File name:

Fortnite.exe

Full analysis: https://app.any.run/tasks/5eed9a01-2d58-4140-9b7b-6f10f58f50d5
Verdict: Malicious activity
Threats:

XWorm is a remote access trojan (RAT) sold as a malware-as-a-service. It possesses an extensive hacking toolset and is capable of gathering private information and files from the infected computer, hijacking MetaMask and Telegram accounts, and tracking user activity. XWorm is typically delivered to victims' computers through multi-stage attacks that start with phishing emails.

Malware Trends Tracker     >>>
Analysis date: January 05, 2025, 04:31:49
OS: Windows 10 Professional (build: 19045, 64 bit)
Tags:
evasion
phishing
remote
xworm
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows, 3 sections
MD5:

FF55A4BB39B47FB44EB8E8187979D7C1

SHA1:

566DBD117A7EB5ECE4029C23D184200E3F43D5A1

SHA256:

4C7575822380A33D3AB184A8B9027755186BB817690291FCCF5F9F47A75CDC5E

SSDEEP:

98304:SwmckF2Bhra14m/ksvlb8FTuN4otAh75pChFocud6MrR0mWkYfo/A+HEhLlaIn:S

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Changes the autorun value in the registry

      • uzivert-private.exe (PID: 5640)

    • Uses Task Scheduler to run other applications

      • uzivert-private.exe (PID: 5640)

    • Create files in the Startup directory

      • uzivert-private.exe (PID: 5640)

    • PHISHING has been detected (SURICATA)

      • uzivert-private.exe (PID: 5640)

    • XWORM has been detected (SURICATA)

      • uzivert-private.exe (PID: 5640)

    • XWORM has been detected (YARA)

      • uzivert-private.exe (PID: 5640)

    • Connects to the CnC server

      • uzivert-private.exe (PID: 5640)

  • SUSPICIOUS

    • Reads security settings of Internet Explorer

      • Fortnite.exe (PID: 1156)
      • uzivert-private.exe (PID: 5640)

    • Reads the date of Windows installation

      • Fortnite.exe (PID: 1156)
      • uzivert-private.exe (PID: 5640)

    • Executable content was dropped or overwritten

      • Fortnite.exe (PID: 1156)
      • uzivert-private.exe (PID: 5640)

    • Checks for external IP

      • uzivert-private.exe (PID: 5640)
      • svchost.exe (PID: 2192)

    • Connects to unusual port

      • uzivert-private.exe (PID: 5640)

    • The process executes via Task Scheduler

      • uzivert-private.exe (PID: 2324)
      • uzivert-private.exe (PID: 1804)

    • Contacting a server suspected of hosting an CnC

      • uzivert-private.exe (PID: 5640)

  • INFO

    • Reads the machine GUID from the registry

      • Fortnite.exe (PID: 1156)
      • uzivert-private.exe (PID: 5640)
      • uzivert-private.exe (PID: 1804)
      • uzivert-private.exe (PID: 2324)

    • Reads the computer name

      • Fortnite.exe (PID: 1156)
      • uzivert-private.exe (PID: 5640)
      • uzivert-private.exe (PID: 2324)
      • uzivert-private.exe (PID: 1804)

    • Checks supported languages

      • Fortnite.exe (PID: 1156)
      • uzivert-private.exe (PID: 5640)
      • uzivert-private.exe (PID: 2324)
      • uzivert-private.exe (PID: 1804)

    • Create files in a temporary directory

      • Fortnite.exe (PID: 1156)

    • The process uses the downloaded file

      • Fortnite.exe (PID: 1156)
      • uzivert-private.exe (PID: 5640)

    • Process checks computer location settings

      • Fortnite.exe (PID: 1156)
      • uzivert-private.exe (PID: 5640)

    • Disables trace logs

      • uzivert-private.exe (PID: 5640)

    • Reads Environment values

      • uzivert-private.exe (PID: 5640)

    • Checks proxy server information

      • uzivert-private.exe (PID: 5640)

    • Reads the software policy settings

      • uzivert-private.exe (PID: 5640)

    • Creates files or folders in the user directory

      • uzivert-private.exe (PID: 5640)

    • Sends debugging messages

      • uzivert-private.exe (PID: 5640)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Generic CIL Executable (.NET, Mono, etc.) (63.1)
.exe | Win64 Executable (generic) (23.8)
.dll | Win32 Dynamic Link Library (generic) (5.6)
.exe | Win32 Executable (generic) (3.8)
.exe | Generic Win/DOS Executable (1.7)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2025:01:05 03:35:20+00:00
ImageFileCharacteristics: Executable, 32-bit
PEType: PE32
LinkerVersion: 11
CodeSize: 1528832
InitializedDataSize: 272384
UninitializedDataSize: -
EntryPoint: 0x1772de
OSVersion: 4
ImageVersion: -
SubsystemVersion: 4
Subsystem: Windows GUI
FileVersionNumber: 1.0.0.0
ProductVersionNumber: 1.0.0.0
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: Neutral
CharacterSet: Unicode
FileDescription:
FileVersion: 1.0.0.0
InternalName: uzivert-private.exe
LegalCopyright:
OriginalFileName: uzivert-private.exe
ProductVersion: 1.0.0.0
AssemblyVersion: 1.0.0.0
No data.
screenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
127
Monitored processes
10
Malicious processes
2
Suspicious processes
1

Behavior graph

Click at the process to see the details
start fortnite.exe fortnite.exe no specs fortnite.exe conhost.exe no specs #PHISHING uzivert-private.exe svchost.exe schtasks.exe no specs conhost.exe no specs uzivert-private.exe no specs uzivert-private.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
1156"C:\Users\admin\Desktop\Fortnite.exe" C:\Users\admin\Desktop\Fortnite.exe
explorer.exe
User:
admin
Integrity Level:
MEDIUM
Description:
Exit code:
0
Version:
1.0.0.0
Modules
Images
c:\users\admin\desktop\fortnite.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
1804"C:\Users\admin\uzivert-private.exe"C:\Users\admin\uzivert-private.exe—svchost.exe
User:
admin
Integrity Level:
MEDIUM
Description:
Exit code:
0
Version:
1.0.0.0
Modules
Images
c:\users\admin\uzivert-private.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
2192C:\WINDOWS\system32\svchost.exe -k NetworkService -p -s DnscacheC:\Windows\System32\svchost.exe
services.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Host Process for Windows Services
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\svchost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\kernel.appcore.dll
2324"C:\Users\admin\uzivert-private.exe"C:\Users\admin\uzivert-private.exe—svchost.exe
User:
admin
Integrity Level:
MEDIUM
Description:
Exit code:
0
Version:
1.0.0.0
Modules
Images
c:\users\admin\uzivert-private.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
2756"C:\Windows\System32\schtasks.exe" /create /f /sc minute /mo 1 /tn "uzivert-private" /tr "C:\Users\admin\uzivert-private.exe"C:\Windows\System32\schtasks.exe—uzivert-private.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Task Scheduler Configuration Tool
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\schtasks.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
3988\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—Fortnite.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
4164"C:\Users\admin\AppData\Local\Temp\Fortnite.exe" C:\Users\admin\AppData\Local\Temp\Fortnite.exe
Fortnite.exe
User:
admin
Integrity Level:
HIGH
Exit code:
3221225781
Modules
Images
c:\users\admin\appdata\local\temp\fortnite.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
4536"C:\Users\admin\AppData\Local\Temp\Fortnite.exe" C:\Users\admin\AppData\Local\Temp\Fortnite.exe—Fortnite.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
3221226540
Modules
Images
c:\users\admin\appdata\local\temp\fortnite.exe
c:\windows\system32\ntdll.dll
5432\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—schtasks.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
5640"C:\Users\admin\AppData\Local\Temp\uzivert-private.exe" C:\Users\admin\AppData\Local\Temp\uzivert-private.exe
Fortnite.exe
User:
admin
Integrity Level:
MEDIUM
Description:
Version:
1.0.0.0
Modules
Images
c:\users\admin\appdata\local\temp\uzivert-private.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
Total events
5 404
Read events
5 388
Write events
16
Delete events
0

Modification events

(PID) Process:(5640) uzivert-private.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\uzivert-private_RASAPI32
Operation:writeName:EnableFileTracing
Value:
0
(PID) Process:(5640) uzivert-private.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\uzivert-private_RASAPI32
Operation:writeName:EnableAutoFileTracing
Value:
0
(PID) Process:(5640) uzivert-private.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\uzivert-private_RASAPI32
Operation:writeName:EnableConsoleTracing
Value:
0
(PID) Process:(5640) uzivert-private.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\uzivert-private_RASAPI32
Operation:writeName:FileTracingMask
Value:
(PID) Process:(5640) uzivert-private.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\uzivert-private_RASAPI32
Operation:writeName:ConsoleTracingMask
Value:
(PID) Process:(5640) uzivert-private.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\uzivert-private_RASAPI32
Operation:writeName:MaxFileSize
Value:
1048576
(PID) Process:(5640) uzivert-private.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\uzivert-private_RASAPI32
Operation:writeName:FileDirectory
Value:
%windir%\tracing
(PID) Process:(5640) uzivert-private.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\uzivert-private_RASMANCS
Operation:writeName:EnableFileTracing
Value:
0
(PID) Process:(5640) uzivert-private.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\uzivert-private_RASMANCS
Operation:writeName:EnableAutoFileTracing
Value:
0
(PID) Process:(5640) uzivert-private.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\uzivert-private_RASMANCS
Operation:writeName:EnableConsoleTracing
Value:
0
Executable files
3
Suspicious files
1
Text files
0
Unknown types
0

Dropped files

PID
Process
Filename
Type
5640uzivert-private.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\uzivert-private.lnkbinary
MD5:DB2D5AAB20375779D654976D9472EBAD
SHA256:5860B93A1A3FCC54A3C3C2727A0B26D36DB62908DAB1381A4350C9BEED1BD348
1156Fortnite.exeC:\Users\admin\AppData\Local\Temp\Fortnite.exeexecutable
MD5:703F25FD6F5C9350B09C98EF020B195B
SHA256:319D367EC1743B17C75C8ECFA64A04F4A54297C257BAD7452ABFBC2710C33C04
1156Fortnite.exeC:\Users\admin\AppData\Local\Temp\uzivert-private.exeexecutable
MD5:3575831D3B29D00B24E3FCC1D2A2F759
SHA256:C9ED17A35783F9BE2AEB923E4972CAC79C5A4E21A8F29822334FAD480B318FB8
5640uzivert-private.exeC:\Users\admin\uzivert-private.exeexecutable
MD5:3575831D3B29D00B24E3FCC1D2A2F759
SHA256:C9ED17A35783F9BE2AEB923E4972CAC79C5A4E21A8F29822334FAD480B318FB8
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
53
TCP/UDP connections
72
DNS requests
10
Threats
103

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
4652
svchost.exe
GET
200
23.216.77.20:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
4652
svchost.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
—
—
GET
—
188.114.96.3:443
https://i.ibb.co/Dwrj41N/Image.png
unknown
—
—
—
—
—
GET
—
188.114.97.3:443
https://i.ibb.co/Dwrj41N/Image.png
unknown
—
—
—
—
—
GET
—
188.114.96.3:443
https://i.ibb.co/Dwrj41N/Image.png
unknown
—
—
—
—
—
GET
—
188.114.97.3:443
https://i.ibb.co/Dwrj41N/Image.png
unknown
—
—
—
4712
MoUsoCoreWorker.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
—
—
GET
—
188.114.96.3:443
https://i.ibb.co/Dwrj41N/Image.png
unknown
—
—
—
5640
uzivert-private.exe
GET
200
208.95.112.1:80
http://ip-api.com/line/?fields=hosting
unknown
—
—
shared
—
—
GET
—
188.114.96.3:443
https://i.ibb.co/Dwrj41N/Image.png
unknown
—
—
—
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
—
—
192.168.100.255:137
—
—
—
whitelisted
4712
MoUsoCoreWorker.exe
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
4652
svchost.exe
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
—
—
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
—
—
104.126.37.131:443
www.bing.com
Akamai International B.V.
DE
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
4652
svchost.exe
23.216.77.20:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
4652
svchost.exe
184.30.21.171:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
4712
MoUsoCoreWorker.exe
184.30.21.171:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
4712
MoUsoCoreWorker.exe
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 20.73.194.208
  • 4.231.128.59
whitelisted
www.bing.com
  • 104.126.37.131
  • 104.126.37.145
whitelisted
google.com
  • 142.250.185.78
whitelisted
crl.microsoft.com
  • 23.216.77.20
  • 23.216.77.42
unknown
www.microsoft.com
  • 184.30.21.171
whitelisted
ip-api.com
  • 208.95.112.1
unknown
i.ibb.co
  • 91.134.9.159
  • 91.134.82.79
  • 91.134.10.127
  • 91.134.10.168
  • 91.134.10.182
  • 91.134.9.160
unknown
medium-transcript.gl.at.ply.gg
  • 147.185.221.24
unknown
self.events.data.microsoft.com
  • 20.42.73.25
whitelisted

Threats

PID
Process
Class
Message
2192
svchost.exe
Device Retrieving External IP Address Detected
INFO [ANY.RUN] External IP Check (ip-api .com)
2192
svchost.exe
Device Retrieving External IP Address Detected
ET INFO External IP Lookup Domain in DNS Lookup (ip-api .com)
5640
uzivert-private.exe
Device Retrieving External IP Address Detected
ET POLICY External IP Lookup ip-api.com
5640
uzivert-private.exe
Device Retrieving External IP Address Detected
POLICY [ANY.RUN] External Hosting Lookup by ip-api
5640
uzivert-private.exe
Not Suspicious Traffic
INFO [ANY.RUN] Image hosting service ImgBB
5640
uzivert-private.exe
Possible Social Engineering Attempted
PHISHING [ANY.RUN] Domain chain identified as Phishing (ipibb)
2192
svchost.exe
Misc activity
ET INFO Tunneling Service in DNS Lookup (* .ply .gg)
5640
uzivert-private.exe
Misc Attack
ET TOR Known Tor Relay/Router (Not Exit) Node Traffic group 181
2192
svchost.exe
Potentially Bad Traffic
ET INFO playit .gg Tunneling Domain in DNS Lookup
5640
uzivert-private.exe
Malware Command and Control Activity Detected
REMOTE [ANY.RUN] Xworm TCP Initial Packet
38 ETPRO signatures available at the full report
Process
Message
uzivert-private.exe
Conversion from string "" to type 'Integer' is not valid.
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
Fortnite.exe