report_id":"6a9e91b0d972b9c71504dfdf"}]},{"tactic":"Credential Access","technique":"Credentials from Web Browsers","attack_id":"T1555.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1555/003","identifiers":[{"type":"suspicious","value":"Able to retrieve saved login credentials from browser"},{"type":"informative","value":"References Chromium browser credentials files"},{"type":"informative","value":"References Firefox browser credentials files"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6836a5da950abe50e709d27c"},{"report_type":"sandbox","report_id":"6a9e91b0d972b9c71504dfdf"}]},{"tactic":"Command and Control","technique":"Application Layer Protocol","attack_id":"T1071","attack_id_wiki":"https://attack.mitre.org/techniques/T1071","identifiers":[{"type":"informative","value":"Found potential URLs in memory dumps"},{"type":"informative","value":"Contains references to network communication API (string)"},{"type":"informative","value":"Found potential IP address in binary/memory"},{"type":"informative","value":"Found potential URL in binary/memory"},{"type":"informative","value":"Contacts server"},{"type":"informative","value":"Contains ability to communicates via socket (possible C&C communication)"},{"type":"suspicious","value":"Spawned process connects to a network"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6836a5da950abe50e709d27c"},{"report_type":"sandbox","report_id":"6a9e91b0d972b9c71504dfdf"}]},{"tactic":"Execution","technique":"Scheduled Task","attack_id":"T1053.005","attack_id_wiki":"https://attack.mitre.org/techniques/T1053/005","identifiers":[{"type":"malicious","value":"Schedules a task to be executed at a specific time and date"}],"sources":[{"report_type":"sandbox","report_id":"6836a5da950abe50e709d27c"},{"report_type":"sandbox","report_id":"6a9e91b0d972b9c71504dfdf"}]},{"tactic":"Execution","technique":"Shared Modules","attack_id":"T1129","attack_id_wiki":"https://attack.mitre.org/techniques/T1129","identifiers":[{"type":"informative","value":"Loads the .NET runtime environment"},{"type":"informative","value":"Loads modules at runtime"},{"type":"informative","value":"Calls an API typically used to load libraries"},{"type":"informative","value":"Loads the RPC (Remote Procedure Call) module DLL"},{"type":"informative","value":"Looks up procedures from modules (excluding apphelp.dll, kernel32.dll, user32.dll, gdi32.dll, ole32.dll, comctl32.dll, uxtheme.dll, oleaut32.dll, version.dll, msctfime.ime)"},{"type":"informative","value":"Fails to load modules at runtime"}],"sources":[{"report_type":"sandbox","report_id":"6836a5da950abe50e709d27c"},{"report_type":"sandbox","report_id":"6a9e91b0d972b9c71504dfdf"}]},{"tactic":"Execution","technique":"Component Object Model","attack_id":"T1559.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1559/001","identifiers":[{"type":"malicious","value":"Loads the task scheduler COM API"}],"sources":[{"report_type":"sandbox","report_id":"6836a5da950abe50e709d27c"},{"report_type":"sandbox","report_id":"6a9e91b0d972b9c71504dfdf"}]},{"tactic":"Execution","technique":"Malicious File","attack_id":"T1204.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1204/002","identifiers":[{"type":"malicious","value":"The analysis extracted a file that was identified as malicious"},{"type":"malicious","value":"The analysis spawned a process that was identified as malicious"},{"type":"malicious","value":"Sample was identified as malicious by a trusted antivirus engine"}],"sources":[{"report_type":"sandbox","report_id":"6836a5da950abe50e709d27c"},{"report_type":"sandbox","report_id":"6a9e91b0d972b9c71504dfdf"}]},{"tactic":"Persistence","technique":"Windows Service","attack_id":"T1543.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1543/003","identifiers":[{"type":"informative","value":"Contains ability to access device drivers"}],"sources":[{"report_type":"sandbox","report_id":"6836a5da950abe50e709d27c"},{"report_type":"sandbox","report_id":"6a9e91b0d972b9c71504dfdf"}]},{"tactic":"Persistence","technique":"Modify Registry","attack_id":"T1112","attack_id_wiki":"https://attack.mitre.org/techniques/T1112","identifiers":[{"type":"suspicious","value":"Writes registry keys"},{"type":"informative","value":"Dotnet code contains ability to modify/delete registry"},{"type":"informative","value":"Writes registry keys"}],"sources":[{"report_type":"sandbox","report_id":"6836a5da950abe50e709d27c"},{"report_type":"sandbox","report_id":"6a9e91b0d972b9c71504dfdf"}]},{"tactic":"Privilege Escalation","technique":"Thread Execution Hijacking","attack_id":"T1055.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/003","identifiers":[{"type":"informative","value":"Creates a thread in a self process"}],"sources":[{"report_type":"sandbox","report_id":"6836a5da950abe50e709d27c"}]},{"tactic":"Privilege Escalation","technique":"ListPlanting","attack_id":"T1055.015","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/015","identifiers":[{"type":"informative","value":"Able to visualize and control listed components (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6836a5da950abe50e709d27c"},{"report_type":"sandbox","report_id":"6a9e91b0d972b9c71504dfdf"}]},{"tactic":"Privilege Escalation","technique":"Access Token Manipulation","attack_id":"T1134","attack_id_wiki":"https://attack.mitre.org/techniques/T1134","identifiers":[{"type":"informative","value":"Contains ability to modify access token privileges (API string)"},{"type":"suspicious","value":"Adjusts debug privileges"},{"type":"informative","value":"Calls an API typically used to enable or disable privileges in the specified access token"}],"sources":[{"report_type":"sandbox","report_id":"6836a5da950abe50e709d27c"},{"report_type":"sandbox","report_id":"6a9e91b0d972b9c71504dfdf"}]},{"tactic":"Privilege Escalation","technique":"Extra Window Memory Injection","attack_id":"T1055.011","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/011","sources":[{"report_type":"sandbox","report_id":"6836a5da950abe50e709d27c"},{"report_type":"sandbox","report_id":"6a9e91b0d972b9c71504dfdf"}]},{"tactic":"Defense Evasion","technique":"File Deletion","attack_id":"T1070.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/004","identifiers":[{"type":"malicious","value":"Tries to hide tracks of having downloaded a file from the internet"},{"type":"suspicious","value":"Opens file with deletion access rights"},{"type":"suspicious","value":"Marks file for deletion"},{"type":"informative","value":"Contains ability to delete files"}],"sources":[{"report_type":"sandbox","report_id":"6836a5da950abe50e709d27c"},{"report_type":"sandbox","report_id":"6a9e91b0d972b9c71504dfdf"}]},{"tactic":"Defense Evasion","technique":"Hidden Window","attack_id":"T1564.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1564/003","identifiers":[{"type":"informative","value":"Contains ability to show a graphical window (API string)"},{"type":"informative","value":"Able to execute applications in hidden mode (.NET)"}],"sources":[{"report_type":"sandbox","report_id":"6836a5da950abe50e709d27c"},{"report_type":"sandbox","report_id":"6a9e91b0d972b9c71504dfdf"}]},{"tactic":"Defense Evasion","technique":"Deobfuscate/Decode Files or Information","attack_id":"T1140","attack_id_wiki":"https://attack.mitre.org/techniques/T1140","identifiers":[{"type":"informative","value":"Able to decode string content at runtime (.NET)"},{"type":"informative","value":"Contains symmetric decryption functionality in .NET code"},{"type":"informative","value":"Contains ability to perform decryption (API string)"},{"type":"informative","value":"Contains ability to load content into memory (Dotnet)"},{"type":"informative","value":"Contains ability to decode string content at runtime (Dotnet)"},{"type":"informative","value":"Contains ability to perform symmetric decryption (Dotnet)"},{"type":"informative","value":"Shows ability to deobfuscate/decode files or information"},{"type":"informative","value":"Able to load content into memory (.NET)"}],"sources":[{"report_type":"sandbox","report_id":"6836a5da950abe50e709d27c"},{"report_type":"sandbox","report_id":"6a9e91b0d972b9c71504dfdf"}]},{"tactic":"Defense Evasion","technique":"Disable or Modify Tools","attack_id":"T1562.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1562/001","identifiers":[{"type":"informative","value":"Contains strings related to AMSI (Anti Malware Scan Interface)"},{"type":"suspicious","value":"Creates guarded memory regions (anti-debugging trick to avoid memory dumping)"}],"sources":[{"report_type":"sandbox","report_id":"6836a5da950abe50e709d27c"},{"report_type":"sandbox","report_id":"6a9e91b0d972b9c71504dfdf"}]},{"tactic":"Defense Evasion","technique":"Reflective Code Loading","attack_id":"T1620","attack_id_wiki":"https://attack.mitre.org/techniques/T1620","identifiers":[{"type":"informative","value":"Loads the CLR Loader DLL"},{"type":"informative","value":"Contains ability to generate intermediate language instructions (Dotnet)"}],"sources":[{"report_type":"sandbox","report_id":"6836a5da950abe50e709d27c"},{"report_type":"sandbox","report_id":"6a9e91b0d972b9c71504dfdf"}]},{"tactic":"Defense Evasion","technique":"Masquerade File Type","attack_id":"T1036.008","attack_id_wiki":"https://attack.mitre.org/techniques/T1036/008","identifiers":[{"type":"suspicious","value":"Drops binary executable file with an unexpected extension"}],"sources":[{"report_type":"sandbox","report_id":"6836a5da950abe50e709d27c"}]},{"tactic":"Defense Evasion","technique":"Masquerading","attack_id":"T1036","attack_id_wiki":"https://attack.mitre.org/techniques/T1036","identifiers":[{"type":"informative","value":"Drops files inside appdata directory"}],"sources":[{"report_type":"sandbox","report_id":"6836a5da950abe50e709d27c"},{"report_type":"sandbox","report_id":"6a9e91b0d972b9c71504dfdf"}]},{"tactic":"Defense Evasion","technique":"Software Packing","attack_id":"T1027.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/002","identifiers":[{"type":"suspicious","value":"PE file has unusual entropy resources"},{"type":"informative","value":"Matched Compiler/Packer signature"},{"type":"informative","value":"Dotnet file contains function to dynamically call methods at runtime"}],"sources":[{"report_type":"sandbox","report_id":"6836a5da950abe50e709d27c"},{"report_type":"sandbox","report_id":"6a9e91b0d972b9c71504dfdf"}]},{"tactic":"Defense Evasion","technique":"File and Directory Permissions Modification","attack_id":"T1222","attack_id_wiki":"https://attack.mitre.org/techniques/T1222","identifiers":[{"type":"informative","value":"Contains ability to set file attributes (Dotnet)"}],"sources":[{"report_type":"sandbox","report_id":"6836a5da950abe50e709d27c"},{"report_type":"sandbox","report_id":"6a9e91b0d972b9c71504dfdf"}]},{"tactic":"Defense Evasion","technique":"Embedded Payloads","attack_id":"T1027.009","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/009","identifiers":[{"type":"suspicious","value":"Section contains high entropy"}],"sources":[{"report_type":"sandbox","report_id":"6836a5da950abe50e709d27c"},{"report_type":"sandbox","report_id":"6a9e91b0d972b9c71504dfdf"}]},{"tactic":"Defense Evasion","technique":"Execution Guardrails","attack_id":"T1480","attack_id_wiki":"https://attack.mitre.org/techniques/T1480","identifiers":[{"type":"informative","value":"Shows ability to use execution guardrails"}],"sources":[{"report_type":"sandbox","report_id":"6836a5da950abe50e709d27c"},{"report_type":"sandbox","report_id":"6a9e91b0d972b9c71504dfdf"}]},{"tactic":"Credential Access","technique":"OS Credential Dumping","attack_id":"T1003","attack_id_wiki":"https://attack.mitre.org/techniques/T1003","identifiers":[{"type":"informative","value":"Attempts to invoke APIs commonly associated with credential theft and data exfiltration functionality"}],"sources":[{"report_type":"sandbox","report_id":"6836a5da950abe50e709d27c"},{"report_type":"sandbox","report_id":"6a9e91b0d972b9c71504dfdf"}]},{"tactic":"Credential Access","technique":"Keylogging","attack_id":"T1056.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1056/001","identifiers":[{"type":"informative","value":"Found strings related to keylogger"}],"sources":[{"report_type":"sandbox","report_id":"6836a5da950abe50e709d27c"},{"report_type":"sandbox","report_id":"6a9e91b0d972b9c71504dfdf"}]},{"tactic":"Credential Access","technique":"Network Sniffing","attack_id":"T1040","attack_id_wiki":"https://attack.mitre.org/techniques/T1040","identifiers":[{"type":"suspicious","value":"Contains ability to listen for incoming connections"}],"sources":[{"report_type":"sandbox","report_id":"6836a5da950abe50e709d27c"},{"report_type":"sandbox","report_id":"6a9e91b0d972b9c71504dfdf"}]},{"tactic":"Discovery","technique":"Process Discovery","attack_id":"T1057","attack_id_wiki":"https://attack.mitre.org/techniques/T1057","identifiers":[{"type":"informative","value":"Contains ability to enumerate process and/or its information (API string)"},{"type":"informative","value":"Spawns new processes"},{"type":"informative","value":"Able to enumerate system processes using native API"},{"type":"informative","value":"Calls an API typically used to determine if process is running under WOW64"},{"type":"informative","value":"Spawns new processes that are not known child processes"},{"type":"informative","value":"Process launched with changed environment"},{"type":"informative","value":"Contains ability to gather process details (Dotnet)"},{"type":"informative","value":"Queries basic information of the specified process"},{"type":"informative","value":"Calls an API typically used for taking snapshot of the specified processes"},{"type":"informative","value":"References to WMI query strings used for process discovery"}],"sources":[{"report_type":"sandbox","report_id":"6836a5da950abe50e709d27c"},{"report_type":"sandbox","report_id":"6a9e91b0d972b9c71504dfdf"}]},{"tactic":"Discovery","technique":"Remote System Discovery","attack_id":"T1018","attack_id_wiki":"https://attack.mitre.org/techniques/T1018","sources":[{"report_type":"sandbox","report_id":"6836a5da950abe50e709d27c"}]},{"tactic":"Discovery","technique":"File and Directory Discovery","attack_id":"T1083","attack_id_wiki":"https://attack.mitre.org/techniques/T1083","identifiers":[{"type":"informative","value":"Touches files"},{"type":"informative","value":"Tries to access non-existent files (non-executable)"},{"type":"informative","value":"References Windows file paths for DLLs (possible dropped files)"},{"type":"informative","value":"Calls an API typically used for searching a directory for files"},{"type":"informative","value":"Tries to access non-existent files (executable)"},{"type":"informative","value":"Reads files"}],"sources":[{"report_type":"sandbox","report_id":"6836a5da950abe50e709d27c"},{"report_type":"sandbox","report_id":"6a9e91b0d972b9c71504dfdf"}]},{"tactic":"Discovery","technique":"System Network Configuration Discovery","attack_id":"T1016","attack_id_wiki":"https://attack.mitre.org/techniques/T1016","identifiers":[{"type":"malicious","value":"Found a reference to an external IP address lookup service"},{"type":"informative","value":"Contains ability to retrieve network adapter information (Dotnet)"},{"type":"suspicious","value":"Reference to an external IP address lookup service identified"}],"sources":[{"report_type":"sandbox","report_id":"6836a5da950abe50e709d27c"},{"report_type":"sandbox","report_id":"6a9e91b0d972b9c71504dfdf"}]},{"tactic":"Discovery","technique":"Application Window Discovery","attack_id":"T1010","attack_id_wiki":"https://attack.mitre.org/techniques/T1010","identifiers":[{"type":"informative","value":"Calls an API typically used to get active windows title"},{"type":"informative","value":"Contains ability to get active window titles (Dotnet)"},{"type":"suspicious","value":"Able to retrieve open application windows"}],"sources":[{"report_type":"sandbox","report_id":"6836a5da950abe50e709d27c"},{"report_type":"sandbox","report_id":"6a9e91b0d972b9c71504dfdf"}]},{"tactic":"Discovery","technique":"System Language Discovery","attack_id":"T1614.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1614/001","identifiers":[{"type":"informative","value":"Reads the windows installation language"},{"type":"informative","value":"Contains ability to retrieve system language"}],"sources":[{"report_type":"sandbox","report_id":"6836a5da950abe50e709d27c"},{"report_type":"sandbox","report_id":"6a9e91b0d972b9c71504dfdf"}]},{"tactic":"Discovery","technique":"System Service Discovery","attack_id":"T1007","attack_id_wiki":"https://attack.mitre.org/techniques/T1007","identifiers":[{"type":"informative","value":"Queries services related registry keys"}],"sources":[{"report_type":"sandbox","report_id":"6836a5da950abe50e709d27c"},{"report_type":"sandbox","report_id":"6a9e91b0d972b9c71504dfdf"}]},{"tactic":"Discovery","technique":"System Owner/User Discovery","attack_id":"T1033","attack_id_wiki":"https://attack.mitre.org/techniques/T1033","identifiers":[{"type":"informative","value":"Contains ability to retrieve current user details (Dotnet)"},{"type":"informative","value":"Contains ability to retrieve user privileges"},{"type":"informative","value":"Able to query security token membership for user discovery (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve account information for specified SID"}],"sources":[{"report_type":"sandbox","report_id":"6836a5da950abe50e709d27c"},{"report_type":"sandbox","report_id":"6a9e91b0d972b9c71504dfdf"}]},{"tactic":"Discovery","technique":"Device Driver Discovery","attack_id":"T1652","attack_id_wiki":"https://attack.mitre.org/techniques/T1652","identifiers":[{"type":"informative","value":"Tries to retrieve device driver information"}],"sources":[{"report_type":"sandbox","report_id":"6836a5da950abe50e709d27c"}]},{"tactic":"Collection","technique":"Screen Capture","attack_id":"T1113","attack_id_wiki":"https://attack.mitre.org/techniques/T1113","identifiers":[{"type":"informative","value":"Contains ability to capture screen (API string)"},{"type":"informative","value":"Contains ability to capture screen information (Dotnet)"},{"type":"informative","value":"Able to capture screen (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6836a5da950abe50e709d27c"},{"report_type":"sandbox","report_id":"6a9e91b0d972b9c71504dfdf"}]},{"tactic":"Collection","technique":"Local Data Staging","attack_id":"T1074.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1074/001","identifiers":[{"type":"informative","value":"Writes log files"},{"type":"informative","value":"Calls an API typically used to create a directory"}],"sources":[{"report_type":"sandbox","report_id":"6836a5da950abe50e709d27c"},{"report_type":"sandbox","report_id":"6a9e91b0d972b9c71504dfdf"}]},{"tactic":"Command and Control","technique":"Proxy","attack_id":"T1090","attack_id_wiki":"https://attack.mitre.org/techniques/T1090","identifiers":[{"type":"informative","value":"Contains references to RPC protocol sequence strings"}],"sources":[{"report_type":"sandbox","report_id":"6836a5da950abe50e709d27c"},{"report_type":"sandbox","report_id":"6a9e91b0d972b9c71504dfdf"}]},{"tactic":"Command and Control","technique":"Web Protocols","attack_id":"T1071.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/001","identifiers":[{"type":"informative","value":"Found user-agent related strings"},{"type":"informative","value":"Contains ability to provide interface for network protocols (Dotnet)"},{"type":"informative","value":"Contains ability to communicate with network (Dotnet)"},{"type":"informative","value":"Found User Agent related strings"}],"sources":[{"report_type":"sandbox","report_id":"6836a5da950abe50e709d27c"},{"report_type":"sandbox","report_id":"6a9e91b0d972b9c71504dfdf"}]},{"tactic":"Command and Control","technique":"Data Encoding","attack_id":"T1132","attack_id_wiki":"https://attack.mitre.org/techniques/T1132","identifiers":[{"type":"informative","value":"Contains ability to perform Base64 encoding/decoding"}],"sources":[{"report_type":"sandbox","report_id":"6836a5da950abe50e709d27c"},{"report_type":"sandbox","report_id":"6a9e91b0d972b9c71504dfdf"}]},{"tactic":"Command and Control","technique":"Non-Standard Port","attack_id":"T1571","attack_id_wiki":"https://attack.mitre.org/techniques/T1571","identifiers":[{"type":"malicious","value":"Uses network protocols on unusual ports"},{"type":"suspicious","value":"Contains ability to open a port and listen for incoming connection"}],"sources":[{"report_type":"sandbox","report_id":"6836a5da950abe50e709d27c"},{"report_type":"sandbox","report_id":"6a9e91b0d972b9c71504dfdf"}]},{"tactic":"Command and Control","technique":"Ingress Tool Transfer","attack_id":"T1105","attack_id_wiki":"https://attack.mitre.org/techniques/T1105","identifiers":[{"type":"informative","value":"Contains ability to download files with network (Dotnet)"},{"type":"informative","value":"Able to download remote files (.NET)"},{"type":"suspicious","value":"Drops executable files"},{"type":"informative","value":"Dropped files"}],"sources":[{"report_type":"sandbox","report_id":"6836a5da950abe50e709d27c"},{"report_type":"sandbox","report_id":"6a9e91b0d972b9c71504dfdf"}]},{"tactic":"Command and Control","technique":"Symmetric Cryptography","attack_id":"T1573.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1573/001","identifiers":[{"type":"informative","value":"Contains ability to perform symmetric crypto operations"},{"type":"informative","value":"Shows ability to use encryption for command and control traffic"}],"sources":[{"report_type":"sandbox","report_id":"6836a5da950abe50e709d27c"},{"report_type":"sandbox","report_id":"6a9e91b0d972b9c71504dfdf"}]},{"tactic":"Command and Control","technique":"Non-Application Layer Protocol","attack_id":"T1095","attack_id_wiki":"https://attack.mitre.org/techniques/T1095","identifiers":[{"type":"informative","value":"Contains ability to communicate via sockets (Dotnet)"}],"sources":[{"report_type":"sandbox","report_id":"6836a5da950abe50e709d27c"},{"report_type":"sandbox","report_id":"6a9e91b0d972b9c71504dfdf"}]},{"tactic":"Command and Control","technique":"Asymmetric Cryptography","attack_id":"T1573.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1573/002","identifiers":[{"type":"informative","value":"Contains ability to perform asymmetric crypto operations"}],"sources":[{"report_type":"sandbox","report_id":"6836a5da950abe50e709d27c"},{"report_type":"sandbox","report_id":"6a9e91b0d972b9c71504dfdf"}]},{"tactic":"Execution","technique":"Inter-Process Communication","attack_id":"T1559","attack_id_wiki":"https://attack.mitre.org/techniques/T1559","identifiers":[{"type":"informative","value":"Connects to LPC ports"}],"sources":[{"report_type":"sandbox","report_id":"6a9e91b0d972b9c71504dfdf"}]},{"tactic":"Privilege Escalation","technique":"Exploitation for Privilege Escalation","attack_id":"T1068","attack_id_wiki":"https://attack.mitre.org/techniques/T1068","identifiers":[{"type":"informative","value":"Opens the Kernel Security Device Driver (KsecDD) of Windows"}],"sources":[{"report_type":"sandbox","report_id":"6a9e91b0d972b9c71504dfdf"}]},{"tactic":"Privilege Escalation","technique":"Process Injection","attack_id":"T1055","attack_id_wiki":"https://attack.mitre.org/techniques/T1055","identifiers":[{"type":"suspicious","value":"Spawned processes are likely due to an injection"}],"sources":[{"report_type":"sandbox","report_id":"6a9e91b0d972b9c71504dfdf"}]},{"tactic":"Defense Evasion","technique":"System Checks","attack_id":"T1497.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/001","identifiers":[{"type":"informative","value":"Able to identify virtual environment by using API string"}],"sources":[{"report_type":"sandbox","report_id":"6a9e91b0d972b9c71504dfdf"}]},{"tactic":"Defense Evasion","technique":"Debugger Evasion","attack_id":"T1622","attack_id_wiki":"https://attack.mitre.org/techniques/T1622","sources":[{"report_type":"sandbox","report_id":"6a9e91b0d972b9c71504dfdf"}]},{"tactic":"Defense Evasion","technique":"Mutual Exclusion","attack_id":"T1480.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1480/002","identifiers":[{"type":"informative","value":"Creates mutants"}],"sources":[{"report_type":"sandbox","report_id":"6a9e91b0d972b9c71504dfdf"}]},{"tactic":"Defense Evasion","technique":"Masquerade Task or Service","attack_id":"T1036.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1036/004","sources":[{"report_type":"sandbox","report_id":"6a9e91b0d972b9c71504dfdf"}]},{"tactic":"Defense Evasion","technique":"Indicator Removal from Tools","attack_id":"T1027.005","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/005","identifiers":[{"type":"informative","value":"XOR operations in executable file detected"}],"sources":[{"report_type":"sandbox","report_id":"6a9e91b0d972b9c71504dfdf"}]},{"tactic":"Credential Access","technique":"Steal or Forge Kerberos Tickets","attack_id":"T1558","attack_id_wiki":"https://attack.mitre.org/techniques/T1558","identifiers":[{"type":"informative","value":"Able to access credential file using Kerberos"}],"sources":[{"report_type":"sandbox","report_id":"6a9e91b0d972b9c71504dfdf"}]},{"tactic":"Discovery","technique":"Domain Groups","attack_id":"T1069.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1069/002","identifiers":[{"type":"informative","value":"References Windows LDAP client module"},{"type":"informative","value":"Loads Windows LDAP client module"}],"sources":[{"report_type":"sandbox","report_id":"6a9e91b0d972b9c71504dfdf"}]},{"tactic":"Discovery","technique":"System Location Discovery","attack_id":"T1614","attack_id_wiki":"https://attack.mitre.org/techniques/T1614","identifiers":[{"type":"informative","value":"Calls an API typically used to retrieve local language"}],"sources":[{"report_type":"sandbox","report_id":"6a9e91b0d972b9c71504dfdf"}]},{"tactic":"Lateral Movement","technique":"Remote Services","attack_id":"T1021","attack_id_wiki":"https://attack.mitre.org/techniques/T1021","identifiers":[{"type":"informative","value":"Calls an API typically used to register an interface (RPC)"}],"sources":[{"report_type":"sandbox","report_id":"6a9e91b0d972b9c71504dfdf"}]},{"tactic":"Exfiltration","technique":"Exfiltration Over Asymmetric Encrypted Non-C2 Protocol","attack_id":"T1048.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1048/002","identifiers":[{"type":"informative","value":"Contains references to SFTP or FTPS file transfer"}],"sources":[{"report_type":"sandbox","report_id":"6a9e91b0d972b9c71504dfdf"}]}],"sandbox_signatures":[{"level":"informative","category":"Pattern Matching","name":"YARA signature match - AES encryption","description":"YARA signature for AES encryption matched on file \"sample.bin\"","origin":"Static Analysis","mitre_attack_id":"T1027","id":"yara-103","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6836a5da950abe50e709d27c"},{"report_type":"sandbox","report_id":"6a9e91b0d972b9c71504dfdf"}]},{"level":"suspicious","category":"Pattern Matching","name":"YARA signature match - MD5 algorithm","description":"YARA signature for MD5 algorithm matched on file \"sample.bin\"","origin":"Static Analysis","mitre_attack_id":"T1027","id":"yara-112","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6836a5da950abe50e709d27c"},{"report_type":"sandbox","report_id":"6a9e91b0d972b9c71504dfdf"}]},{"level":"malicious","category":"External Systems","name":"CrowdStrike ML for Portable Executable (On Sensor) detected file with high confidence","description":"\"Portable Executable (On Sensor) Model\" detected file as \"dirty\" with \"high\" confidence","origin":"Static Analysis","id":"mlmodel-12","sources":[{"report_type":"qsp","report_id":""}]},{"level":"malicious","category":"External Systems","name":"CrowdStrike ML for Portable Executable (Cloud) detected file with high confidence","description":"\"Portable Executable (Cloud) Model\" detected file as \"dirty\" with \"high\" confidence","origin":"Static Analysis","id":"mlmodel-16","sources":[{"report_type":"qsp","report_id":""}]},{"level":"suspicious","category":"Installation/Persistence","name":"Found registry location strings which can modify auto-execute functionality","description":"$25","origin":"sample.bin","mitre_attack_id":"T1547","id":"string-184","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"General","name":"Contains registry location strings","description":"\"SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run\" in Source: sample.bin, \"BraveSoftware\\Brave-Browser\\User Data\\Local State\" in Source: sample.bin, \"Opera Software\\Opera GX Stable\\Login Data\" in Source: sample.bin, \"SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Run\" in Source: sample.bin, \"Software\\Microsoft\\Internet Explorer\\IntelliForms\\Storage2\" in Source: sample.bin, \"Opera Software\\Opera Stable\\Login Data\" in Source: sample.bin, \"SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\RunOnce\" in Source: sample.bin, \"SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\RunOnce\" in Source: sample.bin, \"BraveSoftware\\Brave-Browser\\User Data\\Default\\Login Data\" in Source: sample.bin, \"SOFTWARE\\\\Martin Prikryl\\\\WinSCP 2\\\\Sessions\" in Source: sample.bin, \"Opera Software\\Opera GX Stable\\Local State\" in Source: sample.bin, \"Software\\Microsoft\\Windows\\CurrentVersion\\Run\" in Source: sample.bin, \"Opera Software\\Opera Stable\\Local State\" in Source: sample.bin","origin":"sample.bin","mitre_attack_id":"T1012","id":"string-120","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6836a5da950abe50e709d27c"},{"report_type":"sandbox","report_id":"6a9e91b0d972b9c71504dfdf"}]},{"level":"informative","category":"General","name":"Contains native function calls (syscalls strings)","description":"$26","origin":"sample.bin","mitre_attack_id":"T1106","id":"string-5000","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"General","name":"Possibly checks for the presence of an Antivirus engine","description":"\"Antivirus\" (Indicator: \"antivirus\") in Source: sample.bin","origin":"sample.bin","mitre_attack_id":"T1518.001","id":"string-8","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6836a5da950abe50e709d27c"},{"report_type":"sandbox","report_id":"6a9e91b0d972b9c71504dfdf"}]},{"level":"informative","category":"General","name":"Found well known domains (string)","description":"\"Are you mixing protobuf-net and protobuf-csharp-port? See https://stackoverflow.com/q/11564914/23354; type: \" (Indicator: \"stackoverflow.com\"), \"; please see https://stackoverflow.com/q/14436606/23354\" (Indicator: \"stackoverflow.com\")","origin":"sample.bin","id":"string-135","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6836a5da950abe50e709d27c"},{"report_type":"sandbox","report_id":"6a9e91b0d972b9c71504dfdf"}]},{"level":"informative","category":"General","name":"Contains SQL queries","description":"\"SELECT Caption FROM Win32_OperatingSystem\" (Source: sample.bin, Indicator: \"select caption from win32_operatingsystem\")","origin":"sample.bin","mitre_attack_id":"T1213","id":"string-16","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6836a5da950abe50e709d27c"},{"report_type":"sandbox","report_id":"6a9e91b0d972b9c71504dfdf"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains reference to cryptographic keys","description":"$27","origin":"sample.bin","mitre_attack_id":"T1486","id":"string-280","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6836a5da950abe50e709d27c"},{"report_type":"sandbox","report_id":"6a9e91b0d972b9c71504dfdf"}]},{"level":"informative","category":"Cryptographic Related","name":"Found a cryptographic related string in Linux binary","description":"Observed cryptographic string -(Indicator: \"des-cbc\"), Observed cryptographic string -(Indicator: \"rc2-cbc\"), Observed cryptographic string -(Indicator: \"idea-cbc\")","origin":"sample.bin","mitre_attack_id":"T1027","id":"string-5004","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains CRYPTO related strings","description":"$28","origin":"sample.bin","mitre_attack_id":"T1027","id":"string-57","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6836a5da950abe50e709d27c"},{"report_type":"sandbox","report_id":"6a9e91b0d972b9c71504dfdf"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Identified FTP credentials location strings","description":"\"{0}\\FileZilla\\sitemanager.xml\" (Indicator: \"sitemanager.xml\") in Source: sample.bin, \"{0}\\FileZilla\\recentservers.xml\" (Indicator: \"recentservers.xml\") in Source: sample.bin","origin":"sample.bin","mitre_attack_id":"T1552.001","id":"string-11","sources":[{"report_type":"qsp","report_id":""}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Found browser information locations related strings","description":"$29","origin":"sample.bin","mitre_attack_id":"T1005","id":"string-93","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Found system command-related strings","description":"Found string \"HostName\" (Indicator: \"hostname\"; Source: \"sample.bin\"), Found string \"'name' is not a HostName string\" (Indicator: \"hostname\"; Source: \"sample.bin\"), Found string \"hostname\" (Indicator: \"hostname\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1082","id":"string-126","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a9e91b0d972b9c71504dfdf"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains string like password/secret","description":"Found string \"no password supplied when one expected\" (Indicator: \"password\"; Source: \"sample.bin\"), Found string \"Missing password.\" (Indicator: \"password\"; Source: \"sample.bin\"), Found string \"BCrypt password must be <= 72 bytes\" (Indicator: \"password\"; Source: \"sample.bin\"), Found string \"cannot export keying material without extended_master_secret\" (Indicator: \"secret\"; Source: \"sample.bin\"), Found string \"password_value\" (Indicator: \"password\"; Source: \"sample.bin\"), Found string \"Export of key material requires extended_master_secret\" (Indicator: \"secret\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1555","id":"string-475","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6836a5da950abe50e709d27c"},{"report_type":"sandbox","report_id":"6a9e91b0d972b9c71504dfdf"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Able to retrieve saved login credentials from browser","description":"Found string \"logins.json\" (Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1555.003","id":"string-693","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"References to WMI query strings used for information discovery","description":"Found string \"SELECT Caption FROM Win32_OperatingSystem\" (Indicator: \" Win32_OperatingSystem\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1082","id":"string-507","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6836a5da950abe50e709d27c"},{"report_type":"sandbox","report_id":"6a9e91b0d972b9c71504dfdf"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to use Cryptographic classes","description":"$2a","origin":"sample.bin","mitre_attack_id":"T1027","id":"string-138","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6836a5da950abe50e709d27c"},{"report_type":"sandbox","report_id":"6a9e91b0d972b9c71504dfdf"}]},{"level":"informative","category":"Network Related","name":"Found potential IP address in binary/memory","description":"\"1.4.1.0\", \"2.5.1.1\", \"2.5.29.37\", \"2.5.29.17\", \"2.5.29.18\", \"2.5.29.19\", \"2.5.29.15\", \"2.4.0.0\", \"1.9.0.1\", Potential IP \"2.4.8.1\" found in string \"2.4.8.1+cce1c58590\", \"1.3.132.0\"","origin":"sample.bin","mitre_attack_id":"T1071","id":"string-14","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6836a5da950abe50e709d27c"},{"report_type":"sandbox","report_id":"6a9e91b0d972b9c71504dfdf"}]},{"level":"informative","category":"Network Related","name":"Able to check internet connectivity using ping command","description":"Found string \"@echo off\nchcp 65001\necho DONT CLOSE THIS WINDOW!\nping -n 10 localhost > nul\ndel /a /q /f \"\" (Indicator: \"ping -\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1016.001","id":"string-5070","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a9e91b0d972b9c71504dfdf"}]},{"level":"informative","category":"Network Related","name":"Possibly tries to communicate over SSL connection (HTTPS)","description":"Found HTTPS url \"https://ipwho.is\", Found HTTPS url \"https://stackoverflow.com\"","origin":"sample.bin","mitre_attack_id":"T1573","id":"string-98","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6836a5da950abe50e709d27c"},{"report_type":"sandbox","report_id":"6a9e91b0d972b9c71504dfdf"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"Pattern match: \"https://ipwho.is/\", Pattern match: \"https://stackoverflow.com/q/11564914/23354\", Heuristic match: \"\n*.sy\", Pattern match: \"https://stackoverflow.com/q/14436606/23354\"","origin":"sample.bin","mitre_attack_id":"T1071","id":"string-3","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6836a5da950abe50e709d27c"},{"report_type":"sandbox","report_id":"6a9e91b0d972b9c71504dfdf"}]},{"level":"informative","category":"System Security","name":"Contains ability to shutdown system","description":"Observed string: \"shutdown\" (Indicator: \"shutdown\") in Source: sample.bin","origin":"sample.bin","mitre_attack_id":"T1529","id":"string-406","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6836a5da950abe50e709d27c"},{"report_type":"sandbox","report_id":"6a9e91b0d972b9c71504dfdf"}]},{"level":"suspicious","category":"Environment Awareness","name":"Found a reference to a WMI query string known to be used for VM detection","description":"\"SELECT Caption FROM Win32_OperatingSystem\" (Indicator: \" win32_operatingsystem\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1047","id":"string-55","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6836a5da950abe50e709d27c"},{"report_type":"sandbox","report_id":"6a9e91b0d972b9c71504dfdf"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to generate intermediate language instructions (Dotnet)","description":"Observed namespace \"System.Reflection.Emit.DynamicMethod\" and TypeReference \"GetILGenerator\" in \"afb24fab9c0b0f9e60d81bd7fd2d7999c842bf00b5bb9e0bf7347e36eacafad7\"\n Observed namespace \"System.Reflection.Emit.ILGenerator\" and TypeReference \"Emit\" in \"afb24fab9c0b0f9e60d81bd7fd2d7999c842bf00b5bb9e0bf7347e36eacafad7\"\n Observed namespace \"System.Reflection.Emit.ILGenerator\" and TypeReference \"EmitCall\" in \"afb24fab9c0b0f9e60d81bd7fd2d7999c842bf00b5bb9e0bf7347e36eacafad7\"\n Observed namespace \"System.Reflection.Emit.DynamicMethod\" and TypeReference \"GetILGenerator\" in \"fortnitemap.exe.bin\"\n Observed namespace \"System.Reflection.Emit.ILGenerator\" and TypeReference \"Emit\" in \"fortnitemap.exe.bin\"\n Observed namespace \"System.Reflection.Emit.ILGenerator\" and TypeReference \"EmitCall\" in \"fortnitemap.exe.bin\"","origin":"Static Parser","mitre_attack_id":"T1620","relevance":1,"id":"static-171","sources":[{"report_type":"sandbox","report_id":"6836a5da950abe50e709d27c"},{"report_type":"sandbox","report_id":"6a9e91b0d972b9c71504dfdf"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to load content into memory (Dotnet)","description":"$2b","origin":"Static Parser","mitre_attack_id":"T1140","relevance":1,"id":"static-107","sources":[{"report_type":"sandbox","report_id":"6836a5da950abe50e709d27c"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to perform Base64 encoding/decoding","description":"Found string \"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/3\" (Indicator: \"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+\"; File: \"afb24fab9c0b0f9e60d81bd7fd2d7999c842bf00b5bb9e0bf7347e36eacafad7\")\n Found string \"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/3\" (Indicator: \"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/\"; File: \"afb24fab9c0b0f9e60d81bd7fd2d7999c842bf00b5bb9e0bf7347e36eacafad7\")","origin":"File/Memory","mitre_attack_id":"T1132","relevance":1,"id":"string-338","sources":[{"report_type":"sandbox","report_id":"6836a5da950abe50e709d27c"},{"report_type":"sandbox","report_id":"6a9e91b0d972b9c71504dfdf"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Dotnet file contains encryption/decryption functions","description":"Observed namespace \"System.Security.Cryptography\" and MemberReference \"CreateDecryptor\" in \"afb24fab9c0b0f9e60d81bd7fd2d7999c842bf00b5bb9e0bf7347e36eacafad7\"\n Observed namespace \"System.Security.Cryptography\" and MemberReference \"CreateDecryptor\" in \"fortnitemap.exe.bin\"","origin":"Static Parser","mitre_attack_id":"T1027","relevance":1,"id":"static-134","sources":[{"report_type":"sandbox","report_id":"6836a5da950abe50e709d27c"},{"report_type":"sandbox","report_id":"6a9e91b0d972b9c71504dfdf"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Dotnet file contains function to dynamically call methods at runtime","description":"Observed namespace \"System\" and MemberReference \"GetMethod\" in \"afb24fab9c0b0f9e60d81bd7fd2d7999c842bf00b5bb9e0bf7347e36eacafad7\"\n Observed namespace \"System.Reflection\" and MemberReference \"GetGetMethod\" in \"afb24fab9c0b0f9e60d81bd7fd2d7999c842bf00b5bb9e0bf7347e36eacafad7\"\n Observed namespace \"System\" and MemberReference \"GetMethods\" in \"afb24fab9c0b0f9e60d81bd7fd2d7999c842bf00b5bb9e0bf7347e36eacafad7\"\n Observed namespace \"System\" and MemberReference \"GetMethod\" in \"fortnitemap.exe.bin\"\n Observed namespace \"System.Reflection\" and MemberReference \"GetGetMethod\" in \"fortnitemap.exe.bin\"\n Observed namespace \"System\" and MemberReference \"GetMethods\" in \"fortnitemap.exe.bin\"","origin":"Static Parser","mitre_attack_id":"T1027.002","relevance":1,"id":"static-135","sources":[{"report_type":"sandbox","report_id":"6836a5da950abe50e709d27c"},{"report_type":"sandbox","report_id":"6a9e91b0d972b9c71504dfdf"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to decode string content at runtime (Dotnet)","description":"Observed function \"FromBase64String\" in \"afb24fab9c0b0f9e60d81bd7fd2d7999c842bf00b5bb9e0bf7347e36eacafad7\"\n Observed function \"ToBase64String\" in \"afb24fab9c0b0f9e60d81bd7fd2d7999c842bf00b5bb9e0bf7347e36eacafad7\"\n Observed function \"FromBase64String\" in \"fortnitemap.exe.bin\"\n Observed function \"ToBase64String\" in \"fortnitemap.exe.bin\"","origin":"Static Parser","mitre_attack_id":"T1140","relevance":1,"id":"static-106","sources":[{"report_type":"sandbox","report_id":"6836a5da950abe50e709d27c"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform AES/RC4 encryption (API string)","description":"Found reference to API \"CryptHashData\" (Indicator: \"CryptHashData\"; File: \"afb24fab9c0b0f9e60d81bd7fd2d7999c842bf00b5bb9e0bf7347e36eacafad7\")","origin":"File/Memory","mitre_attack_id":"T1027","relevance":3,"id":"string-438","sources":[{"report_type":"sandbox","report_id":"6836a5da950abe50e709d27c"},{"report_type":"sandbox","report_id":"6a9e91b0d972b9c71504dfdf"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform CryptoStream operations (Dotnet)","description":"Observed namespace \"System.Security.Cryptography.CryptoStream\" and TypeReference \"FlushFinalBlock\" in \"afb24fab9c0b0f9e60d81bd7fd2d7999c842bf00b5bb9e0bf7347e36eacafad7\"\n Observed namespace \"System.Security.Cryptography.CryptoStream\" and TypeReference \"FlushFinalBlock\" in \"fortnitemap.exe.bin\"","origin":"Static Parser","mitre_attack_id":"T1027","relevance":1,"id":"static-166","sources":[{"report_type":"sandbox","report_id":"6836a5da950abe50e709d27c"},{"report_type":"sandbox","report_id":"6a9e91b0d972b9c71504dfdf"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform asymmetric crypto operations","description":"$2c","origin":"Static Parser","mitre_attack_id":"T1573.002","relevance":1,"id":"static-141","sources":[{"report_type":"sandbox","report_id":"6836a5da950abe50e709d27c"},{"report_type":"sandbox","report_id":"6a9e91b0d972b9c71504dfdf"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform crypto operations","description":"Observed namespace \"System.Security.Cryptography\" in [Source: \"afb24fab9c0b0f9e60d81bd7fd2d7999c842bf00b5bb9e0bf7347e36eacafad7\"]\n Observed namespace \"System.Security.Cryptography.X509Certificates\" in [Source: \"afb24fab9c0b0f9e60d81bd7fd2d7999c842bf00b5bb9e0bf7347e36eacafad7\"]","origin":"Static Parser","mitre_attack_id":"T1027","relevance":1,"id":"static-118","sources":[{"report_type":"sandbox","report_id":"6836a5da950abe50e709d27c"},{"report_type":"sandbox","report_id":"6a9e91b0d972b9c71504dfdf"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform decryption (API string)","description":"Found reference to API \"CryptDecrypt\" (Indicator: \"CryptDecrypt\"; Source: \"00000000-00003644.00000000.98170.029D0000.00000004.mdmp, 00000000-00003644.00000001.100092.029D0000.00000004.mdmp, 00000000-00003644.00000002.102012.029D0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1140","relevance":1,"id":"string-212","sources":[{"report_type":"sandbox","report_id":"6836a5da950abe50e709d27c"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform symmetric crypto operations","description":"Observed namespace \"System.Security.Cryptography.AesCryptoServiceProvider\" and TypeReference \".ctor\" in \"afb24fab9c0b0f9e60d81bd7fd2d7999c842bf00b5bb9e0bf7347e36eacafad7\"\n Observed namespace \"System.Security.Cryptography.AesCryptoServiceProvider\" and TypeReference \".ctor\" in \"fortnitemap.exe.bin\"","origin":"Static Parser","mitre_attack_id":"T1573.001","relevance":1,"id":"static-140","sources":[{"report_type":"sandbox","report_id":"6836a5da950abe50e709d27c"},{"report_type":"sandbox","report_id":"6a9e91b0d972b9c71504dfdf"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform symmetric decryption (Dotnet)","description":"Observed namespace \"System.Security.Cryptography.SymmetricAlgorithm\" and TypeReference \"CreateDecryptor\" in \"afb24fab9c0b0f9e60d81bd7fd2d7999c842bf00b5bb9e0bf7347e36eacafad7\"\n Observed namespace \"System.Security.Cryptography.SymmetricAlgorithm\" and TypeReference \"CreateDecryptor\" in \"fortnitemap.exe.bin\"","origin":"Static Parser","mitre_attack_id":"T1140","relevance":1,"id":"static-168","sources":[{"report_type":"sandbox","report_id":"6836a5da950abe50e709d27c"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform symmetric encryption (Dotnet)","description":"Observed namespace \"System.Security.Cryptography.SymmetricAlgorithm\" and TypeReference \"CreateEncryptor\" in \"afb24fab9c0b0f9e60d81bd7fd2d7999c842bf00b5bb9e0bf7347e36eacafad7\"\n Observed namespace \"System.Security.Cryptography.SymmetricAlgorithm\" and TypeReference \"CreateEncryptor\" in \"fortnitemap.exe.bin\"","origin":"Static Parser","mitre_attack_id":"T1027","relevance":1,"id":"static-165","sources":[{"report_type":"sandbox","report_id":"6836a5da950abe50e709d27c"},{"report_type":"sandbox","report_id":"6a9e91b0d972b9c71504dfdf"}]},{"level":"informative","category":"Cryptographic Related","name":"Dotnet code contains ability to generate random numbers","description":"Observed namespace \"System.Security.Cryptography.RandomNumberGenerator\" and TypeReference \"GetBytes\" in \"afb24fab9c0b0f9e60d81bd7fd2d7999c842bf00b5bb9e0bf7347e36eacafad7\"\n Observed namespace \"System.Security.Cryptography.RandomNumberGenerator\" and TypeReference \"Create\" in \"afb24fab9c0b0f9e60d81bd7fd2d7999c842bf00b5bb9e0bf7347e36eacafad7\"\n Observed namespace \"System.Security.Cryptography.RandomNumberGenerator\" and TypeReference \"GetBytes\" in \"fortnitemap.exe.bin\"\n Observed namespace \"System.Security.Cryptography.RandomNumberGenerator\" and TypeReference \"Create\" in \"fortnitemap.exe.bin\"","origin":"Static Parser","mitre_attack_id":"T1027","relevance":1,"id":"static-150","sources":[{"report_type":"sandbox","report_id":"6836a5da950abe50e709d27c"},{"report_type":"sandbox","report_id":"6a9e91b0d972b9c71504dfdf"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to deobfuscate/decode files or information","description":"The analysis shows use of encryption and can be used to decode file or information. Matched sigs: Contains ability to perform Base64 encoding/decoding\n Matched sigs: YARA signature match - AES encryption","origin":"Indicator Combinations","mitre_attack_id":"T1140","relevance":1,"id":"summary-32","sources":[{"report_type":"sandbox","report_id":"6836a5da950abe50e709d27c"},{"report_type":"sandbox","report_id":"6a9e91b0d972b9c71504dfdf"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to obfuscate file or information","description":"$2d","origin":"Indicator Combinations","mitre_attack_id":"T1027","relevance":1,"id":"summary-28","sources":[{"report_type":"sandbox","report_id":"6836a5da950abe50e709d27c"},{"report_type":"sandbox","report_id":"6a9e91b0d972b9c71504dfdf"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to use encryption for command and control traffic","description":"The analysis shows use of encryption\n use of http/https that can be used to send encrypted data on command and control server. Matched sigs: YARA signature match - AES encryption\n Matched sigs: Found potential URL in binary/memory\n Matched sigs: Found potential IP address in binary/memory\n Matched sigs: Contacts server\n Matched sigs: Spawned process connects to a network\n Matched sigs: Contains ability to communicates via socket (possible C&C communication)\n Matched sigs: Possibly tries to communicate over SSL connection (HTTPS)","origin":"Indicator Combinations","mitre_attack_id":"T1573.001","relevance":1,"id":"summary-31","sources":[{"report_type":"sandbox","report_id":"6836a5da950abe50e709d27c"},{"report_type":"sandbox","report_id":"6a9e91b0d972b9c71504dfdf"}]},{"level":"informative","category":"Environment Awareness","name":"Able to visualize and control listed components (API string)","description":"Found reference to API \"PostMessage\" (Indicator: \"postmessage\"; Source: \"00000000-00003644-00000C2B-542234981\")\n Found reference to API \"PostMessageW\" (Indicator: \"postmessage\"; Source: \"00000000-00003644-00000C2B-542235030\")","origin":"File/Memory","mitre_attack_id":"T1055.015","relevance":1,"id":"string-721","sources":[{"report_type":"sandbox","report_id":"6836a5da950abe50e709d27c"},{"report_type":"sandbox","report_id":"6a9e91b0d972b9c71504dfdf"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to call APIs to gather system and hardware detail","description":"\"afb24fab9c0b0f9e60d81bd7fd2d7999c842bf00b5bb9e0bf7347e36eacafad7.exe\" called \"GetSystemInfo\" with parameters (UID: 00000000-00003644)\n \"afb24fab9c0b0f9e60d81bd7fd2d7999c842bf00b5bb9e0bf7347e36eacafad7.exe\" called \"QueryPerformanceCounter\" (UID: 00000000-00003644)\n \"afb24fab9c0b0f9e60d81bd7fd2d7999c842bf00b5bb9e0bf7347e36eacafad7.exe\" called \"GetSystemMetrics\" with parameters (UID: 00000000-00003644)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-294","sources":[{"report_type":"sandbox","report_id":"6836a5da950abe50e709d27c"},{"report_type":"sandbox","report_id":"6a9e91b0d972b9c71504dfdf"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to invoke APIs commonly associated with credential theft and data exfiltration functionality","description":"\"afb24fab9c0b0f9e60d81bd7fd2d7999c842bf00b5bb9e0bf7347e36eacafad7.exe\" called \"NtQueryInformationToken\" with parameters (UID: 00000000-00003644)","origin":"API Call","mitre_attack_id":"T1003","relevance":3,"id":"api-297","sources":[{"report_type":"sandbox","report_id":"6836a5da950abe50e709d27c"},{"report_type":"sandbox","report_id":"6a9e91b0d972b9c71504dfdf"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get active windows title","description":"\"afb24fab9c0b0f9e60d81bd7fd2d7999c842bf00b5bb9e0bf7347e36eacafad7.exe\" called \"GetWindowTextW\" (UID: 00000000-00003644)","origin":"API Call","mitre_attack_id":"T1010","relevance":3,"id":"api-151","sources":[{"report_type":"sandbox","report_id":"6836a5da950abe50e709d27c"},{"report_type":"sandbox","report_id":"6a9e91b0d972b9c71504dfdf"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get system version information","description":"\"afb24fab9c0b0f9e60d81bd7fd2d7999c842bf00b5bb9e0bf7347e36eacafad7.exe\" called \"RtlGetVersion\" with parameter 140100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00003644)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-125","sources":[{"report_type":"sandbox","report_id":"6836a5da950abe50e709d27c"},{"report_type":"sandbox","report_id":"6a9e91b0d972b9c71504dfdf"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to execute WMI queries (Dotnet)","description":"Observed namespace \"System.Management.ManagementObjectSearcher\" in \"afb24fab9c0b0f9e60d81bd7fd2d7999c842bf00b5bb9e0bf7347e36eacafad7\"\n Observed namespace \"System.Management.ManagementObjectSearcher\" in \"fortnitemap.exe.bin\"","origin":"Static Parser","mitre_attack_id":"T1047","relevance":1,"id":"static-114","sources":[{"report_type":"sandbox","report_id":"6836a5da950abe50e709d27c"},{"report_type":"sandbox","report_id":"6a9e91b0d972b9c71504dfdf"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to execute a WMI query","description":"$2e","origin":"File/Memory","mitre_attack_id":"T1047","relevance":1,"id":"string-433","sources":[{"report_type":"sandbox","report_id":"6836a5da950abe50e709d27c"},{"report_type":"sandbox","report_id":"6a9e91b0d972b9c71504dfdf"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to gather system environment details","description":"Observed function \"GetEnvironmentVariable\" in \"afb24fab9c0b0f9e60d81bd7fd2d7999c842bf00b5bb9e0bf7347e36eacafad7\"\n Observed function \"GetEnvironmentVariable\" in \"fortnitemap.exe.bin\"","origin":"Static Parser","mitre_attack_id":"T1082","relevance":1,"id":"static-119","sources":[{"report_type":"sandbox","report_id":"6836a5da950abe50e709d27c"},{"report_type":"sandbox","report_id":"6a9e91b0d972b9c71504dfdf"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to gather system information (Dotnet)","description":"Observed function \"get_UserName\" in \"afb24fab9c0b0f9e60d81bd7fd2d7999c842bf00b5bb9e0bf7347e36eacafad7\"\n Observed function \"get_SystemDirectory\" in \"afb24fab9c0b0f9e60d81bd7fd2d7999c842bf00b5bb9e0bf7347e36eacafad7\"\n Observed function \"get_MachineName\" in \"afb24fab9c0b0f9e60d81bd7fd2d7999c842bf00b5bb9e0bf7347e36eacafad7\"\n Observed function \"get_OSVersion\" in \"afb24fab9c0b0f9e60d81bd7fd2d7999c842bf00b5bb9e0bf7347e36eacafad7\"\n Observed function \"get_Is64BitOperatingSystem\" in \"afb24fab9c0b0f9e60d81bd7fd2d7999c842bf00b5bb9e0bf7347e36eacafad7\"\n Observed function \"get_UserName\" in \"fortnitemap.exe.bin\"\n Observed function \"get_SystemDirectory\" in \"fortnitemap.exe.bin\"\n Observed function \"get_MachineName\" in \"fortnitemap.exe.bin\"\n Observed function \"get_OSVersion\" in \"fortnitemap.exe.bin\"\n Observed function \"get_Is64BitOperatingSystem\" in \"fortnitemap.exe.bin\"","origin":"Static Parser","mitre_attack_id":"T1082","relevance":1,"id":"static-120","sources":[{"report_type":"sandbox","report_id":"6836a5da950abe50e709d27c"},{"report_type":"sandbox","report_id":"6a9e91b0d972b9c71504dfdf"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to get active window titles (Dotnet)","description":"Observed Namespace \"System.Diagnostics.Process\" and MemberReference \"get_MainWindowTitle\" in \"afb24fab9c0b0f9e60d81bd7fd2d7999c842bf00b5bb9e0bf7347e36eacafad7\"\n Observed Namespace \"System.Diagnostics.Process\" and MemberReference \"get_MainWindowTitle\" in \"fortnitemap.exe.bin\"","origin":"Static Parser","mitre_attack_id":"T1010","relevance":1,"id":"static-148","sources":[{"report_type":"sandbox","report_id":"6836a5da950abe50e709d27c"},{"report_type":"sandbox","report_id":"6a9e91b0d972b9c71504dfdf"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query the machine version","description":"Org.BouncyCastle.Asn1.Pkcs.PrivateKeyInfo::GetVersionValue(Org.BouncyCastle.Asn1.DerInteger) at 5462e80e464d9b44b4f0226f0b6d5c2b-6004ed7-ctor","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1082","relevance":1,"id":"stream-3","sources":[{"report_type":"sandbox","report_id":"6836a5da950abe50e709d27c"},{"report_type":"sandbox","report_id":"6a9e91b0d972b9c71504dfdf"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to read software policies","description":"\"afb24fab9c0b0f9e60d81bd7fd2d7999c842bf00b5bb9e0bf7347e36eacafad7.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\")\n \"afb24fab9c0b0f9e60d81bd7fd2d7999c842bf00b5bb9e0bf7347e36eacafad7.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"AUTHENTICODEENABLED\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":1,"id":"registry-78","sources":[{"report_type":"sandbox","report_id":"6836a5da950abe50e709d27c"},{"report_type":"sandbox","report_id":"6a9e91b0d972b9c71504dfdf"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve current user details (Dotnet)","description":"Observed Namespace \"System.Security.Principal.WindowsIdentity\" and MemberReference \"GetCurrent\" in \"afb24fab9c0b0f9e60d81bd7fd2d7999c842bf00b5bb9e0bf7347e36eacafad7\"\n Observed Namespace \"System.Security.Principal.WindowsIdentity\" and MemberReference \"GetCurrent\" in \"fortnitemap.exe.bin\"","origin":"Static Parser","mitre_attack_id":"T1033","relevance":1,"id":"static-152","sources":[{"report_type":"sandbox","report_id":"6836a5da950abe50e709d27c"},{"report_type":"sandbox","report_id":"6a9e91b0d972b9c71504dfdf"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve network adapter information (Dotnet)","description":"Observed namespace \"System.Net.NetworkInformation\" and TypeReference \"NetworkInterface\" in \"afb24fab9c0b0f9e60d81bd7fd2d7999c842bf00b5bb9e0bf7347e36eacafad7\"\n Observed namespace \"System.Net.NetworkInformation\" and TypeReference \"NetworkInterface\" in \"fortnitemap.exe.bin\"","origin":"Static Parser","mitre_attack_id":"T1016","relevance":1,"id":"static-137","sources":[{"report_type":"sandbox","report_id":"6836a5da950abe50e709d27c"},{"report_type":"sandbox","report_id":"6a9e91b0d972b9c71504dfdf"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve system language","description":"Gma.System.MouseKeyHook.WinApi.KeyboardNativeMethods::GetKeyboardLayout(System.Int32) at 5462e80e464d9b44b4f0226f0b6d5c2b-6000980-KeyboardNativeMethods~GetActiveKeyboard","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1614.001","relevance":3,"id":"stream-79","sources":[{"report_type":"sandbox","report_id":"6836a5da950abe50e709d27c"},{"report_type":"sandbox","report_id":"6a9e91b0d972b9c71504dfdf"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the active computer name","description":"\"afb24fab9c0b0f9e60d81bd7fd2d7999c842bf00b5bb9e0bf7347e36eacafad7.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":5,"id":"registry-35","sources":[{"report_type":"sandbox","report_id":"6836a5da950abe50e709d27c"},{"report_type":"sandbox","report_id":"6a9e91b0d972b9c71504dfdf"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the cryptographic machine GUID","description":"\"afb24fab9c0b0f9e60d81bd7fd2d7999c842bf00b5bb9e0bf7347e36eacafad7.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":5,"id":"registry-1","sources":[{"report_type":"sandbox","report_id":"6836a5da950abe50e709d27c"},{"report_type":"sandbox","report_id":"6a9e91b0d972b9c71504dfdf"}]},{"level":"informative","category":"Environment Awareness","name":"References to WMI query strings used for process discovery","description":"Found string \"SELECT * FROM Win32_Processor\" (Indicator: \" Win32_Process\"; File: \"afb24fab9c0b0f9e60d81bd7fd2d7999c842bf00b5bb9e0bf7347e36eacafad7\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-513","sources":[{"report_type":"sandbox","report_id":"6836a5da950abe50e709d27c"},{"report_type":"sandbox","report_id":"6a9e91b0d972b9c71504dfdf"}]},{"level":"informative","category":"Environment Awareness","name":"Tries to retrieve device driver information","description":"\"afb24fab9c0b0f9e60d81bd7fd2d7999c842bf00b5bb9e0bf7347e36eacafad7.exe\" (Access type: \"OPEN\"; Path: \"HKLM\\SYSTEM\\CURRENTCONTROLSET\\SERVICES\\SANDBOXFLTR\"; Key: \"\"; Value: \"\")","origin":"Registry Access","mitre_attack_id":"T1652","relevance":1,"id":"registry-174","sources":[{"report_type":"sandbox","report_id":"6836a5da950abe50e709d27c"}]},{"level":"informative","category":"External Systems","name":"Detected Suricata Alert","description":"Detected alert \"SURICATA IPv4 invalid checksum\" (SID: 2200073, Rev: 2, Severity: 3) categorized as \"Generic Protocol Command Decode\"\n Detected alert \"SURICATA TCPv4 invalid checksum\" (SID: 2200074, Rev: 2, Severity: 3) categorized as \"Generic Protocol Command Decode\"","origin":"Suricata Alerts","relevance":10,"id":"suricata-0","sources":[{"report_type":"sandbox","report_id":"6836a5da950abe50e709d27c"}]},{"level":"informative","category":"General","name":"Calls an API typically used to load libraries","description":"\"afb24fab9c0b0f9e60d81bd7fd2d7999c842bf00b5bb9e0bf7347e36eacafad7.exe\" called \"LoadLibrary\" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00003644)\n \"afb24fab9c0b0f9e60d81bd7fd2d7999c842bf00b5bb9e0bf7347e36eacafad7.exe\" called \"LoadLibrary\" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00003644)\n \"afb24fab9c0b0f9e60d81bd7fd2d7999c842bf00b5bb9e0bf7347e36eacafad7.exe\" called \"LoadLibrary\" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00003644)\n \"afb24fab9c0b0f9e60d81bd7fd2d7999c842bf00b5bb9e0bf7347e36eacafad7.exe\" called \"LoadLibrary\" with a parameter kernel32 (UID: 00000000-00003644)","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-175","sources":[{"report_type":"sandbox","report_id":"6836a5da950abe50e709d27c"},{"report_type":"sandbox","report_id":"6a9e91b0d972b9c71504dfdf"}]},{"level":"informative","category":"General","name":"Calls an API typically used to retrieve function addresses","description":"$2f","origin":"API Call","mitre_attack_id":"T1106","relevance":1,"id":"api-176","sources":[{"report_type":"sandbox","report_id":"6836a5da950abe50e709d27c"},{"report_type":"sandbox","report_id":"6a9e91b0d972b9c71504dfdf"}]},{"level":"informative","category":"General","name":"Contacts server","description":"\"82.10.132.77:4782\"","origin":"Network Traffic","mitre_attack_id":"T1071","relevance":1,"id":"network-1","sources":[{"report_type":"sandbox","report_id":"6836a5da950abe50e709d27c"},{"report_type":"sandbox","report_id":"6a9e91b0d972b9c71504dfdf"}]},{"level":"informative","category":"General","name":"Contains ability to download files with network (Dotnet)","description":"Observed Namespace \"System.Net.WebClient\" and MemberReference \"add_DownloadFileCompleted\" in \"afb24fab9c0b0f9e60d81bd7fd2d7999c842bf00b5bb9e0bf7347e36eacafad7\"\n Observed Namespace \"System.Net.WebClient\" and MemberReference \"DownloadFileAsync\" in \"afb24fab9c0b0f9e60d81bd7fd2d7999c842bf00b5bb9e0bf7347e36eacafad7\"\n Observed Namespace \"System.Net.WebClient\" and MemberReference \"remove_DownloadFileCompleted\" in \"afb24fab9c0b0f9e60d81bd7fd2d7999c842bf00b5bb9e0bf7347e36eacafad7\"\n Observed Namespace \"System.Net.WebClient\" and MemberReference \"add_DownloadFileCompleted\" in \"fortnitemap.exe.bin\"\n Observed Namespace \"System.Net.WebClient\" and MemberReference \"DownloadFileAsync\" in \"fortnitemap.exe.bin\"\n Observed Namespace \"System.Net.WebClient\" and MemberReference \"remove_DownloadFileCompleted\" in \"fortnitemap.exe.bin\"","origin":"Static Parser","mitre_attack_id":"T1105","relevance":1,"id":"static-99","sources":[{"report_type":"sandbox","report_id":"6836a5da950abe50e709d27c"},{"report_type":"sandbox","report_id":"6a9e91b0d972b9c71504dfdf"}]},{"level":"informative","category":"General","name":"Contains ability to execute Windows APIs","description":"$30","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-101","sources":[{"report_type":"sandbox","report_id":"6836a5da950abe50e709d27c"},{"report_type":"sandbox","report_id":"6a9e91b0d972b9c71504dfdf"}]},{"level":"informative","category":"General","name":"Contains ability to execute application (Dotnet)","description":"Observed function \"set_UseShellExecute\" in \"afb24fab9c0b0f9e60d81bd7fd2d7999c842bf00b5bb9e0bf7347e36eacafad7\"\n Observed function \"set_UseShellExecute\" in \"fortnitemap.exe.bin\"","origin":"Static Parser","mitre_attack_id":"T1106","relevance":1,"id":"static-108","sources":[{"report_type":"sandbox","report_id":"6836a5da950abe50e709d27c"}]},{"level":"informative","category":"General","name":"Contains ability to set file attributes (Dotnet)","description":"Observed Namespace \"System.IO.File\" and MemberReference \"SetAttributes\" in \"afb24fab9c0b0f9e60d81bd7fd2d7999c842bf00b5bb9e0bf7347e36eacafad7\"\n Observed Namespace \"System.IO.FileSystemInfo\" and MemberReference \"get_Attributes\" in \"afb24fab9c0b0f9e60d81bd7fd2d7999c842bf00b5bb9e0bf7347e36eacafad7\"\n Observed Namespace \"System.IO.FileSystemInfo\" and MemberReference \"set_Attributes\" in \"afb24fab9c0b0f9e60d81bd7fd2d7999c842bf00b5bb9e0bf7347e36eacafad7\"\n Observed Namespace \"System.IO.File\" and MemberReference \"SetAttributes\" in \"fortnitemap.exe.bin\"\n Observed Namespace \"System.IO.FileSystemInfo\" and MemberReference \"get_Attributes\" in \"fortnitemap.exe.bin\"\n Observed Namespace \"System.IO.FileSystemInfo\" and MemberReference \"set_Attributes\" in \"fortnitemap.exe.bin\"","origin":"Static Parser","mitre_attack_id":"T1222","relevance":1,"id":"static-155","sources":[{"report_type":"sandbox","report_id":"6836a5da950abe50e709d27c"},{"report_type":"sandbox","report_id":"6a9e91b0d972b9c71504dfdf"}]},{"level":"informative","category":"General","name":"Contains ability to show a graphical window (API string)","description":"Found reference to API \"GetWindowThreadProcessId\" (Indicator: \"GetWindowThreadProcessId\"; File: \"afb24fab9c0b0f9e60d81bd7fd2d7999c842bf00b5bb9e0bf7347e36eacafad7\")","origin":"File/Memory","mitre_attack_id":"T1564.003","relevance":1,"id":"string-208","sources":[{"report_type":"sandbox","report_id":"6836a5da950abe50e709d27c"},{"report_type":"sandbox","report_id":"6a9e91b0d972b9c71504dfdf"}]},{"level":"informative","category":"General","name":"Contains ability to start a process (Dotnet)","description":"Observed function \"Process.Start\" in \"afb24fab9c0b0f9e60d81bd7fd2d7999c842bf00b5bb9e0bf7347e36eacafad7\"\n Observed function \"Process.set_StartInfo\" in \"afb24fab9c0b0f9e60d81bd7fd2d7999c842bf00b5bb9e0bf7347e36eacafad7\"\n Observed function \"Process.Start\" in \"fortnitemap.exe.bin\"\n Observed function \"Process.set_StartInfo\" in \"fortnitemap.exe.bin\"","origin":"Static Parser","mitre_attack_id":"T1106","relevance":1,"id":"static-111","sources":[{"report_type":"sandbox","report_id":"6836a5da950abe50e709d27c"},{"report_type":"sandbox","report_id":"6a9e91b0d972b9c71504dfdf"}]},{"level":"informative","category":"General","name":"Dotnet code contains ability to modify/delete registry","description":"$31","origin":"Static Parser","mitre_attack_id":"T1112","relevance":1,"id":"static-139","sources":[{"report_type":"sandbox","report_id":"6836a5da950abe50e709d27c"},{"report_type":"sandbox","report_id":"6a9e91b0d972b9c71504dfdf"}]},{"level":"informative","category":"General","name":"Dotnet code contains ability to query registry","description":"$32","origin":"Static Parser","mitre_attack_id":"T1012","relevance":1,"id":"static-138","sources":[{"report_type":"sandbox","report_id":"6836a5da950abe50e709d27c"}]},{"level":"informative","category":"General","name":"Dotnet source code contains suspicious native API","description":"Observed API \"LoadLibrary\" in \"afb24fab9c0b0f9e60d81bd7fd2d7999c842bf00b5bb9e0bf7347e36eacafad7\"\n Observed API \"GetProcAddress\" in \"afb24fab9c0b0f9e60d81bd7fd2d7999c842bf00b5bb9e0bf7347e36eacafad7\"\n Observed API \"MapVirtualKeyEx\" in \"afb24fab9c0b0f9e60d81bd7fd2d7999c842bf00b5bb9e0bf7347e36eacafad7\"\n Observed API \"LoadLibrary\" in \"fortnitemap.exe.bin\"\n Observed API \"GetProcAddress\" in \"fortnitemap.exe.bin\"\n Observed API \"MapVirtualKeyEx\" in \"fortnitemap.exe.bin\"","origin":"Static Parser","mitre_attack_id":"T1106","relevance":1,"id":"static-126","sources":[{"report_type":"sandbox","report_id":"6836a5da950abe50e709d27c"}]},{"level":"informative","category":"General","name":"File contains dynamic base/NX flags","description":"\"afb24fab9c0b0f9e60d81bd7fd2d7999c842bf00b5bb9e0bf7347e36eacafad7\" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE\n IMAGE_DLLCHARACTERISTICS_NX_COMPAT\n IMAGE_DLLCHARACTERISTICS_NO_SEH\n IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE\n \"fortnitemap.exe.bin\" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE\n IMAGE_DLLCHARACTERISTICS_NX_COMPAT\n IMAGE_DLLCHARACTERISTICS_NO_SEH\n IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE","origin":"Static Parser","id":"static-154","sources":[{"report_type":"sandbox","report_id":"6836a5da950abe50e709d27c"},{"report_type":"sandbox","report_id":"6a9e91b0d972b9c71504dfdf"}]},{"level":"informative","category":"General","name":"Found Native API in Dotnet file","description":"$33","origin":"Static Parser","mitre_attack_id":"T1106","relevance":1,"id":"static-101","sources":[{"report_type":"sandbox","report_id":"6836a5da950abe50e709d27c"},{"report_type":"sandbox","report_id":"6a9e91b0d972b9c71504dfdf"}]},{"level":"informative","category":"General","name":"Found user-agent related strings","description":"Found string \"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_3) AppleWebKit/537.75.14 (KHTML, like Gecko) Version/7.0.3 Safari/7046A194A\" (Indicator: \"mozilla/5.0 (\"; File: \"afb24fab9c0b0f9e60d81bd7fd2d7999c842bf00b5bb9e0bf7347e36eacafad7\")\n Found string \"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:76.0) Gecko/20100101 Firefox/76.0\" (Indicator: \"mozilla/5.0 (\"; File: \"afb24fab9c0b0f9e60d81bd7fd2d7999c842bf00b5bb9e0bf7347e36eacafad7\")","origin":"File/Memory","mitre_attack_id":"T1071.001","relevance":1,"id":"string-127","sources":[{"report_type":"sandbox","report_id":"6836a5da950abe50e709d27c"}]},{"level":"informative","category":"General","name":"Loads modules at runtime","description":"\"afb24fab9c0b0f9e60d81bd7fd2d7999c842bf00b5bb9e0bf7347e36eacafad7.exe\" loaded module \"API-MS-WIN-CORE-SYNCH-L1-2-0\" at base 7ffb2fa00000\n \"afb24fab9c0b0f9e60d81bd7fd2d7999c842bf00b5bb9e0bf7347e36eacafad7.exe\" loaded module \"API-MS-WIN-CORE-FIBERS-L1-1-1\" at base 7ffb2fa00000\n \"afb24fab9c0b0f9e60d81bd7fd2d7999c842bf00b5bb9e0bf7347e36eacafad7.exe\" loaded module \"API-MS-WIN-CORE-LOCALIZATION-L1-2-1\" at base 7ffb2fa00000\n \"afb24fab9c0b0f9e60d81bd7fd2d7999c842bf00b5bb9e0bf7347e36eacafad7.exe\" loaded module \"KERNEL32\" at base 7ffb2fe90000\n \"afb24fab9c0b0f9e60d81bd7fd2d7999c842bf00b5bb9e0bf7347e36eacafad7.exe\" loaded module \"%WINDIR%\\TEMP\\VXOLE64.DLL\" at base 7ffb20c10000","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-7","sources":[{"report_type":"sandbox","report_id":"6836a5da950abe50e709d27c"},{"report_type":"sandbox","report_id":"6a9e91b0d972b9c71504dfdf"}]},{"level":"informative","category":"General","name":"Loads the .NET runtime environment","description":"\"afb24fab9c0b0f9e60d81bd7fd2d7999c842bf00b5bb9e0bf7347e36eacafad7.exe\" loaded module \"%WINDIR%\\assembly\\NativeImages_v4.0.30319_64\\mscorlib\\fe2524177eb3088c77be666722039f52\\mscorlib.ni.dll\" at FF7B0000","origin":"Loaded Module","mitre_attack_id":"T1129","id":"module-3","sources":[{"report_type":"sandbox","report_id":"6836a5da950abe50e709d27c"},{"report_type":"sandbox","report_id":"6a9e91b0d972b9c71504dfdf"}]},{"level":"informative","category":"General","name":"Loads the Bcrypt module DLL","description":"\"afb24fab9c0b0f9e60d81bd7fd2d7999c842bf00b5bb9e0bf7347e36eacafad7.exe\" loaded module \"%WINDIR%\\System32\\bcryptprimitives.dll\" at 2F190000\n \"afb24fab9c0b0f9e60d81bd7fd2d7999c842bf00b5bb9e0bf7347e36eacafad7.exe\" loaded module \"%WINDIR%\\System32\\bcrypt.dll\" at 2E810000\n \"schtasks.exe\" loaded module \"%WINDIR%\\System32\\bcryptprimitives.dll\" at 2F190000","origin":"Loaded Module","mitre_attack_id":"T1027","id":"module-9","sources":[{"report_type":"sandbox","report_id":"6836a5da950abe50e709d27c"},{"report_type":"sandbox","report_id":"6a9e91b0d972b9c71504dfdf"}]},{"level":"informative","category":"General","name":"Loads the CLR Loader DLL","description":"\"afb24fab9c0b0f9e60d81bd7fd2d7999c842bf00b5bb9e0bf7347e36eacafad7.exe\" loaded module \"%WINDIR%\\Microsoft.NET\\Framework64\\v4.0.30319\\clr.dll\" at 00DB0000","origin":"Loaded Module","mitre_attack_id":"T1620","id":"module-7","sources":[{"report_type":"sandbox","report_id":"6836a5da950abe50e709d27c"},{"report_type":"sandbox","report_id":"6a9e91b0d972b9c71504dfdf"}]},{"level":"informative","category":"General","name":"Loads the RPC (Remote Procedure Call) module DLL","description":"\"afb24fab9c0b0f9e60d81bd7fd2d7999c842bf00b5bb9e0bf7347e36eacafad7.exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at 30560000\n \"schtasks.exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at 30560000","origin":"Loaded Module","mitre_attack_id":"T1129","id":"module-10","sources":[{"report_type":"sandbox","report_id":"6836a5da950abe50e709d27c"},{"report_type":"sandbox","report_id":"6a9e91b0d972b9c71504dfdf"}]},{"level":"informative","category":"General","name":"Matched Compiler/Packer signature (DIE)","description":"\"afb24fab9c0b0f9e60d81bd7fd2d7999c842bf00b5bb9e0bf7347e36eacafad7\" was detected as \".NET\" and name: \"Library\"\n \"afb24fab9c0b0f9e60d81bd7fd2d7999c842bf00b5bb9e0bf7347e36eacafad7\" was detected as \"Microsoft Linker\" and name: \"Linker\"\n \"fortnitemap.exe.bin\" was detected as \".NET\" and name: \"Library\"\n \"fortnitemap.exe.bin\" was detected as \"Microsoft Linker\" and name: \"Linker\"","origin":"Static Parser","mitre_attack_id":"T1027","id":"static-157","sources":[{"report_type":"sandbox","report_id":"6836a5da950abe50e709d27c"},{"report_type":"sandbox","report_id":"6a9e91b0d972b9c71504dfdf"}]},{"level":"informative","category":"General","name":"May execute SQL queries","description":"$34","origin":"File/Memory","mitre_attack_id":"T1005","relevance":1,"id":"string-605","sources":[{"report_type":"sandbox","report_id":"6836a5da950abe50e709d27c"}]},{"level":"informative","category":"General","name":"PE file contains COM data directory","description":"\"afb24fab9c0b0f9e60d81bd7fd2d7999c842bf00b5bb9e0bf7347e36eacafad7\" has COM data directory \"IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR\"\n \"fortnitemap.exe.bin\" has COM data directory \"IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR\"","origin":"Static Parser","relevance":1,"id":"static-144","sources":[{"report_type":"sandbox","report_id":"6836a5da950abe50e709d27c"},{"report_type":"sandbox","report_id":"6a9e91b0d972b9c71504dfdf"}]},{"level":"informative","category":"General","name":"PE file contains executable sections","description":"\"afb24fab9c0b0f9e60d81bd7fd2d7999c842bf00b5bb9e0bf7347e36eacafad7\" has an executable section named \".text\"\n \"fortnitemap.exe.bin\" has an executable section named \".text\"","origin":"Static Parser","relevance":1,"id":"static-80","sources":[{"report_type":"sandbox","report_id":"6836a5da950abe50e709d27c"},{"report_type":"sandbox","report_id":"6a9e91b0d972b9c71504dfdf"}]},{"level":"informative","category":"General","name":"PE file entrypoint instructions","description":"$35","origin":"Static Parser","id":"static-96","sources":[{"report_type":"sandbox","report_id":"6836a5da950abe50e709d27c"},{"report_type":"sandbox","report_id":"6a9e91b0d972b9c71504dfdf"}]},{"level":"informative","category":"General","name":"PE file has a big raw size section","description":"Raw size of \".text\" is \"0x31c600\" greater than 0x100000","origin":"Static Parser","relevance":3,"id":"static-125","sources":[{"report_type":"sandbox","report_id":"6836a5da950abe50e709d27c"},{"report_type":"sandbox","report_id":"6a9e91b0d972b9c71504dfdf"}]},{"level":"informative","category":"General","name":"PE file has a big virtual size section","description":"Virtual size of \".text\" is \"0x31c404\" greater than 0x100000","origin":"Static Parser","relevance":3,"id":"static-124","sources":[{"report_type":"sandbox","report_id":"6836a5da950abe50e709d27c"},{"report_type":"sandbox","report_id":"6a9e91b0d972b9c71504dfdf"}]},{"level":"informative","category":"General","name":"Possibly uses system binaries (Windows LOLbins)","description":"Observed system executable string:\"%WINDIR%\\System32\\schtasks.exe\" [Source: 00000000-00003644-00000BC0-541686375]","origin":"File/Memory","relevance":1,"id":"string-170","sources":[{"report_type":"sandbox","report_id":"6836a5da950abe50e709d27c"}]},{"level":"informative","category":"General","name":"Process launched with changed environment","description":"Process \"fortnitemap.exe\" (UID: 00000000-00005412) was launched with new environment variables: \"PROMPT=\"$P$G\", PROCESSOR_ARCHITEW6432=\"AMD64\"\"\n Process \"fortnitemap.exe\" (UID: 00000000-00005412) was launched with modified environment variables: \"PROCESSOR_ARCHITECTURE, PSModulePath, CommonProgramFiles, Path, PATHEXT, ProgramFiles\"\n Process \"schtasks.exe\" (UID: 00000000-00006524) was launched with modified environment variables: \"PROCESSOR_ARCHITECTURE, CommonProgramFiles, ProgramFiles\"\n Process \"schtasks.exe\" (UID: 00000000-00006524) was launched with missing environment variables: \"PROCESSOR_ARCHITEW6432\"","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":10,"id":"target-67","sources":[{"report_type":"sandbox","report_id":"6836a5da950abe50e709d27c"},{"report_type":"sandbox","report_id":"6a9e91b0d972b9c71504dfdf"}]},{"level":"informative","category":"General","name":"Reads information about supported languages","description":"\"afb24fab9c0b0f9e60d81bd7fd2d7999c842bf00b5bb9e0bf7347e36eacafad7.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EN-US\")\n \"afb24fab9c0b0f9e60d81bd7fd2d7999c842bf00b5bb9e0bf7347e36eacafad7.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\EXTENDEDLOCALE\"; Key: \"EN-US\")\n \"afb24fab9c0b0f9e60d81bd7fd2d7999c842bf00b5bb9e0bf7347e36eacafad7.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LOCALE\"; Key: \"00000409\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":3,"id":"registry-25","sources":[{"report_type":"sandbox","report_id":"6836a5da950abe50e709d27c"},{"report_type":"sandbox","report_id":"6a9e91b0d972b9c71504dfdf"}]},{"level":"informative","category":"General","name":"Spawns new processes","description":"Spawned process \"schtasks.exe\" with commandline \"\"schtasks\" /create /tn \"Discord Startup\" /sc ONLOGON /tr \"%APPDA ...\" (UID: 00000000-00006660), Spawned process \"schtasks.exe\" with commandline \"\"schtasks\" /create /tn \"Discord Startup\" /sc ONLOGON /tr \"%APPDA ...\" (UID: 00000000-00006524)","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":3,"id":"target-25","sources":[{"report_type":"sandbox","report_id":"6836a5da950abe50e709d27c"},{"report_type":"sandbox","report_id":"6a9e91b0d972b9c71504dfdf"}]},{"level":"informative","category":"General","name":"Spawns new processes that are not known child processes","description":"Spawned process \"schtasks.exe\" with commandline \"\"schtasks\" /create /tn \"Discord Startup\" /sc ONLOGON /tr \"%APPDA ...\" (UID: 00000000-00006660), Spawned process \"schtasks.exe\" with commandline \"\"schtasks\" /create /tn \"Discord Startup\" /sc ONLOGON /tr \"%APPDA ...\" (UID: 00000000-00006524)","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":3,"id":"target-103","sources":[{"report_type":"sandbox","report_id":"6836a5da950abe50e709d27c"},{"report_type":"sandbox","report_id":"6a9e91b0d972b9c71504dfdf"}]},{"level":"informative","category":"General","name":"Uses 32 bit executable PE","description":"\"afb24fab9c0b0f9e60d81bd7fd2d7999c842bf00b5bb9e0bf7347e36eacafad7\" has flags like IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_EXECUTABLE\n \"fortnitemap.exe.bin\" has flags like IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_EXECUTABLE","origin":"Static Parser","id":"static-153","sources":[{"report_type":"sandbox","report_id":"6836a5da950abe50e709d27c"},{"report_type":"sandbox","report_id":"6a9e91b0d972b9c71504dfdf"}]},{"level":"informative","category":"Installation/Persistence","name":"Creates a thread in a self process","description":"\"afb24fab9c0b0f9e60d81bd7fd2d7999c842bf00b5bb9e0bf7347e36eacafad7.exe\" creates a thread in process \"-1\" (Handle: FFFFFFFFFFFFFFFF)","origin":"API Call","mitre_attack_id":"T1055.003","relevance":3,"id":"api-264","sources":[{"report_type":"sandbox","report_id":"6836a5da950abe50e709d27c"}]},{"level":"informative","category":"Installation/Persistence","name":"Dropped files","description":"\"fortnitemap.exe.bin\" has type \"PE32 executable (GUI) Intel 80386 Mono/.Net assembly for MS Windows 3 sections\"- [targetUID: N/A]\n \"afb24fab9c0b0f9e60d81bd7fd2d7999c842bf00b5bb9e0bf7347e36eacafad7.exe.log\" has type \"CSV ASCII text\"- Location: [%LOCALAPPDATA%\\Microsoft\\CLR_v4.0\\UsageLogs\\afb24fab9c0b0f9e60d81bd7fd2d7999c842bf00b5bb9e0bf7347e36eacafad7.exe.log]- [targetUID: 00000000-00003644]\n \"fortnitemap.exe\" has type \"PE32 executable (GUI) Intel 80386 Mono/.Net assembly for MS Windows 3 sections\"- Location: [%APPDATA%\\SubDir\\fortnitemap.exe]- [targetUID: 00000000-00003644]","origin":"Binary File","mitre_attack_id":"T1105","relevance":3,"id":"binary-0","sources":[{"report_type":"sandbox","report_id":"6836a5da950abe50e709d27c"},{"report_type":"sandbox","report_id":"6a9e91b0d972b9c71504dfdf"}]},{"level":"informative","category":"Installation/Persistence","name":"Opens registry keys","description":"$36","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-177","sources":[{"report_type":"sandbox","report_id":"6836a5da950abe50e709d27c"},{"report_type":"sandbox","report_id":"6a9e91b0d972b9c71504dfdf"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries basic information of the specified process","description":"\"afb24fab9c0b0f9e60d81bd7fd2d7999c842bf00b5bb9e0bf7347e36eacafad7.exe\" queries basic process information of the \"C:\\afb24fab9c0b0f9e60d81bd7fd2d7999c842bf00b5bb9e0bf7347e36eacafad7.exe\" (UID: 3644)","origin":"API Call","mitre_attack_id":"T1057","relevance":1,"id":"api-235","sources":[{"report_type":"sandbox","report_id":"6836a5da950abe50e709d27c"},{"report_type":"sandbox","report_id":"6a9e91b0d972b9c71504dfdf"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries registry keys","description":"$37","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-172","sources":[{"report_type":"sandbox","report_id":"6836a5da950abe50e709d27c"},{"report_type":"sandbox","report_id":"6a9e91b0d972b9c71504dfdf"}]},{"level":"informative","category":"Installation/Persistence","name":"Reads files","description":"$38","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-243","sources":[{"report_type":"sandbox","report_id":"6836a5da950abe50e709d27c"},{"report_type":"sandbox","report_id":"6a9e91b0d972b9c71504dfdf"}]},{"level":"informative","category":"Installation/Persistence","name":"Shows ability to use execution guardrails","description":"The analysis shows indicators which can be used as execution guardrails to ensure that payload only executes against intended targets/system. Matched sigs: Found a reference to an external IP address lookup service","origin":"Indicator Combinations","mitre_attack_id":"T1480","relevance":1,"id":"summary-29","sources":[{"report_type":"sandbox","report_id":"6836a5da950abe50e709d27c"},{"report_type":"sandbox","report_id":"6a9e91b0d972b9c71504dfdf"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files","description":"$39","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-263","sources":[{"report_type":"sandbox","report_id":"6836a5da950abe50e709d27c"},{"report_type":"sandbox","report_id":"6a9e91b0d972b9c71504dfdf"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (executable)","description":"$3a","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-126","sources":[{"report_type":"sandbox","report_id":"6836a5da950abe50e709d27c"},{"report_type":"sandbox","report_id":"6a9e91b0d972b9c71504dfdf"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (non-executable)","description":"$3b","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-161","sources":[{"report_type":"sandbox","report_id":"6836a5da950abe50e709d27c"},{"report_type":"sandbox","report_id":"6a9e91b0d972b9c71504dfdf"}]},{"level":"informative","category":"Installation/Persistence","name":"Writes files","description":"\"afb24fab9c0b0f9e60d81bd7fd2d7999c842bf00b5bb9e0bf7347e36eacafad7.exe\" writes file \"c:\\users\\%osuser%\\appdata\\roaming\\subdir\\fortnitemap.exe\"\n \"afb24fab9c0b0f9e60d81bd7fd2d7999c842bf00b5bb9e0bf7347e36eacafad7.exe\" writes file \"c:\\users\\%osuser%\\appdata\\local\\microsoft\\clr_v4.0\\usagelogs\\afb24fab9c0b0f9e60d81bd7fd2d7999c842bf00b5bb9e0bf7347e36eacafad7.exe.log\"\n \"afb24fab9c0b0f9e60d81bd7fd2d7999c842bf00b5bb9e0bf7347e36eacafad7.exe\" writes file \"%appdata%\\subdir\\fortnitemap.exe\"\n \"afb24fab9c0b0f9e60d81bd7fd2d7999c842bf00b5bb9e0bf7347e36eacafad7.exe\" writes file \"%localappdata%\\microsoft\\clr_v4.0\\usagelogs\\afb24fab9c0b0f9e60d81bd7fd2d7999c842bf00b5bb9e0bf7347e36eacafad7.exe.log\"","origin":"API Call","relevance":1,"id":"api-242","sources":[{"report_type":"sandbox","report_id":"6836a5da950abe50e709d27c"},{"report_type":"sandbox","report_id":"6a9e91b0d972b9c71504dfdf"}]},{"level":"informative","category":"Installation/Persistence","name":"Writes log files","description":"\"afb24fab9c0b0f9e60d81bd7fd2d7999c842bf00b5bb9e0bf7347e36eacafad7.exe\" writes a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Microsoft\\CLR_v4.0\\UsageLogs\\afb24fab9c0b0f9e60d81bd7fd2d7999c842bf00b5bb9e0bf7347e36eacafad7.exe.log\"\n \"afb24fab9c0b0f9e60d81bd7fd2d7999c842bf00b5bb9e0bf7347e36eacafad7.exe\" writes a file \"%LOCALAPPDATA%\\Microsoft\\CLR_v4.0\\UsageLogs\\afb24fab9c0b0f9e60d81bd7fd2d7999c842bf00b5bb9e0bf7347e36eacafad7.exe.log\"","origin":"API Call","mitre_attack_id":"T1074.001","relevance":1,"id":"api-159","sources":[{"report_type":"sandbox","report_id":"6836a5da950abe50e709d27c"}]},{"level":"informative","category":"Network Related","name":"Contains ability to communicate via sockets (Dotnet)","description":"$3c","origin":"Static Parser","mitre_attack_id":"T1095","relevance":1,"id":"static-159","sources":[{"report_type":"sandbox","report_id":"6836a5da950abe50e709d27c"},{"report_type":"sandbox","report_id":"6a9e91b0d972b9c71504dfdf"}]},{"level":"informative","category":"Network Related","name":"Contains ability to communicate with network (Dotnet)","description":"$3d","origin":"Static Parser","mitre_attack_id":"T1071.001","relevance":1,"id":"static-158","sources":[{"report_type":"sandbox","report_id":"6836a5da950abe50e709d27c"},{"report_type":"sandbox","report_id":"6a9e91b0d972b9c71504dfdf"}]},{"level":"informative","category":"Network Related","name":"Contains ability to communicates via socket (possible C&C communication)","description":"$3e","origin":"Static Parser","mitre_attack_id":"T1071","relevance":1,"id":"static-151","sources":[{"report_type":"sandbox","report_id":"6836a5da950abe50e709d27c"},{"report_type":"sandbox","report_id":"6a9e91b0d972b9c71504dfdf"}]},{"level":"informative","category":"Network Related","name":"Contains ability to provide interface for network protocols (Dotnet)","description":"Observed namespace \"System.Net\" in \"afb24fab9c0b0f9e60d81bd7fd2d7999c842bf00b5bb9e0bf7347e36eacafad7\"\n Observed namespace \"System.Net.Sockets\" in \"afb24fab9c0b0f9e60d81bd7fd2d7999c842bf00b5bb9e0bf7347e36eacafad7\"\n Observed namespace \"System.Net.Security\" in \"afb24fab9c0b0f9e60d81bd7fd2d7999c842bf00b5bb9e0bf7347e36eacafad7\"\n Observed namespace \"System.Net.NetworkInformation\" in \"afb24fab9c0b0f9e60d81bd7fd2d7999c842bf00b5bb9e0bf7347e36eacafad7\"","origin":"Static Parser","mitre_attack_id":"T1071.001","relevance":1,"id":"static-110","sources":[{"report_type":"sandbox","report_id":"6836a5da950abe50e709d27c"},{"report_type":"sandbox","report_id":"6a9e91b0d972b9c71504dfdf"}]},{"level":"informative","category":"Remote Access Related","name":"Contains references to RPC protocol sequence strings","description":"Found string \"+ncalrpc:[OLE94AAAEA93931BDA112D41D80852F]\" (Indicator: \"ncalrpc\"; Source: \"00000000-00003644.00000000.98170.029D0000.00000004.mdmp, 00000000-00003644.00000001.100092.029D0000.00000004.mdmp, 00000000-00003644.00000002.102012.029D0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1090","relevance":1,"id":"string-531","sources":[{"report_type":"sandbox","report_id":"6836a5da950abe50e709d27c"},{"report_type":"sandbox","report_id":"6a9e91b0d972b9c71504dfdf"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used for taking snapshot of the specified processes","description":"\"afb24fab9c0b0f9e60d81bd7fd2d7999c842bf00b5bb9e0bf7347e36eacafad7.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}","origin":"API Call","mitre_attack_id":"T1057","relevance":3,"id":"api-103","sources":[{"report_type":"sandbox","report_id":"6836a5da950abe50e709d27c"},{"report_type":"sandbox","report_id":"6a9e91b0d972b9c71504dfdf"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to capture screen (API string)","description":"Found reference to API \"CreateDC\" (Indicator: \"CreateDC\"; File: \"afb24fab9c0b0f9e60d81bd7fd2d7999c842bf00b5bb9e0bf7347e36eacafad7\")","origin":"File/Memory","mitre_attack_id":"T1113","relevance":1,"id":"string-78","sources":[{"report_type":"sandbox","report_id":"6836a5da950abe50e709d27c"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to capture screen information (Dotnet)","description":"Observed Namespace \"System.Windows.Forms::Screen\" and MemberReference \"get_AllScreens\" in \"afb24fab9c0b0f9e60d81bd7fd2d7999c842bf00b5bb9e0bf7347e36eacafad7\"\n Observed Namespace \"System.Windows.Forms::Screen\" and MemberReference \"get_AllScreens\" in \"fortnitemap.exe.bin\"","origin":"Static Parser","mitre_attack_id":"T1113","relevance":1,"id":"static-164","sources":[{"report_type":"sandbox","report_id":"6836a5da950abe50e709d27c"},{"report_type":"sandbox","report_id":"6a9e91b0d972b9c71504dfdf"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate process and/or its information (API string)","description":"Found reference to API \"GetProcessById\" (Indicator: \"GetProcessById\"; File: \"afb24fab9c0b0f9e60d81bd7fd2d7999c842bf00b5bb9e0bf7347e36eacafad7\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-85","sources":[{"report_type":"sandbox","report_id":"6836a5da950abe50e709d27c"},{"report_type":"sandbox","report_id":"6a9e91b0d972b9c71504dfdf"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to gather process details (Dotnet)","description":"Observed function \"GetProcessesByName\" in \"afb24fab9c0b0f9e60d81bd7fd2d7999c842bf00b5bb9e0bf7347e36eacafad7\"\n Observed function \"get_ProcessName\" in \"afb24fab9c0b0f9e60d81bd7fd2d7999c842bf00b5bb9e0bf7347e36eacafad7\"\n Observed function \"GetProcessById\" in \"afb24fab9c0b0f9e60d81bd7fd2d7999c842bf00b5bb9e0bf7347e36eacafad7\"\n Observed function \"GetProcessesByName\" in \"fortnitemap.exe.bin\"\n Observed function \"get_ProcessName\" in \"fortnitemap.exe.bin\"\n Observed function \"GetProcessById\" in \"fortnitemap.exe.bin\"","origin":"Static Parser","mitre_attack_id":"T1057","relevance":1,"id":"static-100","sources":[{"report_type":"sandbox","report_id":"6836a5da950abe50e709d27c"},{"report_type":"sandbox","report_id":"6a9e91b0d972b9c71504dfdf"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve user privileges","description":"System.Security.Principal.WindowsPrincipal::IsInRole(System.Security.Principal.WindowsBuiltInRole) at 5462e80e464d9b44b4f0226f0b6d5c2b-600003d-ctor","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1033","relevance":5,"id":"stream-136","sources":[{"report_type":"sandbox","report_id":"6836a5da950abe50e709d27c"},{"report_type":"sandbox","report_id":"6a9e91b0d972b9c71504dfdf"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Found strings related to keylogger","description":"Found string \"

[Esc]

\" (Indicator: \"[esc]\"; File: \"afb24fab9c0b0f9e60d81bd7fd2d7999c842bf00b5bb9e0bf7347e36eacafad7\")","origin":"File/Memory","mitre_attack_id":"T1056.001","relevance":1,"id":"string-556","sources":[{"report_type":"sandbox","report_id":"6836a5da950abe50e709d27c"},{"report_type":"sandbox","report_id":"6a9e91b0d972b9c71504dfdf"}]},{"level":"informative","category":"System Security","name":"Contains ability to access device drivers","description":"Found string \"\\Device\\HarddiskVolume2\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscoreei.dll\" (Indicator: \"\\Device\\\"; Source: \"00000000-00003644.00000000.98170.029D0000.00000004.mdmp, 00000000-00003644.00000001.100092.029D0000.00000004.mdmp, 00000000-00003644.00000002.102012.029D0000.00000004.mdmp\")\n Found string \":\\WINDOWS\\system32\\DRIVERS\" (Indicator: \"system32\\drivers\"; Source: \"00000000-00003644.00000000.98170.029D0000.00000004.mdmp, 00000000-00003644.00000001.100092.029D0000.00000004.mdmp, 00000000-00003644.00000002.102012.029D0000.00000004.mdmp\")\n Found string \"\\Device\\HarddiskVolume2\" (Indicator: \"\\Device\\\"; Source: \"00000000-00003644.00000000.98170.029D0000.00000004.mdmp, 00000000-00003644.00000001.100092.029D0000.00000004.mdmp, 00000000-00003644.00000002.102012.029D0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-474","sources":[{"report_type":"sandbox","report_id":"6836a5da950abe50e709d27c"},{"report_type":"sandbox","report_id":"6a9e91b0d972b9c71504dfdf"}]},{"level":"informative","category":"System Security","name":"Contains ability to delete files","description":"Observed string: \"\"del /a /q /f \"\" (Indicator: \"\"del \") in Source: afb24fab9c0b0f9e60d81bd7fd2d7999c842bf00b5bb9e0bf7347e36eacafad7","origin":"File/Memory","mitre_attack_id":"T1070.004","relevance":1,"id":"string-408","sources":[{"report_type":"sandbox","report_id":"6836a5da950abe50e709d27c"},{"report_type":"sandbox","report_id":"6a9e91b0d972b9c71504dfdf"}]},{"level":"informative","category":"System Security","name":"Contains ability to modify access token privileges (API string)","description":"Found reference to API \"SeDebugPrivilege\" (Indicator: \"SeDebugPrivilege\"; Source: \"00000000-00003644.00000000.98170.029D0000.00000004.mdmp, 00000000-00003644.00000001.100092.029D0000.00000004.mdmp, 00000000-00003644.00000002.102012.029D0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1134","relevance":1,"id":"string-77","sources":[{"report_type":"sandbox","report_id":"6836a5da950abe50e709d27c"},{"report_type":"sandbox","report_id":"6a9e91b0d972b9c71504dfdf"}]},{"level":"informative","category":"System Security","name":"Queries services related registry keys","description":"\"afb24fab9c0b0f9e60d81bd7fd2d7999c842bf00b5bb9e0bf7347e36eacafad7.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\WCIFS\"; Key: \"SUPPORTEDFEATURES\"; Value: \"\")\n \"afb24fab9c0b0f9e60d81bd7fd2d7999c842bf00b5bb9e0bf7347e36eacafad7.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\WOF\"; Key: \"SUPPORTEDFEATURES\"; Value: \"\")\n \"afb24fab9c0b0f9e60d81bd7fd2d7999c842bf00b5bb9e0bf7347e36eacafad7.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\FILEINFO\"; Key: \"SUPPORTEDFEATURES\"; Value: \"\")\n \"afb24fab9c0b0f9e60d81bd7fd2d7999c842bf00b5bb9e0bf7347e36eacafad7.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\BAM\\USERSETTINGS\\S-1-5-21-735145574-3570218355-1207367261-1001\"; Key: \"\\DEVICE\\HARDDISKVOLUME2\\WINDOWS\\SYSTEM32\\SCHTASKS.EXE\"; Value: \"\")","origin":"Registry Access","mitre_attack_id":"T1007","relevance":1,"id":"registry-173","sources":[{"report_type":"sandbox","report_id":"6836a5da950abe50e709d27c"},{"report_type":"sandbox","report_id":"6a9e91b0d972b9c71504dfdf"}]},{"level":"informative","category":"Unusual Characteristics","name":"Drops files inside appdata directory","description":"Dropped file: \"afb24fab9c0b0f9e60d81bd7fd2d7999c842bf00b5bb9e0bf7347e36eacafad7.exe.log\" - Location: [%LOCALAPPDATA%\\Microsoft\\CLR_v4.0\\UsageLogs\\afb24fab9c0b0f9e60d81bd7fd2d7999c842bf00b5bb9e0bf7347e36eacafad7.exe.log]- [targetUID: 00000000-00003644]\n Dropped file: \"fortnitemap.exe\" - Location: [%APPDATA%\\SubDir\\fortnitemap.exe]- [targetUID: 00000000-00003644]","origin":"Binary File","mitre_attack_id":"T1036","relevance":3,"id":"binary-37","sources":[{"report_type":"sandbox","report_id":"6836a5da950abe50e709d27c"},{"report_type":"sandbox","report_id":"6a9e91b0d972b9c71504dfdf"}]},{"level":"informative","category":"Unusual Characteristics","name":"Matched Compiler/Packer signature","description":"\"afb24fab9c0b0f9e60d81bd7fd2d7999c842bf00b5bb9e0bf7347e36eacafad7\" was detected as \"Microsoft visual C# v7.0 / Basic .NET\"\n \"fortnitemap.exe.bin\" was detected as \"Microsoft visual C# v7.0 / Basic .NET\"","origin":"Static Parser","mitre_attack_id":"T1027.002","relevance":10,"id":"static-18","sources":[{"report_type":"sandbox","report_id":"6836a5da950abe50e709d27c"},{"report_type":"sandbox","report_id":"6a9e91b0d972b9c71504dfdf"}]},{"level":"informative","category":"Unusual Characteristics","name":"Reads the windows installation language","description":"\"afb24fab9c0b0f9e60d81bd7fd2d7999c842bf00b5bb9e0bf7347e36eacafad7.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE GROUPS\"; Key: \"1\")","origin":"Registry Access","mitre_attack_id":"T1614.001","relevance":2,"id":"registry-26","sources":[{"report_type":"sandbox","report_id":"6836a5da950abe50e709d27c"},{"report_type":"sandbox","report_id":"6a9e91b0d972b9c71504dfdf"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"Creates guarded memory regions (anti-debugging trick to avoid memory dumping)","description":"\"afb24fab9c0b0f9e60d81bd7fd2d7999c842bf00b5bb9e0bf7347e36eacafad7.exe\" is allocating memory with PAGE_GUARD access rights (Handle: FFFFFFFFFFFFFFFF); (PID: 3644)","origin":"API Call","mitre_attack_id":"T1562.001","relevance":10,"id":"api-1","sources":[{"report_type":"sandbox","report_id":"6836a5da950abe50e709d27c"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"Section contains high entropy","description":"\"afb24fab9c0b0f9e60d81bd7fd2d7999c842bf00b5bb9e0bf7347e36eacafad7\" has section name .text with entropy \"6.084721054547407\"\n \"afb24fab9c0b0f9e60d81bd7fd2d7999c842bf00b5bb9e0bf7347e36eacafad7\" has section name .rsrc with entropy \"7.3251900921516055\"\n \"fortnitemap.exe.bin\" has section name .text with entropy \"6.084721054547407\"\n \"fortnitemap.exe.bin\" has section name .rsrc with entropy \"7.3251900921516055\"","origin":"Static Parser","mitre_attack_id":"T1027.009","relevance":1,"id":"static-6","sources":[{"report_type":"sandbox","report_id":"6836a5da950abe50e709d27c"},{"report_type":"sandbox","report_id":"6a9e91b0d972b9c71504dfdf"}]},{"level":"suspicious","category":"Environment Awareness","name":"Contains ability to retrieve information about the current system","description":"ቢ。鲻⯦琜輱৬좍鱅↶ੵ닍힧ꆉ￹ᑻ奵苻胢::觮櫳墨䟐遄擈婎婚팷ص㸜徳韜⽂鷄菝(矻㋳�ộ큍虿ᔵ뒜펲ꠤ蹴们줤흌࡮梋⯸辻,Quasar.Common.Messages.GetSystemInfo) at 5462e80e464d9b44b4f0226f0b6d5c2b-60001d2-_~Execute\n Quasar.Common.Messages.GetSystemInfoResponse::set_SystemInfos(System.Collections.Generic.List`1>) at 5462e80e464d9b44b4f0226f0b6d5c2b-60001d3-_~_","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1082","relevance":4,"id":"stream-86","sources":[{"report_type":"sandbox","report_id":"6836a5da950abe50e709d27c"},{"report_type":"sandbox","report_id":"6a9e91b0d972b9c71504dfdf"}]},{"level":"suspicious","category":"General","name":"PE file has unusual entropy resources","description":"\"afb24fab9c0b0f9e60d81bd7fd2d7999c842bf00b5bb9e0bf7347e36eacafad7\" has resource with unusual entropy \"RT_ICON:7.989244385739015\"\n \"fortnitemap.exe.bin\" has resource with unusual entropy \"RT_ICON:7.989244385739015\"","origin":"Static Parser","mitre_attack_id":"T1027.002","relevance":5,"id":"static-92","sources":[{"report_type":"sandbox","report_id":"6836a5da950abe50e709d27c"},{"report_type":"sandbox","report_id":"6a9e91b0d972b9c71504dfdf"}]},{"level":"suspicious","category":"Installation/Persistence","name":"Drops executable files","description":"\"fortnitemap.exe.bin\" has type \"PE32 executable (GUI) Intel 80386 Mono/.Net assembly for MS Windows 3 sections\"- [targetUID: N/A]\n \"fortnitemap.exe\" has type \"PE32 executable (GUI) Intel 80386 Mono/.Net assembly for MS Windows 3 sections\"- Location: [%APPDATA%\\SubDir\\fortnitemap.exe]- [targetUID: 00000000-00003644]","origin":"Binary File","mitre_attack_id":"T1105","relevance":10,"id":"binary-1","sources":[{"report_type":"sandbox","report_id":"6836a5da950abe50e709d27c"},{"report_type":"sandbox","report_id":"6a9e91b0d972b9c71504dfdf"}]},{"level":"suspicious","category":"System Destruction","name":"Marks file for deletion","description":"\"afb24fab9c0b0f9e60d81bd7fd2d7999c842bf00b5bb9e0bf7347e36eacafad7.exe\" marked \"C:\\afb24fab9c0b0f9e60d81bd7fd2d7999c842bf00b5bb9e0bf7347e36eacafad7.exe:Zone.Identifier\" for deletion","origin":"API Call","mitre_attack_id":"T1070.004","relevance":10,"id":"api-26","sources":[{"report_type":"sandbox","report_id":"6836a5da950abe50e709d27c"}]},{"level":"suspicious","category":"System Destruction","name":"Opens file with deletion access rights","description":"\"afb24fab9c0b0f9e60d81bd7fd2d7999c842bf00b5bb9e0bf7347e36eacafad7.exe\" opened \"C:\\afb24fab9c0b0f9e60d81bd7fd2d7999c842bf00b5bb9e0bf7347e36eacafad7.exe:Zone.Identifier\" with delete access","origin":"API Call","mitre_attack_id":"T1070.004","relevance":7,"id":"api-25","sources":[{"report_type":"sandbox","report_id":"6836a5da950abe50e709d27c"},{"report_type":"sandbox","report_id":"6a9e91b0d972b9c71504dfdf"}]},{"level":"suspicious","category":"System Security","name":"Writes registry keys","description":"\"afb24fab9c0b0f9e60d81bd7fd2d7999c842bf00b5bb9e0bf7347e36eacafad7.exe\" (Access type: \"SETVAL\"; Path: \"HKCU\\LOCAL SETTINGS\\MUICACHE\\2F3\\52C64B7E\"; Key: \"LANGUAGELIST\"; Value: \"en-US\")","origin":"Registry Access","mitre_attack_id":"T1112","relevance":3,"id":"registry-136","sources":[{"report_type":"sandbox","report_id":"6836a5da950abe50e709d27c"},{"report_type":"sandbox","report_id":"6a9e91b0d972b9c71504dfdf"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Drops binary executable file with an unexpected extension","description":"\"fortnitemap.exe.bin\" has unusual extension","origin":"Binary File","mitre_attack_id":"T1036.008","relevance":3,"id":"binary-75","sources":[{"report_type":"sandbox","report_id":"6836a5da950abe50e709d27c"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Input file contains API references not part of its Import Address Table (IAT)","description":"Found string \"CryptHashData\" (Source: afb24fab9c0b0f9e60d81bd7fd2d7999c842bf00b5bb9e0bf7347e36eacafad7, API is part of module: CRYPTSP.DLL)","origin":"File/Memory","mitre_attack_id":"T1106","relevance":10,"id":"string-64","sources":[{"report_type":"sandbox","report_id":"6836a5da950abe50e709d27c"},{"report_type":"sandbox","report_id":"6a9e91b0d972b9c71504dfdf"}]},{"level":"malicious","category":"Anti-Detection/Stealthiness","name":"Tries to hide tracks of having downloaded a file from the internet","description":"\"afb24fab9c0b0f9e60d81bd7fd2d7999c842bf00b5bb9e0bf7347e36eacafad7.exe\" opened \"C:\\afb24fab9c0b0f9e60d81bd7fd2d7999c842bf00b5bb9e0bf7347e36eacafad7.exe:Zone.Identifier\" with delete access","origin":"API Call","mitre_attack_id":"T1070.004","relevance":7,"id":"api-42","sources":[{"report_type":"sandbox","report_id":"6836a5da950abe50e709d27c"},{"report_type":"sandbox","report_id":"6a9e91b0d972b9c71504dfdf"}]},{"level":"malicious","category":"External Systems","name":"Sample detected by CrowdStrike Static Analysis and ML with relatively high confidence","description":"CrowdStrike Static Analysis and ML (QuickScan) yielded detection: win/malicious_confidence_100% (W)","origin":"External System","relevance":10,"id":"avtest-8","sources":[{"report_type":"sandbox","report_id":"6836a5da950abe50e709d27c"},{"report_type":"sandbox","report_id":"6a9e91b0d972b9c71504dfdf"}]},{"level":"malicious","category":"General","name":"The analysis extracted a file that was identified as malicious","description":"11/21 Antivirus vendors marked dropped file \"fortnitemap.exe.bin\" as malicious (classified as \"HEUR:Trojan.MSIL.Quasar\" with 52% detection rate)\n 11/21 Antivirus vendors marked dropped file \"fortnitemap.exe\" as malicious (classified as \"HEUR:Trojan.MSIL.Quasar\" with 52% detection rate)","origin":"Binary File","mitre_attack_id":"T1204.002","relevance":10,"id":"binary-11","sources":[{"report_type":"sandbox","report_id":"6836a5da950abe50e709d27c"},{"report_type":"sandbox","report_id":"6a9e91b0d972b9c71504dfdf"}]},{"level":"malicious","category":"Installation/Persistence","name":"Loads the task scheduler COM API","description":"\"schtasks.exe\" loaded module \"%WINDIR%\\System32\\taskschd.dll\" at 2A7B0000","origin":"Loaded Module","mitre_attack_id":"T1559.001","relevance":5,"id":"module-4","sources":[{"report_type":"sandbox","report_id":"6836a5da950abe50e709d27c"}]},{"level":"malicious","category":"Installation/Persistence","name":"Schedules a task to be executed at a specific time and date","description":"Process \"schtasks.exe\" with commandline \"\"schtasks\" /create /tn \"Discord Startup\" /sc ONLOGON /tr \"%APPDATA%\\\\SubDir\\\\fortnitemap.exe\" /rl HIGHEST /f\" (UID: 00000000-00006660)\n Process \"schtasks.exe\" with commandline \"\"schtasks\" /create /tn \"Discord Startup\" /sc ONLOGON /tr \"%APPDATA%\\\\SubDir\\\\fortnitemap.exe\" /rl HIGHEST /f\" (UID: 00000000-00006524)","origin":"Monitored Target","mitre_attack_id":"T1053.005","relevance":8,"id":"target-13","sources":[{"report_type":"sandbox","report_id":"6836a5da950abe50e709d27c"},{"report_type":"sandbox","report_id":"6a9e91b0d972b9c71504dfdf"}]},{"level":"malicious","category":"Network Related","name":"Found a reference to an external IP address lookup service","description":"\"https://api.ipify.org/\" (Indicator: \"api.ipify.org\"; File: \"6000217-_~_\")","origin":"File/Memory","mitre_attack_id":"T1016","relevance":6,"id":"string-56","sources":[{"report_type":"sandbox","report_id":"6836a5da950abe50e709d27c"}]},{"level":"malicious","category":"Network Related","name":"Uses network protocols on unusual ports","description":"TCP traffic to 82.10.132.77 on port 4782","origin":"Network Traffic","mitre_attack_id":"T1571","relevance":7,"id":"network-7","sources":[{"report_type":"sandbox","report_id":"6836a5da950abe50e709d27c"},{"report_type":"sandbox","report_id":"6a9e91b0d972b9c71504dfdf"}]},{"level":"malicious","category":"Pattern Matching","name":"YARA signature match","description":"YARA signature \"win_njrat_g0\" classified file \"sample.bin\" as \"njrat,rat\" (Author: Various authors / Slavo Greminger, SWITCH-CERT)\n YARA signature \"win_njrat_g0\" classified file \"fortnitemap.exe.2324321180\" as \"njrat,rat\" (Author: Various authors / Slavo Greminger, SWITCH-CERT)\n YARA signature \"win_njrat_g0\" classified file \"fortnitemap.exe.bin\" as \"njrat,rat\" (Author: Various authors / Slavo Greminger, SWITCH-CERT)\n YARA signature \"MALWARE_Win_QuasarStealer\" matched file \"sample.bin\" as \"Detects Quasar infostealer\" (Author: ditekshen)\n YARA signature \"MALWARE_Win_QuasarStealer\" matched file \"fortnitemap.exe.2324321180\" as \"Detects Quasar infostealer\" (Author: ditekshen)\n YARA signature \"MALWARE_Win_QuasarStealer\" matched file \"fortnitemap.exe.bin\" as \"Detects Quasar infostealer\" (Author: ditekshen)","origin":"YARA Signature","relevance":9,"id":"yara-0","sources":[{"report_type":"sandbox","report_id":"6836a5da950abe50e709d27c"},{"report_type":"sandbox","report_id":"6a9e91b0d972b9c71504dfdf"}]},{"level":"malicious","category":"Spyware/Information Retrieval","name":"Found FTP credentials location strings","description":"\"{0}\\FileZilla\\recentservers.xml\" (Indicator: \"recentservers.xml\") in Source: afb24fab9c0b0f9e60d81bd7fd2d7999c842bf00b5bb9e0bf7347e36eacafad7\n \"{0}\\FileZilla\\sitemanager.xml\" (Indicator: \"sitemanager.xml\") in Source: afb24fab9c0b0f9e60d81bd7fd2d7999c842bf00b5bb9e0bf7347e36eacafad7\n \"{0}\\\\FileZilla\\\\recentservers.xml\" (Indicator: \"recentservers.xml\") in Source: 600007d-ctor\n \"{0}\\\\FileZilla\\\\sitemanager.xml\" (Indicator: \"sitemanager.xml\") in Source: 600007d-ctor","origin":"File/Memory","mitre_attack_id":"T1552.001","relevance":6,"id":"string-11","sources":[{"report_type":"sandbox","report_id":"6836a5da950abe50e709d27c"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to execute applications in hidden mode (.NET)","description":"Observed Namespace \"System.Diagnostics.ProcessStartInfo\" and MemberReference \"set_CreateNoWindow\" in \"afb24fab9c0b0f9e60d81bd7fd2d7999c842bf00b5bb9e0bf7347e36eacafad7\"\n Observed Namespace \"System.Diagnostics.ProcessStartInfo\" and MemberReference \"set_CreateNoWindow\" in \"fortnitemap.exe\"","origin":"Static Parser","mitre_attack_id":"T1564.003","relevance":7,"id":"static-161","sources":[{"report_type":"sandbox","report_id":"6a9e91b0d972b9c71504dfdf"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to load content into memory (.NET)","description":"$3f","origin":"Static Parser","mitre_attack_id":"T1140","relevance":5,"id":"static-107","sources":[{"report_type":"sandbox","report_id":"6a9e91b0d972b9c71504dfdf"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Calls an API typically used to load a resource in memory","description":"\"afb24fab9c0b0f9e60d81bd7fd2d7999c842bf00b5bb9e0bf7347e36eacafad7.exe\" called \"LoadResource with parameter {'hModule': '1968570368', 'hResInfo': '6030832'}\" (UID: 00000000-00004144)\n \"fortnitemap.exe\" called \"LoadResource with parameter {'hModule': '1968570368', 'hResInfo': '6227440'}\" (UID: 00000000-00003776)","origin":"API Call","mitre_attack_id":"T1106","relevance":3,"id":"api-139","sources":[{"report_type":"sandbox","report_id":"6a9e91b0d972b9c71504dfdf"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains strings related to AMSI (Anti Malware Scan Interface)","description":"Observed string: \"AmsiScanBuffer\" (Indicator: \"amsiscanbuffer\") in Source: 00000000-00004144.00000003.80690.00169000.00000004.mdmp","origin":"File/Memory","mitre_attack_id":"T1562.001","relevance":1,"id":"string-231","sources":[{"report_type":"sandbox","report_id":"6a9e91b0d972b9c71504dfdf"}]},{"level":"informative","category":"Cryptographic Related","name":"Able to access crypto-related API (String)","description":"Found reference to API \"description=\"Uses CryptProtectData and CryptUnProtectData Windows APIs to encrypt and decrypt\"\" (Indicator: \"CryptProtectData\"; Source: \"00000000-00003776.00000000.81007.00340000.00000004.mdmp, 00000000-00003776.00000001.82929.00340000.00000004.mdmp, 00000000-00003776.00000002.84852.00340000.00000004.mdmp\")\n Found reference to API \"description=\"Uses CryptProtectData and CryptUnProtectData Windows APIs to encrypt and decrypt\"\" (Indicator: \"CryptProtectData\"; Source: \"00000000-00004744.00000001.88362.00240000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1486","relevance":1,"id":"string-920","sources":[{"report_type":"sandbox","report_id":"6a9e91b0d972b9c71504dfdf"}]},{"level":"informative","category":"Cryptographic Related","name":"Able to decode string content at runtime (.NET)","description":"Observed function \"FromBase64String\" in \"afb24fab9c0b0f9e60d81bd7fd2d7999c842bf00b5bb9e0bf7347e36eacafad7\"\n Observed function \"ToBase64String\" in \"afb24fab9c0b0f9e60d81bd7fd2d7999c842bf00b5bb9e0bf7347e36eacafad7\"\n Observed function \"FromBase64String\" in \"fortnitemap.exe\"\n Observed function \"ToBase64String\" in \"fortnitemap.exe\"","origin":"Static Parser","mitre_attack_id":"T1140","relevance":5,"id":"static-106","sources":[{"report_type":"sandbox","report_id":"6a9e91b0d972b9c71504dfdf"}]},{"level":"informative","category":"Cryptographic Related","name":"Able to use Microsoft's Enhanced Cryptographic Provider","description":"Found api reference \"CryptHashData\" (Indicator: \"CryptHashData\"; File: \"afb24fab9c0b0f9e60d81bd7fd2d7999c842bf00b5bb9e0bf7347e36eacafad7\")","origin":"File/Memory","mitre_attack_id":"T1573","relevance":1,"id":"string-602","sources":[{"report_type":"sandbox","report_id":"6a9e91b0d972b9c71504dfdf"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform encryption (API string)","description":"Found reference to API \"description=\"Uses CryptProtectData and CryptUnProtectData Windows APIs to encrypt and decrypt\"\" (Indicator: \"CryptProtectData\"; Source: \"00000000-00003776.00000000.81007.00340000.00000004.mdmp, 00000000-00003776.00000001.82929.00340000.00000004.mdmp, 00000000-00003776.00000002.84852.00340000.00000004.mdmp\")\n Found reference to API \"description=\"Uses CryptProtectData and CryptUnProtectData Windows APIs to encrypt and decrypt\"\" (Indicator: \"CryptProtectData\"; Source: \"00000000-00004744.00000001.88362.00240000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1486","relevance":1,"id":"string-108","sources":[{"report_type":"sandbox","report_id":"6a9e91b0d972b9c71504dfdf"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains key cryptographic functions (API string)","description":"Found reference to API \"CryptHashData\" (Indicator: \"CryptHashData\"; File: \"afb24fab9c0b0f9e60d81bd7fd2d7999c842bf00b5bb9e0bf7347e36eacafad7\")","origin":"File/Memory","mitre_attack_id":"T1027","relevance":1,"id":"string-195","sources":[{"report_type":"sandbox","report_id":"6a9e91b0d972b9c71504dfdf"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains reference to crypto DLLs","description":"Found string \":\\Windows\\system32\\MSVCP140.dll\" (Indicator: \"\\msvcp140.dll\"; Source: \"00000000-00003776.00000000.81007.00340000.00000004.mdmp, 00000000-00003776.00000001.82929.00340000.00000004.mdmp, 00000000-00003776.00000002.84852.00340000.00000004.mdmp\")\n Found string \":\\Windows\\system32\\MSVCP140.dll\" (Indicator: \"\\msvcp140.dll\"; Source: \"00000000-00004144.00000000.76590.00170000.00000004.mdmp, 00000000-00004144.00000001.78513.00170000.00000004.mdmp, 00000000-00004144.00000002.80434.00170000.00000004.mdmp, 00000000-00004144.00000003.80690.00170000.00000004.mdmp\")\n Found string \":\\Windows\\system32\\MSVCP140.dll\" (Indicator: \"\\msvcp140.dll\"; Source: \"00000000-00004744.00000000.86440.00240000.00000004.mdmp, 00000000-00004744.00000001.88362.00240000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1486","relevance":1,"id":"string-493","sources":[{"report_type":"sandbox","report_id":"6a9e91b0d972b9c71504dfdf"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains symmetric decryption functionality in .NET code","description":"Observed namespace \"System.Security.Cryptography.SymmetricAlgorithm\" and TypeReference \"CreateDecryptor\" in \"afb24fab9c0b0f9e60d81bd7fd2d7999c842bf00b5bb9e0bf7347e36eacafad7\"\n Observed namespace \"System.Security.Cryptography.SymmetricAlgorithm\" and TypeReference \"CreateDecryptor\" in \"fortnitemap.exe\"","origin":"Static Parser","mitre_attack_id":"T1140","relevance":1,"id":"static-168","sources":[{"report_type":"sandbox","report_id":"6a9e91b0d972b9c71504dfdf"}]},{"level":"informative","category":"Cryptographic Related","name":"XOR operations in executable file detected","description":"$40","origin":"Binary File","mitre_attack_id":"T1027.005","id":"binary-92","sources":[{"report_type":"sandbox","report_id":"6a9e91b0d972b9c71504dfdf"}]},{"level":"informative","category":"Environment Awareness","name":"Able to enumerate system processes using native API","description":"Found reference to API \"NtQuerySystemInformation\" (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00004144-00000C2C-206933506\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-907","sources":[{"report_type":"sandbox","report_id":"6a9e91b0d972b9c71504dfdf"}]},{"level":"informative","category":"Environment Awareness","name":"Able to gather system file/directory information (.NET)","description":"Observed dotnet function \"GetFiles\" in \"afb24fab9c0b0f9e60d81bd7fd2d7999c842bf00b5bb9e0bf7347e36eacafad7\"\n Observed dotnet function \"GetDirectories\" in \"afb24fab9c0b0f9e60d81bd7fd2d7999c842bf00b5bb9e0bf7347e36eacafad7\"\n Observed dotnet function \"GetFiles\" in \"fortnitemap.exe\"\n Observed dotnet function \"GetDirectories\" in \"fortnitemap.exe\"","origin":"Static Parser","mitre_attack_id":"T1082","relevance":3,"id":"static-200","sources":[{"report_type":"sandbox","report_id":"6a9e91b0d972b9c71504dfdf"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify virtual environment by using API string","description":"Found string \"NtQuerySystemInformation\" (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00004144-00000C2C-206933506\")","origin":"File/Memory","mitre_attack_id":"T1497.001","relevance":1,"id":"string-659","sources":[{"report_type":"sandbox","report_id":"6a9e91b0d972b9c71504dfdf"}]},{"level":"informative","category":"Environment Awareness","name":"Able to obtain MAC address in .NET file","description":"Observed retrieval of MAC address \"System.Net.NetworkInformation.GetPhysicalAddress\" in \"afb24fab9c0b0f9e60d81bd7fd2d7999c842bf00b5bb9e0bf7347e36eacafad7\"\n Observed retrieval of MAC address \"System.Net.NetworkInformation.GetPhysicalAddress\" in \"fortnitemap.exe\"","origin":"Static Parser","mitre_attack_id":"T1082","relevance":1,"id":"static-216","sources":[{"report_type":"sandbox","report_id":"6a9e91b0d972b9c71504dfdf"}]},{"level":"informative","category":"Environment Awareness","name":"Able to query security token membership for user discovery (API string)","description":"Found reference to API \"AllocateAndInitializeSid\" (Indicator: \"AllocateAndInitializeSid\"; Source: \"00000000-00004144-00000C2C-205114139\")\n Found reference to API \"FreeSid\" (Indicator: \"FreeSid\"; Source: \"00000000-00004144-00000C2C-205114888\")\n Found reference to API \"CheckTokenMembership\" (Indicator: \"CheckTokenMembership\"; Source: \"00000000-00004144-00000C2C-269453416\")\n Found reference to API \"CheckTokenMembershipW\" (Indicator: \"CheckTokenMembership\"; Source: \"00000000-00004144-00000C2C-269453487\")","origin":"File/Memory","mitre_attack_id":"T1033","relevance":1,"id":"string-908","sources":[{"report_type":"sandbox","report_id":"6a9e91b0d972b9c71504dfdf"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to determine if process is running under WOW64","description":"\"afb24fab9c0b0f9e60d81bd7fd2d7999c842bf00b5bb9e0bf7347e36eacafad7.exe\" called \"IsWow64Process\" with parameter \"4144\" - (UID: 00000000-00004144)\n \"schtasks.exe\" called \"IsWow64Process\" with parameter \"1152\" - (UID: 00000000-00001152)\n \"fortnitemap.exe\" called \"IsWow64Process\" with parameter \"3776\" - (UID: 00000000-00003776)","origin":"API Call","mitre_attack_id":"T1057","relevance":3,"id":"api-146","sources":[{"report_type":"sandbox","report_id":"6a9e91b0d972b9c71504dfdf"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get product type","description":"\"afb24fab9c0b0f9e60d81bd7fd2d7999c842bf00b5bb9e0bf7347e36eacafad7.exe\" called \"RtlGetNtProductType\" with parameter 01000000 (UID: 00000000-00004144)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-124","sources":[{"report_type":"sandbox","report_id":"6a9e91b0d972b9c71504dfdf"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to retrieve OS information","description":"$41","origin":"API Call","mitre_attack_id":"T1082","relevance":2,"id":"api-222","sources":[{"report_type":"sandbox","report_id":"6a9e91b0d972b9c71504dfdf"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to retrieve account information for specified SID","description":"\"afb24fab9c0b0f9e60d81bd7fd2d7999c842bf00b5bb9e0bf7347e36eacafad7.exe\" called \"LookupAccountSidW\" with param Name %OSUSER% (UID: 00000000-00004144)\n \"schtasks.exe\" called \"LookupAccountSidW\" with param Name %OSUSER% (UID: 00000000-00001152)","origin":"API Call","mitre_attack_id":"T1033","relevance":3,"id":"api-148","sources":[{"report_type":"sandbox","report_id":"6a9e91b0d972b9c71504dfdf"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to retrieve local language","description":"\"afb24fab9c0b0f9e60d81bd7fd2d7999c842bf00b5bb9e0bf7347e36eacafad7.exe\" called \"GetLocaleInfoW\" with parameter \"1033\" - (UID: 00000000-00004144)\n \"fortnitemap.exe\" called \"GetLocaleInfoW\" with parameter \"1033\" - (UID: 00000000-00003776)","origin":"API Call","mitre_attack_id":"T1614","relevance":3,"id":"api-147","sources":[{"report_type":"sandbox","report_id":"6a9e91b0d972b9c71504dfdf"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve the OS information (API string)","description":"Found reference to API \"075978,940,3024,,RtlGetVersion,NTDLL.dll,\"252:14\" (Indicator: \"GetVersion\"; Source: \"00000000-00003776.00000000.81007.00340000.00000004.mdmp\n 00000000-00003776.00000001.82929.00340000.00000004.mdmp\"), Found reference to API \"3550044\n4296\n3024\n\nRtlGetVersion\nNTDLL.dll\n\"252:05:28.655\"\nRX=0\nPX=0\" (Indicator: \"GetVersion\"; Source: \"00000000-00004144.00000000.76590.00170000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-171","sources":[{"report_type":"sandbox","report_id":"6a9e91b0d972b9c71504dfdf"}]},{"level":"informative","category":"Environment Awareness","name":"Queries volume information","description":"\"afb24fab9c0b0f9e60d81bd7fd2d7999c842bf00b5bb9e0bf7347e36eacafad7.exe\" queries volume information of \"C:\\afb24fab9c0b0f9e60d81bd7fd2d7999c842bf00b5bb9e0bf7347e36eacafad7.exe\" at 00000000-00004144-0000010C-3481009\n \"fortnitemap.exe\" queries volume information of \"C:\\Users\\%OSUSER%\\AppData\\Roaming\\SubDir\\fortnitemap.exe\" at 00000000-00003776-0000010C-3013055\n \"fortnitemap.exe\" queries volume information of \"C:\\Windows\\Microsoft.NET\\assembly\\GAC_MSIL\\System.ServiceModel\\v4.0_4.0.0.0__b77a5c561934e089\\System.ServiceModel.dll\" at 00000000-00003776-0000010C-63436491\n \"fortnitemap.exe\" queries volume information of \"C:\\Windows\\Microsoft.NET\\assembly\\GAC_MSIL\\System.ServiceModel\\v4.0_4.0.0.0__b77a5c561934e089\\System.ServiceModel.dll\" at 00000000-00003776-0000010C-63596557","origin":"API Call","mitre_attack_id":"T1082","relevance":8,"id":"api-39","sources":[{"report_type":"sandbox","report_id":"6a9e91b0d972b9c71504dfdf"}]},{"level":"informative","category":"General","name":".NET code is able to query registry","description":"$42","origin":"Static Parser","mitre_attack_id":"T1012","relevance":5,"id":"static-138","sources":[{"report_type":"sandbox","report_id":"6a9e91b0d972b9c71504dfdf"}]},{"level":"informative","category":"General","name":".NET source code contains suspicious native API","description":"Observed API \"LoadLibrary\" in \"afb24fab9c0b0f9e60d81bd7fd2d7999c842bf00b5bb9e0bf7347e36eacafad7\"\n Observed API \"GetProcAddress\" in \"afb24fab9c0b0f9e60d81bd7fd2d7999c842bf00b5bb9e0bf7347e36eacafad7\"\n Observed API \"MapVirtualKeyEx\" in \"afb24fab9c0b0f9e60d81bd7fd2d7999c842bf00b5bb9e0bf7347e36eacafad7\"\n Observed API \"LoadLibrary\" in \"fortnitemap.exe\"\n Observed API \"GetProcAddress\" in \"fortnitemap.exe\"\n Observed API \"MapVirtualKeyEx\" in \"fortnitemap.exe\"","origin":"Static Parser","mitre_attack_id":"T1106","relevance":5,"id":"static-126","sources":[{"report_type":"sandbox","report_id":"6a9e91b0d972b9c71504dfdf"}]},{"level":"informative","category":"General","name":"Able to execute application (.NET)","description":"Observed function \"System.Diagnostics.ProcessStartInfo.UseShellExecute\" in \"afb24fab9c0b0f9e60d81bd7fd2d7999c842bf00b5bb9e0bf7347e36eacafad7\"\n Observed function \"System.Diagnostics.ProcessStartInfo.UseShellExecute\" in \"fortnitemap.exe\"","origin":"Static Parser","mitre_attack_id":"T1106","relevance":3,"id":"static-108","sources":[{"report_type":"sandbox","report_id":"6a9e91b0d972b9c71504dfdf"}]},{"level":"informative","category":"General","name":"Calls an API typically used to copy file from one location to another","description":"\"afb24fab9c0b0f9e60d81bd7fd2d7999c842bf00b5bb9e0bf7347e36eacafad7.exe\" called \"CopyFileW\" to copy C:\\afb24fab9c0b0f9e60d81bd7fd2d7999c842bf00b5bb9e0bf7347e36eacafad7.exe to new location %APPDATA%\\SubDir\\fortnitemap.exe (UID: 00000000-00004144)","origin":"API Call","mitre_attack_id":"T1005","relevance":3,"id":"api-123","sources":[{"report_type":"sandbox","report_id":"6a9e91b0d972b9c71504dfdf"}]},{"level":"informative","category":"General","name":"Calls an API typically used to create a directory","description":"\"afb24fab9c0b0f9e60d81bd7fd2d7999c842bf00b5bb9e0bf7347e36eacafad7.exe\" called \"CreateDirectoryW\" with parameter C:\\Users\\%OSUSER% (UID: 00000000-00004144)\n \"afb24fab9c0b0f9e60d81bd7fd2d7999c842bf00b5bb9e0bf7347e36eacafad7.exe\" called \"CreateDirectoryW\" with parameter %USERPROFILE%\\AppData\\Roaming (UID: 00000000-00004144)\n \"afb24fab9c0b0f9e60d81bd7fd2d7999c842bf00b5bb9e0bf7347e36eacafad7.exe\" called \"CreateDirectoryW\" with parameter %APPDATA%\\SubDir (UID: 00000000-00004144)\n \"fortnitemap.exe\" called \"CreateDirectoryW\" with parameter C:\\Users\\%OSUSER% (UID: 00000000-00003776)\n \"fortnitemap.exe\" called \"CreateDirectoryW\" with parameter %USERPROFILE%\\AppData\\Roaming (UID: 00000000-00003776)","origin":"API Call","mitre_attack_id":"T1074.001","relevance":3,"id":"api-122","sources":[{"report_type":"sandbox","report_id":"6a9e91b0d972b9c71504dfdf"}]},{"level":"informative","category":"General","name":"Calls an API typically used to create a process","description":"\"afb24fab9c0b0f9e60d81bd7fd2d7999c842bf00b5bb9e0bf7347e36eacafad7.exe\" called \"CreateProcessW\" with parameter \"\"schtasks\" /create /tn \"Discord Startup\" /sc ONLOGON /tr \"%APPDATA%\\SubDir\\fortnitemap.exe\" /rl HIGHEST /f\" - (UID: 00000000-00004144)\n \"afb24fab9c0b0f9e60d81bd7fd2d7999c842bf00b5bb9e0bf7347e36eacafad7.exe\" called \"CreateProcessW\" with parameter \"\"%APPDATA%\\SubDir\\fortnitemap.exe\"\" - (UID: 00000000-00004144)","origin":"API Call","mitre_attack_id":"T1106","relevance":5,"id":"api-128","sources":[{"report_type":"sandbox","report_id":"6a9e91b0d972b9c71504dfdf"}]},{"level":"informative","category":"General","name":"Creates mutants","description":"Process afb24fab9c0b0f9e60d81bd7fd2d7999c842bf00b5bb9e0bf7347e36eacafad7.exe created mutex with name \"\\Sessions\\1\\BaseNamedObjects\\Global\\CLR_PerfMon_WrapMutex\"\n Process afb24fab9c0b0f9e60d81bd7fd2d7999c842bf00b5bb9e0bf7347e36eacafad7.exe created mutex with name \"\\Sessions\\1\\BaseNamedObjects\\Local\\9165d845-5b53-4916-8289-e3cd1c364dd1\"\n Process fortnitemap.exe created mutex with name \"\\Sessions\\1\\BaseNamedObjects\\Local\\9165d845-5b53-4916-8289-e3cd1c364dd1\"","origin":"Created Mutant","mitre_attack_id":"T1480.002","relevance":3,"id":"mutant-0","sources":[{"report_type":"sandbox","report_id":"6a9e91b0d972b9c71504dfdf"}]},{"level":"informative","category":"General","name":"Fails to load modules at runtime","description":"$43","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-22","sources":[{"report_type":"sandbox","report_id":"6a9e91b0d972b9c71504dfdf"}]},{"level":"informative","category":"General","name":"Found User Agent related strings","description":"Found string \"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_3) AppleWebKit/537.75.14 (KHTML, like Gecko) Version/7.0.3 Safari/7046A194A\" (Indicator: \"mozilla/5.0 (\"; File: \"afb24fab9c0b0f9e60d81bd7fd2d7999c842bf00b5bb9e0bf7347e36eacafad7\")\n Found string \"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:76.0) Gecko/20100101 Firefox/76.0\" (Indicator: \"mozilla/5.0 (\"; File: \"afb24fab9c0b0f9e60d81bd7fd2d7999c842bf00b5bb9e0bf7347e36eacafad7\")","origin":"File/Memory","mitre_attack_id":"T1071.001","relevance":1,"id":"string-127","sources":[{"report_type":"sandbox","report_id":"6a9e91b0d972b9c71504dfdf"}]},{"level":"informative","category":"General","name":"Found registry location strings in memory","description":"\"Read?HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows NT\\CurrentVersion\" in Source: 00000000-00003776.00000002.84852.00330000.00000004.mdmp\n \"Read3HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\.NETFramework\" in Source: 00000000-00003776.00000002.84852.00330000.00000004.mdmp\n \"Read?HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows NT\\CurrentVersion\" in Source: 00000000-00004144.00000002.80434.00540000.00000004.mdmp\n \"Read3HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\.NETFramework\" in Source: 00000000-00004144.00000002.80434.00540000.00000004.mdmp\n \"Read?HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows NT\\CurrentVersion\" in Source: 00000000-00004144.00000003.80690.00540000.00000004.mdmp\n \"Read3HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\.NETFramework\" in Source: 00000000-00004144.00000003.80690.00540000.00000004.mdmp","origin":"Memory Dumps","mitre_attack_id":"T1012","relevance":1,"id":"memorydump-10","sources":[{"report_type":"sandbox","report_id":"6a9e91b0d972b9c71504dfdf"}]},{"level":"informative","category":"General","name":"Loads Windows LDAP client module","description":"\"afb24fab9c0b0f9e60d81bd7fd2d7999c842bf00b5bb9e0bf7347e36eacafad7.exe\" loaded module \"%WINDIR%\\System32\\Wldap32.dll\" at 77370000\n \"fortnitemap.exe\" loaded module \"%WINDIR%\\System32\\Wldap32.dll\" at 77370000","origin":"Loaded Module","mitre_attack_id":"T1069.002","relevance":3,"id":"module-17","sources":[{"report_type":"sandbox","report_id":"6a9e91b0d972b9c71504dfdf"}]},{"level":"informative","category":"General","name":"Looks up procedures from modules (excluding apphelp.dll, kernel32.dll, user32.dll, gdi32.dll, ole32.dll, comctl32.dll, uxtheme.dll, oleaut32.dll, version.dll, msctfime.ime)","description":"\"0d000e00fe02a56b@ADVAPI32.dll\"\n \"0b000c00cc02a56b@ADVAPI32.dll\"\n \"10001100da02a56b@ADVAPI32.dll\"\n \"150016002073c068@ADVAPI32.dll\"\n \"0e000f00e473c068@ADVAPI32.dll\"\n \"0e000f005074c068@ADVAPI32.dll\"\n \"11001200d47dc068@ADVAPI32.dll\"\n \"110012007c7ec068@ADVAPI32.dll\"\n \"12001300cc7ec068@ADVAPI32.dll\"\n \"12001300387fc068@ADVAPI32.dll\"\n \"14001500e4b7c068@ADVAPI32.dll\"\n \"1400150000b8c068@ADVAPI32.dll\"\n \"140015001cb8c068@ADVAPI32.dll\"\n \"1700180038b8c068@ADVAPI32.dll\"\n \"0d000e0054b8c068@ADVAPI32.dll\"\n \"1100120064b8c068@ADVAPI32.dll\"\n \"110012007cb8c068@ADVAPI32.dll\"\n \"0f001000ecb9c068@ADVAPI32.dll\"\n \"1400150038bac068@ADVAPI32.dll\"\n \"1400150054bac068@ADVAPI32.dll\"\n \"0c000d00a8bac068@ADVAPI32.dll\"\n \"0c000d00b8bac068@ADVAPI32.dll\"\n \"0e000f00c8bac068@ADVAPI32.dll\"\n \"0e000f00dcbac068@ADVAPI32.dll\"","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-8","sources":[{"report_type":"sandbox","report_id":"6a9e91b0d972b9c71504dfdf"}]},{"level":"informative","category":"General","name":"References Windows LDAP client module","description":"Found string \":\\Windows\\system32\\WLDAP32.dll\" (Source: \"00000000-00003776.00000002.84852.00340000.00000004.mdmp\")\n Found string \":\\Windows\\system32\\WLDAP32.dll\" (Source: \"00000000-00004144.00000003.80690.00170000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1069.002","relevance":1,"id":"string-987","sources":[{"report_type":"sandbox","report_id":"6a9e91b0d972b9c71504dfdf"}]},{"level":"informative","category":"General","name":"References Windows file paths for DLLs (possible dropped files)","description":"$44","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-625","sources":[{"report_type":"sandbox","report_id":"6a9e91b0d972b9c71504dfdf"}]},{"level":"informative","category":"Installation/Persistence","name":"Connects to LPC ports","description":"\"afb24fab9c0b0f9e60d81bd7fd2d7999c842bf00b5bb9e0bf7347e36eacafad7.exe\" connecting to \"\\ThemeApiPort\"\n \"schtasks.exe\" connecting to \"\\ThemeApiPort\"\n \"fortnitemap.exe\" connecting to \"\\ThemeApiPort\"","origin":"API Call","mitre_attack_id":"T1559","relevance":1,"id":"api-16","sources":[{"report_type":"sandbox","report_id":"6a9e91b0d972b9c71504dfdf"}]},{"level":"informative","category":"Network Related","name":"Able to download remote files (.NET)","description":"Observed dotnet function \"WebRequest.GetResponse\" in \"afb24fab9c0b0f9e60d81bd7fd2d7999c842bf00b5bb9e0bf7347e36eacafad7\"\n Observed dotnet function \"WebResponse.GetResponseStream\" in \"afb24fab9c0b0f9e60d81bd7fd2d7999c842bf00b5bb9e0bf7347e36eacafad7\"\n Observed dotnet function \"WebRequest.GetResponse\" in \"fortnitemap.exe\"\n Observed dotnet function \"WebResponse.GetResponseStream\" in \"fortnitemap.exe\"","origin":"Static Parser","mitre_attack_id":"T1105","relevance":7,"id":"static-201","sources":[{"report_type":"sandbox","report_id":"6a9e91b0d972b9c71504dfdf"}]},{"level":"informative","category":"Network Related","name":"Calls an API typically used to register an interface (RPC)","description":"\"afb24fab9c0b0f9e60d81bd7fd2d7999c842bf00b5bb9e0bf7347e36eacafad7.exe\" called \"RpcServerRegisterIf2\" (UID: 00000000-00004144)","origin":"API Call","mitre_attack_id":"T1021","relevance":3,"id":"api-219","sources":[{"report_type":"sandbox","report_id":"6a9e91b0d972b9c71504dfdf"}]},{"level":"informative","category":"Network Related","name":"Contains references to network communication API (string)","description":"Found reference to API \"AUTHUI.DLL: Shutdown Choices Message Window\" (Indicator: \" shutdown \"; Source: \"00000000-00003776.00000000.81007.013E0000.00000002.mdmp, 00000000-00003776.00000001.82929.013E0000.00000002.mdmp, 00000000-00003776.00000002.84852.013E0000.00000002.mdmp\")\n Found reference to API \"AUTHUI.DLL: Shutdown Choices Message Window\" (Indicator: \" shutdown \"; Source: \"00000000-00004144.00000000.76590.01500000.00000002.mdmp, 00000000-00004144.00000001.78513.01500000.00000002.mdmp, 00000000-00004144.00000002.80434.01500000.00000002.mdmp\")\n Found reference to API \"AUTHUI.DLL: Shutdown Choices Message Window\" (Indicator: \" shutdown \"; Source: \"00000000-00004744.00000000.86440.013E0000.00000002.mdmp, 00000000-00004744.00000001.88362.013E0000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1071","relevance":1,"id":"string-899","sources":[{"report_type":"sandbox","report_id":"6a9e91b0d972b9c71504dfdf"}]},{"level":"informative","category":"Network Related","name":"Found potential URLs in memory dumps","description":"Found URL \"http://go.microsoft.com/fwlink/?linkid=42127\" - Source: \"00000000-00003776.00000000.81007.00340000.00000004.mdmp\")\n Found URL \"http://go.microsoft.cgm?linkid=42127\" - Source: \"00000000-00003776.00000001.82929.00340000.00000004.mdmp\")\n Found URL \"http://go.microsoft.cgm?linkid=42127\" - Source: \"00000000-00003776.00000002.84852.00340000.00000004.mdmp\")","origin":"Memory Dumps","mitre_attack_id":"T1071","relevance":1,"id":"memorydump-2","sources":[{"report_type":"sandbox","report_id":"6a9e91b0d972b9c71504dfdf"}]},{"level":"informative","category":"Remote Access Related","name":"Contains references to SFTP or FTPS file transfer","description":"Found string \"b__4_0\" (Indicator: \"winscp\"; File: \"afb24fab9c0b0f9e60d81bd7fd2d7999c842bf00b5bb9e0bf7347e36eacafad7\")\n Found string \"WinSCP\" (Indicator: \"winscp\"; File: \"afb24fab9c0b0f9e60d81bd7fd2d7999c842bf00b5bb9e0bf7347e36eacafad7\")\n Found string \"SOFTWARE\\\\Martin Prikryl\\\\WinSCP 2\\\\Sessions\" (Indicator: \"winscp\"; File: \"afb24fab9c0b0f9e60d81bd7fd2d7999c842bf00b5bb9e0bf7347e36eacafad7\")\n Found string \"SOFTWARE\\\\\\\\Martin Prikryl\\\\\\\\WinSCP 2\\\\\\\\Sessions\" (Indicator: \"winscp\"; File: \"afb24fab9c0b0f9e60d81bd7fd2d7999c842bf00b5bb9e0bf7347e36eacafad7\")","origin":"File/Memory","mitre_attack_id":"T1048.002","relevance":1,"id":"string-724","sources":[{"report_type":"sandbox","report_id":"6a9e91b0d972b9c71504dfdf"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to access credential file using Kerberos","description":"Found string \"Kerberos\" (Indicator: \"kerberos\"; Source: \"00000000-00003776.00000002.84852.00340000.00000004.mdmp\")\n Found string \"Kerberos\" (Indicator: \"kerberos\"; Source: \"00000000-00004144.00000003.80690.00170000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1558","relevance":1,"id":"string-868","sources":[{"report_type":"sandbox","report_id":"6a9e91b0d972b9c71504dfdf"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to capture screen (API string)","description":"Found reference to API \"CreateDC\" (Indicator: \"CreateDC\"; File: \"afb24fab9c0b0f9e60d81bd7fd2d7999c842bf00b5bb9e0bf7347e36eacafad7\")","origin":"File/Memory","mitre_attack_id":"T1113","relevance":1,"id":"string-78","sources":[{"report_type":"sandbox","report_id":"6a9e91b0d972b9c71504dfdf"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to discover operating system information (API string)","description":"Found reference to API \"075978,940,3024,,RtlGetVersion,NTDLL.dll,\"252:14\" (Indicator: \"RtlGetVersion\"; Source: \"00000000-00003776.00000000.81007.00340000.00000004.mdmp\n 00000000-00003776.00000001.82929.00340000.00000004.mdmp\"), Found reference to API \"3550044\n4296\n3024\n\nRtlGetVersion\nNTDLL.dll\n\"252:05:28.655\"\nRX=0\nPX=0\" (Indicator: \"RtlGetVersion\"; Source: \"00000000-00004144.00000000.76590.00170000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-86","sources":[{"report_type":"sandbox","report_id":"6a9e91b0d972b9c71504dfdf"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to perform SQL operations","description":"$45","origin":"File/Memory","mitre_attack_id":"T1213","relevance":3,"id":"string-836","sources":[{"report_type":"sandbox","report_id":"6a9e91b0d972b9c71504dfdf"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used for searching a directory for files","description":"$46","origin":"API Call","mitre_attack_id":"T1083","relevance":5,"id":"api-102","sources":[{"report_type":"sandbox","report_id":"6a9e91b0d972b9c71504dfdf"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"References Chromium browser credentials files","description":"Found string \"BraveSoftware\\Brave-Browser\\User Data\\Default\\Login Data\" (Indicator: \"bravesoftware\\brave-browser\\user data\\default\\login data\"; File: \"afb24fab9c0b0f9e60d81bd7fd2d7999c842bf00b5bb9e0bf7347e36eacafad7\")\n Found string \"Google\\Chrome\\User Data\\Default\\Login Data\" (Indicator: \"google\\chrome\\user data\\default\\login data\"; File: \"afb24fab9c0b0f9e60d81bd7fd2d7999c842bf00b5bb9e0bf7347e36eacafad7\")\n Found string \"Microsoft\\Edge\\User Data\\Default\\Login Data\" (Indicator: \"edge\\user data\\default\\login data\"; File: \"afb24fab9c0b0f9e60d81bd7fd2d7999c842bf00b5bb9e0bf7347e36eacafad7\")\n Found string \"Opera Software\\Opera GX Stable\\Login Data\" (Indicator: \"opera software\\opera gx stable\\login data\"; File: \"afb24fab9c0b0f9e60d81bd7fd2d7999c842bf00b5bb9e0bf7347e36eacafad7\")\n Found string \"Opera Software\\Opera Stable\\Login Data\" (Indicator: \"opera software\\opera stable\\login data\"; File: \"afb24fab9c0b0f9e60d81bd7fd2d7999c842bf00b5bb9e0bf7347e36eacafad7\")","origin":"File/Memory","mitre_attack_id":"T1555.003","relevance":3,"id":"string-1000","sources":[{"report_type":"sandbox","report_id":"6a9e91b0d972b9c71504dfdf"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"References Firefox browser credentials files","description":"Found string \"logins.json\" (Indicator: \"logins.json\"; in File: \"afb24fab9c0b0f9e60d81bd7fd2d7999c842bf00b5bb9e0bf7347e36eacafad7\")","origin":"File/Memory","mitre_attack_id":"T1555.003","relevance":1,"id":"string-405","sources":[{"report_type":"sandbox","report_id":"6a9e91b0d972b9c71504dfdf"}]},{"level":"informative","category":"System Security","name":"Calls an API typically used to enable or disable privileges in the specified access token","description":"\"afb24fab9c0b0f9e60d81bd7fd2d7999c842bf00b5bb9e0bf7347e36eacafad7.exe\" called an API \"AdjustTokenPrivileges\"on file: C:\\Windows\\System32\\cryptsp.dll\" (UID: 00000000-00004144), \"fortnitemap.exe\" called an API \"AdjustTokenPrivileges\"on file: C:\\Windows\\System32\\cryptsp.dll\" (UID: 00000000-00003776)","origin":"API Call","mitre_attack_id":"T1134","relevance":3,"id":"api-111","sources":[{"report_type":"sandbox","report_id":"6a9e91b0d972b9c71504dfdf"}]},{"level":"informative","category":"System Security","name":"Opens the Kernel Security Device Driver (KsecDD) of Windows","description":"\"afb24fab9c0b0f9e60d81bd7fd2d7999c842bf00b5bb9e0bf7347e36eacafad7.exe\" opened \"\\Device\\KsecDD\"\n \"schtasks.exe\" opened \"\\Device\\KsecDD\"\n \"fortnitemap.exe\" opened \"\\Device\\KsecDD\"","origin":"API Call","mitre_attack_id":"T1068","relevance":10,"id":"api-37","sources":[{"report_type":"sandbox","report_id":"6a9e91b0d972b9c71504dfdf"}]},{"level":"suspicious","category":"Environment Awareness","name":"Able to retrieve open application windows","description":"Observed API \"GetForegroundWindow\" in \"afb24fab9c0b0f9e60d81bd7fd2d7999c842bf00b5bb9e0bf7347e36eacafad7\"\n Observed API \"GetWindowText\" in \"afb24fab9c0b0f9e60d81bd7fd2d7999c842bf00b5bb9e0bf7347e36eacafad7\"\n Observed API \"GetForegroundWindow\" in \"fortnitemap.exe\"\n Observed API \"GetWindowText\" in \"fortnitemap.exe\"","origin":"Static Parser","mitre_attack_id":"T1010","relevance":1,"id":"static-222","sources":[{"report_type":"sandbox","report_id":"6a9e91b0d972b9c71504dfdf"}]},{"level":"suspicious","category":"External Systems","name":"Sample was identified as malicious by at least one Antivirus engine","description":"20/27 Antivirus vendors marked sample as malicious (74% detection rate)","origin":"External System","id":"avtest-0","sources":[{"report_type":"sandbox","report_id":"6a9e91b0d972b9c71504dfdf"}]},{"level":"suspicious","category":"Network Related","name":"Contains ability to listen for incoming connections","description":"$47","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1040","relevance":5,"id":"stream-33","sources":[{"report_type":"sandbox","report_id":"6a9e91b0d972b9c71504dfdf"}]},{"level":"suspicious","category":"Network Related","name":"Contains ability to open a port and listen for incoming connection","description":"$48","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1571","relevance":5,"id":"stream-85","sources":[{"report_type":"sandbox","report_id":"6a9e91b0d972b9c71504dfdf"}]},{"level":"suspicious","category":"Network Related","name":"Reference to an external IP address lookup service identified","description":"\"https://api.ipify.org/\" (Indicator: \"api.ipify.org\"; File: \"6000217-_~_\")","origin":"File/Memory","mitre_attack_id":"T1016","relevance":1,"id":"string-56","sources":[{"report_type":"sandbox","report_id":"6a9e91b0d972b9c71504dfdf"}]},{"level":"suspicious","category":"Network Related","name":"Spawned process connects to a network","description":"Process \"%APPDATA%\\SubDir\\fortnitemap.exe\" connects to 82.10.132.77 on port 4782 (TCP)","origin":"Monitored Target","mitre_attack_id":"T1071","relevance":5,"id":"target-412","sources":[{"report_type":"sandbox","report_id":"6a9e91b0d972b9c71504dfdf"}]},{"level":"suspicious","category":"Pattern Matching","name":"Yara Signature Match - Indicators","description":"$49","origin":"YARA Signature","relevance":9,"id":"yara-553","sources":[{"report_type":"sandbox","report_id":"6a9e91b0d972b9c71504dfdf"}]},{"level":"suspicious","category":"System Security","name":"Adjusts debug privileges","description":"\"afb24fab9c0b0f9e60d81bd7fd2d7999c842bf00b5bb9e0bf7347e36eacafad7.exe\" adjusted SE_DEBUG_PRIVILEGE on file \"C:\\Windows\\System32\\cryptsp.dll\"\n \"fortnitemap.exe\" adjusted SE_DEBUG_PRIVILEGE on file \"C:\\Windows\\System32\\cryptsp.dll\"","origin":"API Call","mitre_attack_id":"T1134","relevance":3,"id":"api-28","sources":[{"report_type":"sandbox","report_id":"6a9e91b0d972b9c71504dfdf"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Spawned processes are likely due to an injection","description":"Process \"%APPDATA%\\SubDir\\fortnitemap.exe\" spawned likely due to injection","origin":"Monitored Target","mitre_attack_id":"T1055","relevance":3,"id":"target-413","sources":[{"report_type":"sandbox","report_id":"6a9e91b0d972b9c71504dfdf"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by a large number of Antivirus engines","description":"20/27 Antivirus vendors marked sample as malicious (74% detection rate)","origin":"External System","relevance":10,"id":"avtest-3","sources":[{"report_type":"sandbox","report_id":"6a9e91b0d972b9c71504dfdf"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by a trusted antivirus engine","description":"Trusted antivirus vendors count marked sample as malicious (count = 2)","origin":"External System","mitre_attack_id":"T1204.002","relevance":10,"id":"avtest-5","sources":[{"report_type":"sandbox","report_id":"6a9e91b0d972b9c71504dfdf"}]},{"level":"malicious","category":"General","name":"The analysis spawned a process that was identified as malicious","description":"20/27 Antivirus vendors marked spawned process \"fortnitemap.exe\" (PID: 3776) as malicious (classified as \"MSIL_Troj.BTX.gen\" with 74% detection rate)","origin":"Monitored Target","mitre_attack_id":"T1204.002","relevance":10,"id":"target-58","sources":[{"report_type":"sandbox","report_id":"6a9e91b0d972b9c71504dfdf"}]}],"incidents":[{"name":"Remote Access","details_count":1,"details":[{"detail":"Contains ability to listen for incoming connections"}],"sources":[{"report_type":"sandbox","report_id":"6836a5da950abe50e709d27c"},{"report_type":"sandbox","report_id":"6a9e91b0d972b9c71504dfdf"}]},{"name":"Spyware","details_count":2,"details":[{"detail":"Found a string that may be used as part of an injection method"},{"detail":"Found browser information locations related strings"}],"sources":[{"report_type":"sandbox","report_id":"6836a5da950abe50e709d27c"},{"report_type":"sandbox","report_id":"6a9e91b0d972b9c71504dfdf"}]},{"name":"Stealer/Phishing","details_count":1,"details":[{"detail":"Found FTP credentials location strings"}],"sources":[{"report_type":"sandbox","report_id":"6836a5da950abe50e709d27c"},{"report_type":"sandbox","report_id":"6a9e91b0d972b9c71504dfdf"}]},{"name":"Persistence","details_count":1,"details":[{"detail":"Schedules a task to be executed at a specific time and date"}],"sources":[{"report_type":"sandbox","report_id":"6836a5da950abe50e709d27c"},{"report_type":"sandbox","report_id":"6a9e91b0d972b9c71504dfdf"}]},{"name":"Fingerprint","details_count":2,"details":[{"detail":"Queries process information"},{"detail":"Contains ability to retrieve information about the current system"}],"sources":[{"report_type":"sandbox","report_id":"6836a5da950abe50e709d27c"},{"report_type":"sandbox","report_id":"6a9e91b0d972b9c71504dfdf"}]},{"name":"Evasive","details_count":4,"details":[{"detail":"Marks file for deletion"},{"detail":"Tries to hide tracks of having downloaded a file from the internet"},{"detail":"Found a reference to a WMI query string known to be used for VM detection"},{"detail":"Input file contains API references not part of its Import Address Table (IAT)"}],"sources":[{"report_type":"sandbox","report_id":"6836a5da950abe50e709d27c"},{"report_type":"sandbox","report_id":"6a9e91b0d972b9c71504dfdf"}]}],"intel_graph":{"map":{"Adversary:bbed552e992e2f7ab900f2a8c5f22571d38fe81d84374db1500f7609f59b7300":{"type":"Adversary","value":"BLIND SPIDER","verdict":{"verdict":"malicious","verdict_source":"indicator database"}},"File:764e6a8907cea21cb264a30bbbe0989aa998cb446e63d7113d03f037a3c892dc":{"type":"File","value":"764e6a8907cea21cb264a30bbbe0989aa998cb446e63d7113d03f037a3c892dc","verdict":{"verdict":"malicious","verdict_source":"indicator database","reasons":["Detected malware C2 configuration","Detected relationship with a Threat Quasar","confirmed relationship with an Adversary BLIND SPIDER"]},"filetype":"PE32+ executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows","filetype_short":"PE64","mime_type":"application/x-dosexec"},"File:9be47a97d8dfb5465d57548b6c4095b96797963bccc4fef9b5291eb72cd1f586":{"type":"File","value":"9be47a97d8dfb5465d57548b6c4095b96797963bccc4fef9b5291eb72cd1f586","verdict":{"verdict":"malicious","verdict_source":"indicator database","reasons":["Detected malware C2 configuration","Detected relationship with a Threat Quasar","confirmed relationship with an Adversary BLIND SPIDER"]},"filetype":"PE32+ executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows","filetype_short":"PE64","mime_type":"application/x-dosexec"},"File:afb24fab9c0b0f9e60d81bd7fd2d7999c842bf00b5bb9e0bf7347e36eacafad7":{"type":"File","value":"afb24fab9c0b0f9e60d81bd7fd2d7999c842bf00b5bb9e0bf7347e36eacafad7","verdict":{"verdict":"malicious","verdict_source":"indicator database","reasons":["Creates scheduled task using schtasks.exe","Detected malware C2 configuration","Detected relationship with a Threat Quasar","Dynamic analysis produced likely malicious output file","Suspected stealer executable based on static file features","confirmed malicious file","confirmed relationship with a Threat Quasar","confirmed relationship with an Adversary BLIND SPIDER"]},"filetype":"PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows","filetype_short":"PE32","mime_type":"application/x-dosexec"},"File:ca26c3973476dd6bc7dc5325fe7881d48f814a33f8a406e81ec5533ca73c4baf":{"type":"File","value":"ca26c3973476dd6bc7dc5325fe7881d48f814a33f8a406e81ec5533ca73c4baf","verdict":{"verdict":"malicious","verdict_source":"indicator database","reasons":["Detected malware C2 configuration","Detected relationship with a Threat Quasar","confirmed relationship with an Adversary BLIND SPIDER"]},"filetype":"PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows","filetype_short":"PE32","mime_type":"application/x-dosexec"},"File:f30b02b0b2de13d67f64c21a962271dfe6a1349695ee4820c870e450c1341c19":{"type":"File","value":"f30b02b0b2de13d67f64c21a962271dfe6a1349695ee4820c870e450c1341c19"},"File:f31c0e4ab8c00823851e51b730b5aba5a7bafde5320a4837140b85f7415bbf85":{"type":"File","value":"f31c0e4ab8c00823851e51b730b5aba5a7bafde5320a4837140b85f7415bbf85","verdict":{"verdict":"malicious","verdict_source":"indicator database","reasons":["Detected malware C2 configuration","Detected relationship with a Threat Quasar","confirmed relationship with an Adversary BLIND SPIDER"]},"filetype":"PE32+ executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows","filetype_short":"PE64","mime_type":"application/x-dosexec"},"Ip:82.10.132.77":{"type":"Ip","value":"82.10.132.77"},"Threat:d9bb688ffeddaa656e6f3b7c4f321c10c080132c43ab3b98d8ff58409fe90d9c":{"type":"Threat","value":"Quasar","verdict":{"verdict":"malicious","verdict_source":"indicator database","reasons":["Detected relationship with a Threat Quasar","confirmed relationship with an Adversary BLIND SPIDER"]}},"Url:c401ebcad2d2c5d0451c706a02e7d73e40185f71861a38e3c4f2c8677529fdb9":{"type":"Url","value":"tcp://82.10.132.77:4782","verdict":{"verdict":"malicious","verdict_source":"dynamic and static analysis","reasons":["Detected malware C2 configuration"]}}},"chains":[{"id":"1546467088308721685","root":"File:afb24fab9c0b0f9e60d81bd7fd2d7999c842bf00b5bb9e0bf7347e36eacafad7","edges":[],"verdict":{"verdict":"malicious","verdict_source":"indicator database","reasons":["Creates scheduled task using schtasks.exe","Detected malware C2 configuration","Detected relationship with a Threat Quasar","Dynamic analysis produced likely malicious output file","Suspected stealer executable based on static file features","confirmed malicious file","confirmed relationship with a Threat Quasar","confirmed relationship with an Adversary BLIND SPIDER"]}},{"id":"1546467091963909311","root":"File:afb24fab9c0b0f9e60d81bd7fd2d7999c842bf00b5bb9e0bf7347e36eacafad7","edges":[{"edge_kind":"is_threat","from_key":"File:afb24fab9c0b0f9e60d81bd7fd2d7999c842bf00b5bb9e0bf7347e36eacafad7","to_key":"Threat:d9bb688ffeddaa656e6f3b7c4f321c10c080132c43ab3b98d8ff58409fe90d9c"}],"verdict":{"verdict":"malicious","verdict_source":"dynamic and static analysis","reasons":["Malware presence detected","confirmed relationship with an Adversary BLIND SPIDER"]}},{"id":"1546467087574036054","root":"File:afb24fab9c0b0f9e60d81bd7fd2d7999c842bf00b5bb9e0bf7347e36eacafad7","edges":[{"edge_kind":"contains_c2_config","from_key":"File:afb24fab9c0b0f9e60d81bd7fd2d7999c842bf00b5bb9e0bf7347e36eacafad7","to_key":"Url:c401ebcad2d2c5d0451c706a02e7d73e40185f71861a38e3c4f2c8677529fdb9"}],"verdict":{"verdict":"malicious","verdict_source":"dynamic and static analysis","reasons":["Malware presence detected"]}},{"id":"1546467087574036053","root":"File:afb24fab9c0b0f9e60d81bd7fd2d7999c842bf00b5bb9e0bf7347e36eacafad7","edges":[{"edge_kind":"memory","from_key":"File:afb24fab9c0b0f9e60d81bd7fd2d7999c842bf00b5bb9e0bf7347e36eacafad7","to_key":"File:764e6a8907cea21cb264a30bbbe0989aa998cb446e63d7113d03f037a3c892dc"},{"edge_kind":"is_threat","from_key":"File:764e6a8907cea21cb264a30bbbe0989aa998cb446e63d7113d03f037a3c892dc","to_key":"Threat:d9bb688ffeddaa656e6f3b7c4f321c10c080132c43ab3b98d8ff58409fe90d9c"}],"verdict":{"verdict":"malicious","verdict_source":"dynamic and static analysis","reasons":["Malware presence detected"]}},{"id":"1546467087574036058","root":"File:afb24fab9c0b0f9e60d81bd7fd2d7999c842bf00b5bb9e0bf7347e36eacafad7","edges":[{"edge_kind":"memory","from_key":"File:afb24fab9c0b0f9e60d81bd7fd2d7999c842bf00b5bb9e0bf7347e36eacafad7","to_key":"File:764e6a8907cea21cb264a30bbbe0989aa998cb446e63d7113d03f037a3c892dc"},{"edge_kind":"contains_c2_config","from_key":"File:764e6a8907cea21cb264a30bbbe0989aa998cb446e63d7113d03f037a3c892dc","to_key":"Url:c401ebcad2d2c5d0451c706a02e7d73e40185f71861a38e3c4f2c8677529fdb9"}],"verdict":{"verdict":"malicious","verdict_source":"dynamic and static analysis","reasons":["Malware presence detected"]}},{"id":"1546467087574036052","root":"File:afb24fab9c0b0f9e60d81bd7fd2d7999c842bf00b5bb9e0bf7347e36eacafad7","edges":[{"edge_kind":"memory","from_key":"File:afb24fab9c0b0f9e60d81bd7fd2d7999c842bf00b5bb9e0bf7347e36eacafad7","to_key":"File:9be47a97d8dfb5465d57548b6c4095b96797963bccc4fef9b5291eb72cd1f586"},{"edge_kind":"is_threat","from_key":"File:9be47a97d8dfb5465d57548b6c4095b96797963bccc4fef9b5291eb72cd1f586","to_key":"Threat:d9bb688ffeddaa656e6f3b7c4f321c10c080132c43ab3b98d8ff58409fe90d9c"}],"verdict":{"verdict":"malicious","verdict_source":"dynamic and static analysis","reasons":["Malware presence detected"]}},{"id":"1546467087574036057","root":"File:afb24fab9c0b0f9e60d81bd7fd2d7999c842bf00b5bb9e0bf7347e36eacafad7","edges":[{"edge_kind":"memory","from_key":"File:afb24fab9c0b0f9e60d81bd7fd2d7999c842bf00b5bb9e0bf7347e36eacafad7","to_key":"File:9be47a97d8dfb5465d57548b6c4095b96797963bccc4fef9b5291eb72cd1f586"},{"edge_kind":"contains_c2_config","from_key":"File:9be47a97d8dfb5465d57548b6c4095b96797963bccc4fef9b5291eb72cd1f586","to_key":"Url:c401ebcad2d2c5d0451c706a02e7d73e40185f71861a38e3c4f2c8677529fdb9"}],"verdict":{"verdict":"malicious","verdict_source":"dynamic and static analysis","reasons":["Malware presence detected"]}},{"id":"1546467087574036050","root":"File:afb24fab9c0b0f9e60d81bd7fd2d7999c842bf00b5bb9e0bf7347e36eacafad7","edges":[{"edge_kind":"memory","from_key":"File:afb24fab9c0b0f9e60d81bd7fd2d7999c842bf00b5bb9e0bf7347e36eacafad7","to_key":"File:ca26c3973476dd6bc7dc5325fe7881d48f814a33f8a406e81ec5533ca73c4baf"},{"edge_kind":"is_threat","from_key":"File:ca26c3973476dd6bc7dc5325fe7881d48f814a33f8a406e81ec5533ca73c4baf","to_key":"Threat:d9bb688ffeddaa656e6f3b7c4f321c10c080132c43ab3b98d8ff58409fe90d9c"}],"verdict":{"verdict":"malicious","verdict_source":"dynamic and static analysis","reasons":["Malware presence detected"]}},{"id":"1546467087574036055","root":"File:afb24fab9c0b0f9e60d81bd7fd2d7999c842bf00b5bb9e0bf7347e36eacafad7","edges":[{"edge_kind":"memory","from_key":"File:afb24fab9c0b0f9e60d81bd7fd2d7999c842bf00b5bb9e0bf7347e36eacafad7","to_key":"File:ca26c3973476dd6bc7dc5325fe7881d48f814a33f8a406e81ec5533ca73c4baf"},{"edge_kind":"contains_c2_config","from_key":"File:ca26c3973476dd6bc7dc5325fe7881d48f814a33f8a406e81ec5533ca73c4baf","to_key":"Url:c401ebcad2d2c5d0451c706a02e7d73e40185f71861a38e3c4f2c8677529fdb9"}],"verdict":{"verdict":"malicious","verdict_source":"dynamic and static analysis","reasons":["Malware presence detected"]}},{"id":"1546467087574036051","root":"File:afb24fab9c0b0f9e60d81bd7fd2d7999c842bf00b5bb9e0bf7347e36eacafad7","edges":[{"edge_kind":"memory","from_key":"File:afb24fab9c0b0f9e60d81bd7fd2d7999c842bf00b5bb9e0bf7347e36eacafad7","to_key":"File:f31c0e4ab8c00823851e51b730b5aba5a7bafde5320a4837140b85f7415bbf85"},{"edge_kind":"is_threat","from_key":"File:f31c0e4ab8c00823851e51b730b5aba5a7bafde5320a4837140b85f7415bbf85","to_key":"Threat:d9bb688ffeddaa656e6f3b7c4f321c10c080132c43ab3b98d8ff58409fe90d9c"}],"verdict":{"verdict":"malicious","verdict_source":"dynamic and static analysis","reasons":["Malware presence detected"]}},{"id":"1546467087574036056","root":"File:afb24fab9c0b0f9e60d81bd7fd2d7999c842bf00b5bb9e0bf7347e36eacafad7","edges":[{"edge_kind":"memory","from_key":"File:afb24fab9c0b0f9e60d81bd7fd2d7999c842bf00b5bb9e0bf7347e36eacafad7","to_key":"File:f31c0e4ab8c00823851e51b730b5aba5a7bafde5320a4837140b85f7415bbf85"},{"edge_kind":"contains_c2_config","from_key":"File:f31c0e4ab8c00823851e51b730b5aba5a7bafde5320a4837140b85f7415bbf85","to_key":"Url:c401ebcad2d2c5d0451c706a02e7d73e40185f71861a38e3c4f2c8677529fdb9"}],"verdict":{"verdict":"malicious","verdict_source":"dynamic and static analysis","reasons":["Malware presence detected"]}},{"id":"1546467089847693914","root":"Threat:d9bb688ffeddaa656e6f3b7c4f321c10c080132c43ab3b98d8ff58409fe90d9c","edges":[{"edge_kind":"used_by","from_key":"Threat:d9bb688ffeddaa656e6f3b7c4f321c10c080132c43ab3b98d8ff58409fe90d9c","to_key":"Adversary:bbed552e992e2f7ab900f2a8c5f22571d38fe81d84374db1500f7609f59b7300"}],"verdict":{"verdict":"malicious","verdict_source":"indicator database"}},{"id":"1546467089847693915","root":"Threat:d9bb688ffeddaa656e6f3b7c4f321c10c080132c43ab3b98d8ff58409fe90d9c","edges":[],"verdict":{"verdict":"malicious","verdict_source":"indicator database"}},{"id":"sandbox_network","root":"File:afb24fab9c0b0f9e60d81bd7fd2d7999c842bf00b5bb9e0bf7347e36eacafad7","edges":[{"edge_kind":"contacted_ip","from_key":"File:afb24fab9c0b0f9e60d81bd7fd2d7999c842bf00b5bb9e0bf7347e36eacafad7","to_key":"Ip:82.10.132.77"}],"verdict":{"verdict":"unknown","verdict_source":"sandbox"}},{"id":"sandbox_files","root":"File:afb24fab9c0b0f9e60d81bd7fd2d7999c842bf00b5bb9e0bf7347e36eacafad7","edges":[{"edge_kind":"extracted","from_key":"File:afb24fab9c0b0f9e60d81bd7fd2d7999c842bf00b5bb9e0bf7347e36eacafad7","to_key":"File:afb24fab9c0b0f9e60d81bd7fd2d7999c842bf00b5bb9e0bf7347e36eacafad7"},{"edge_kind":"extracted","from_key":"File:afb24fab9c0b0f9e60d81bd7fd2d7999c842bf00b5bb9e0bf7347e36eacafad7","to_key":"File:afb24fab9c0b0f9e60d81bd7fd2d7999c842bf00b5bb9e0bf7347e36eacafad7"},{"edge_kind":"extracted","from_key":"File:afb24fab9c0b0f9e60d81bd7fd2d7999c842bf00b5bb9e0bf7347e36eacafad7","to_key":"File:f30b02b0b2de13d67f64c21a962271dfe6a1349695ee4820c870e450c1341c19"}],"verdict":{"verdict":"unknown","verdict_source":"sandbox"}}]}},"activity":{"stats":{"process_count":4,"spawned_processes_count":4,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":2,"imported_dlls_count":103,"dropped_files_count":0,"extracted_files_count":3,"files_written_count":4,"files_deleted_count":0,"registry_keys_created_count":2,"registry_keys_modified_count":0,"registry_keys_deleted_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":2,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":1,"contacted_hosts_count":1,"dns_resolutions_count":0,"contacted_urls_count":0,"http_requests_count":0},"behavior_tags":["commodity","rat","quasar","opensource","targeted","criminal","njrat","evasive"],"sample_flags":["Multi-Process","Network Traffic","Extracted Files","TOR analysis"],"sandbox_reports":[{"id":"6a9e91b0d972b9c71504dfdf","environment_id":100,"environment_description":"Windows 7 32 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"malware_family":"MSIL_Troj.BTX.gen","contacted_countries":["GBR"],"submit_name":"afb24fab9c0b0f9e60d81bd7fd2d7999c842bf00b5bb9e0bf7347e36eacafad7","analysis_start_time":"2026-09-07T10:28:02+00:00","indicators_count":{"informative":159,"suspicious":36,"malicious":9},"tags":["Multi-Process","Network Traffic","Extracted Files"],"is_in_unified_schema":true},{"id":"6836a5da950abe50e709d27c","environment_id":160,"environment_description":"Windows 10 64 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"contacted_countries":["GBR"],"submit_name":"afb24fab9c0b0f9e60d81bd7fd2d7999c842bf00b5bb9e0bf7347e36eacafad7","analysis_start_time":"2025-05-28T05:57:47+00:00","indicators_count":{"informative":116,"suspicious":34,"malicious":9},"tags":["Multi-Process","Network Traffic","Extracted Files","TOR analysis"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":[{"address":"82.10.132.77","port":4782,"protocol":"TCP","country":"United Kingdom","sources":[{"report_type":"sandbox","report_id":"6836a5da950abe50e709d27c"},{"report_type":"sandbox","report_id":"6a9e91b0d972b9c71504dfdf"}]}],"dns_resolutions":null,"http_requests":null,"embedded_urls":[{"value":"tcp://82.10.132.77:4782","sources":[{"report_type":"qsp","report_id":""}]}]},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"6836a5da950abe50e709d27c"}],"processes":[{"pid":3644,"ppid":0,"name":"afb24fab9c0b0f9e60d81bd7fd2d7999c842bf00b5bb9e0bf7347e36eacafad7.exe","command_line":"","sha256":"afb24fab9c0b0f9e60d81bd7fd2d7999c842bf00b5bb9e0bf7347e36eacafad7","normalized_path":"C:\\afb24fab9c0b0f9e60d81bd7fd2d7999c842bf00b5bb9e0bf7347e36eacafad7.exe","uid":"00000000-00003644","icon":"$4a"},{"pid":6660,"ppid":3644,"name":"schtasks.exe","command_line":"\"schtasks\" /create /tn \"Discord Startup\" /sc ONLOGON /tr \"%APPDATA%\\SubDir\\fortnitemap.exe\" /rl HIGHEST /f","sha256":"3a0943826ebc7f6d76908e5bc6a14067265460b0742f89ae0f74b9380ef9a361","normalized_path":"%WINDIR%\\SYSTEM32\\schtasks.exe","parent_uid":"00000000-00003644","uid":"00000000-00006660"},{"pid":5412,"ppid":0,"name":"fortnitemap.exe","command_line":"","sha256":"afb24fab9c0b0f9e60d81bd7fd2d7999c842bf00b5bb9e0bf7347e36eacafad7","normalized_path":"%APPDATA%\\SubDir\\fortnitemap.exe","uid":"00000000-00005412","icon":"$4b"},{"pid":6524,"ppid":5412,"name":"schtasks.exe","command_line":"\"schtasks\" /create /tn \"Discord Startup\" /sc ONLOGON /tr \"%APPDATA%\\SubDir\\fortnitemap.exe\" /rl HIGHEST /f","sha256":"3a0943826ebc7f6d76908e5bc6a14067265460b0742f89ae0f74b9380ef9a361","normalized_path":"%WINDIR%\\SYSTEM32\\schtasks.exe","parent_uid":"00000000-00005412","uid":"00000000-00006524"}],"all_imported_dlls":["user32.dll","fltLib.dll","msvcrt.dll","shlwapi.dll","clbcatq.dll","System.Core.ni.dll","xmllite.dll","psapi.dll","System.Configuration.ni.dll","shell32.dll","crypt32.dll","combase.dll","ucrtbase.dll","gdi32full.dll","clrjit.dll","ntmarta.dll","VxSSL64.dll","vcruntime140_clr0400.dll","KernelBase.dll","advapi32.dll","uxtheme.dll","windows.storage.dll","msasn1.dll","sspicli.dll","mscorlib.ni.dll","rsaenh.dll","mscoreei.dll","bcryptprimitives.dll","System.ni.dll","System.Windows.Forms.ni.dll","System.Xml.ni.dll","ws2_32.dll","win32u.dll","System.Drawing.ni.dll","SHCore.dll","cryptsp.dll","profapi.dll","gdi32.dll","msvcp_win.dll","version.dll","ucrtbase_clr0400.dll","cryptbase.dll","dwmapi.dll","ntdll.dll","sechost.dll","kernel.appcore.dll","clr.dll","bcrypt.dll","comctl32.dll","oleaut32.dll","mscoree.dll","rpcrt4.dll","ole32.dll","cfgmgr32.dll","msctf.dll","taskschd.dll","imm32.dll","powrprof.dll","kernel32.dll","api-ms-win-core-file-l2-1-0.dll","api-ms-win-core-xstate-l2-1-0.dll","msvcp140.dll","api-ms-win-crt-runtime-l1-1-0.dll","api-ms-win-crt-math-l1-1-0.dll","rpcss.dll","api-ms-win-core-localization-l1-2-0.dll","api-ms-win-core-processthreads-l1-1-1.dll","VxSSL32.dll","Wldap32.dll","dsrole.dll","cryptnet.dll","wship6.dll","api-ms-win-crt-heap-l1-1-0.dll","System.Data.SqlXml.ni.dll","lpk.dll","usp10.dll","api-ms-win-core-file-l1-2-0.dll","api-ms-win-crt-filesystem-l1-1-0.dll","RpcRtRemote.dll","vcruntime140.dll","api-ms-win-crt-string-l1-1-0.dll","api-ms-win-crt-convert-l1-1-0.dll","api-ms-win-crt-time-l1-1-0.dll","System.Runtime.Serialization.ni.dll","api-ms-win-crt-utility-l1-1-0.dll","System.Security.ni.dll","System.Windows.Forms.dll","api-ms-win-core-synch-l1-2-0.dll","nsi.dll","api-ms-win-core-timezone-l1-1-0.dll","api-ms-win-crt-stdio-l1-1-0.dll","api-ms-win-crt-locale-l1-1-0.dll","ktmw32.dll","System.ServiceModel.dll","api-ms-win-crt-environment-l1-1-0.dll","atl.dll","apphelp.dll","Accessibility.ni.dll","mswsock.dll","WSHTCPIP.DLL","SensApi.dll","nlssorting.dll","certcli.dll"]},"file_activity":{"dropped_files":[],"extracted_files":[{"name":"fortnitemap.exe","sha256":"afb24fab9c0b0f9e60d81bd7fd2d7999c842bf00b5bb9e0bf7347e36eacafad7","verdict":"malicious","sources":[{"report_type":"sandbox","report_id":"6836a5da950abe50e709d27c"},{"report_type":"sandbox","report_id":"6a9e91b0d972b9c71504dfdf"}]},{"name":"fortnitemap.exe.bin","sha256":"afb24fab9c0b0f9e60d81bd7fd2d7999c842bf00b5bb9e0bf7347e36eacafad7","verdict":"malicious","sources":[{"report_type":"sandbox","report_id":"6836a5da950abe50e709d27c"}]},{"name":"afb24fab9c0b0f9e60d81bd7fd2d7999c842bf00b5bb9e0bf7347e36eacafad7.exe.log","sha256":"f30b02b0b2de13d67f64c21a962271dfe6a1349695ee4820c870e450c1341c19","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6836a5da950abe50e709d27c"}]}],"files_written":[{"path":"C:\\Users\\%OSUSER%","sources":[{"report_type":"sandbox","report_id":"6836a5da950abe50e709d27c"},{"report_type":"sandbox","report_id":"6a9e91b0d972b9c71504dfdf"}]},{"path":"%USERPROFILE%\\AppData\\Roaming","sources":[{"report_type":"sandbox","report_id":"6836a5da950abe50e709d27c"},{"report_type":"sandbox","report_id":"6a9e91b0d972b9c71504dfdf"}]},{"path":"%APPDATA%\\SubDir\\fortnitemap.exe","sources":[{"report_type":"sandbox","report_id":"6836a5da950abe50e709d27c"},{"report_type":"sandbox","report_id":"6a9e91b0d972b9c71504dfdf"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\CLR_v4.0\\UsageLogs\\afb24fab9c0b0f9e60d81bd7fd2d7999c842bf00b5bb9e0bf7347e36eacafad7.exe.log","sources":[{"report_type":"sandbox","report_id":"6836a5da950abe50e709d27c"}]}],"files_deleted":null},"registry_activity":{"keys_created":[{"key":"HKLMHKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\TIMEZONEINFORMATION\\","sources":[{"report_type":"sandbox","report_id":"6a9e91b0d972b9c71504dfdf"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\\AUTOENROLLMENT\\","sources":[{"report_type":"sandbox","report_id":"6a9e91b0d972b9c71504dfdf"}]}],"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":[{"name":"\\Sessions\\1\\BaseNamedObjects\\Global\\CLR_PerfMon_WrapMutex","sources":[{"report_type":"sandbox","report_id":"6a9e91b0d972b9c71504dfdf"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\9165d845-5b53-4916-8289-e3cd1c364dd1","sources":[{"report_type":"sandbox","report_id":"6a9e91b0d972b9c71504dfdf"}]}]}},"report_ids":{"sandbox_job_ids":["6a9e91b0d972b9c71504dfdf","6836a5da950abe50e709d27c"]}}}]]}] 1e:null 22:[["$","title","0",{"children":"Malicious Trojan.Agent Sample afb24fab9c0b… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample afb24fab9c0b…. Malware family: Trojan.Agent. Threat score 100/100. 21/28 AV engines flagged this file. 14 malicious and 25 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/afb24fab9c0b0f9e60d81bd7fd2d7999c842bf00b5bb9e0bf7347e36eacafad7"}],["$","meta","4",{"property":"og:title","content":"Malicious Trojan.Agent Sample afb24fab9c0b… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample afb24fab9c0b…. Malware family: Trojan.Agent. Threat score 100/100. 21/28 AV engines flagged this file. 14 malicious and 25 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/afb24fab9c0b0f9e60d81bd7fd2d7999c842bf00b5bb9e0bf7347e36eacafad7"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious Trojan.Agent Sample afb24fab9c0b… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample afb24fab9c0b…. Malware family: Trojan.Agent. Threat score 100/100. 21/28 AV engines flagged this file. 14 malicious and 25 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L4c","11",{}]]