| download: | Fortnite_Account_Gen_V3.rar |
| Full analysis: | https://app.any.run/tasks/6e9e8c89-8ffd-47fb-b8b2-7078bfc6ae27 |
| Verdict: | Malicious activity |
| Threats: | NanoCore is a Remote Access Trojan or RAT. This malware is highly customizable with plugins which allow attackers to tailor its functionality to their needs. Nanocore is created with the .NET framework and it’s available for purchase for just $25 from its “official” website. |
| Analysis date: | January 14, 2022, 22:27:34 |
| OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
| Tags: | |
| Indicators: | |
| MIME: | application/x-rar |
| File info: | RAR archive data, v5 |
| MD5: | CD654A8D405C26586AD1AA3981112BF0 |
| SHA1: | C0545420C4626A6C9152D243013CC6B11308CE16 |
| SHA256: | 53FDF119354A8C15C09E15E4640DC6DAEAF95863F0845B591D97AA5CCEB43D8B |
| SSDEEP: | 12288:tJ68tSfyqHejasrJnWKV36FiS3Akg6gn/3/mvcni5PdjCnYaqANMfWv:JY9rWWKpS/ASU/ue0ANf |
MALICIOUS
Application was dropped or rewritten from another process
- Fortnite Account Gen V3.exe (PID: 2992)
- Fortnite Account Gen V3.exe (PID: 2072)
- Fortnite Account Gen V3.exe (PID: 2920)
- Fortnite Account Gen V3.exe (PID: 3556)
Uses Task Scheduler to run other applications
- Fortnite Account Gen V3.exe (PID: 2992)
NANOCORE was detected
- Fortnite Account Gen V3.exe (PID: 3556)
Connects to CnC server
- Fortnite Account Gen V3.exe (PID: 3556)
Loads the Task Scheduler COM API
- schtasks.exe (PID: 3324)
SUSPICIOUS
Reads the computer name
- WinRAR.exe (PID: 1408)
- Fortnite Account Gen V3.exe (PID: 2992)
- Fortnite Account Gen V3.exe (PID: 3556)
Drops a file with a compile date too recent
- WinRAR.exe (PID: 1408)
- Fortnite Account Gen V3.exe (PID: 2992)
Checks supported languages
- WinRAR.exe (PID: 1408)
- Fortnite Account Gen V3.exe (PID: 2992)
- Fortnite Account Gen V3.exe (PID: 3556)
Drops a file that was compiled in debug mode
- WinRAR.exe (PID: 1408)
Executable content was dropped or overwritten
- WinRAR.exe (PID: 1408)
- Fortnite Account Gen V3.exe (PID: 2992)
Modifies files in Chrome extension folder
- chrome.exe (PID: 956)
Creates files in the user directory
- Fortnite Account Gen V3.exe (PID: 2992)
- Fortnite Account Gen V3.exe (PID: 3556)
Application launched itself
- Fortnite Account Gen V3.exe (PID: 2992)
INFO
Checks supported languages
- chrome.exe (PID: 956)
- chrome.exe (PID: 1888)
- chrome.exe (PID: 4036)
- chrome.exe (PID: 2228)
- chrome.exe (PID: 2912)
- chrome.exe (PID: 2072)
- chrome.exe (PID: 2248)
- chrome.exe (PID: 3972)
- chrome.exe (PID: 736)
- chrome.exe (PID: 2332)
- chrome.exe (PID: 3144)
- chrome.exe (PID: 2180)
- chrome.exe (PID: 3468)
- chrome.exe (PID: 2752)
- chrome.exe (PID: 3628)
- chrome.exe (PID: 3064)
- chrome.exe (PID: 3112)
- chrome.exe (PID: 2916)
- chrome.exe (PID: 3788)
- schtasks.exe (PID: 3324)
Manual execution by user
- chrome.exe (PID: 956)
Reads the computer name
- chrome.exe (PID: 956)
- chrome.exe (PID: 1888)
- chrome.exe (PID: 2912)
- chrome.exe (PID: 3972)
- chrome.exe (PID: 3144)
- schtasks.exe (PID: 3324)
Application launched itself
- chrome.exe (PID: 956)
Reads the hosts file
- chrome.exe (PID: 956)
- chrome.exe (PID: 1888)
Reads settings of System Certificates
- chrome.exe (PID: 1888)
Dropped object may contain Bitcoin addresses
- chrome.exe (PID: 956)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
TRiD
| .rar | | | RAR compressed archive (v5.0) (61.5) |
|---|---|---|
| .rar | | | RAR compressed archive (gen) (38.4) |
Total processes
60
Monitored processes
25
Malicious processes
2
Suspicious processes
1
Behavior graph
Click at the process to see the details
Process information
PID | CMD | Path | Indicators | Parent process | |||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 736 | "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1036,6012030725972146145,3809830161717053703,131072 --enable-features=PasswordImport --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2968 /prefetch:8 | C:\Program Files\Google\Chrome\Application\chrome.exe | — | chrome.exe | |||||||||||
User: admin Company: Google LLC Integrity Level: LOW Description: Google Chrome Exit code: 0 Version: 86.0.4240.198 Modules
| |||||||||||||||
| 956 | "C:\Program Files\Google\Chrome\Application\chrome.exe" | C:\Program Files\Google\Chrome\Application\chrome.exe | Explorer.EXE | ||||||||||||
User: admin Company: Google LLC Integrity Level: MEDIUM Description: Google Chrome Exit code: 3221225547 Version: 86.0.4240.198 Modules
| |||||||||||||||
| 1408 | "C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Local\Temp\Fortnite_Account_Gen_V3.rar" | C:\Program Files\WinRAR\WinRAR.exe | Explorer.EXE | ||||||||||||
User: admin Company: Alexander Roshal Integrity Level: MEDIUM Description: WinRAR archiver Exit code: 0 Version: 5.91.0 Modules
| |||||||||||||||
| 1888 | "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1036,6012030725972146145,3809830161717053703,131072 --enable-features=PasswordImport --lang=en-US --service-sandbox-type=network --mojo-platform-channel-handle=1312 /prefetch:8 | C:\Program Files\Google\Chrome\Application\chrome.exe | chrome.exe | ||||||||||||
User: admin Company: Google LLC Integrity Level: MEDIUM Description: Google Chrome Exit code: 0 Version: 86.0.4240.198 Modules
| |||||||||||||||
| 2072 | "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1036,6012030725972146145,3809830161717053703,131072 --enable-features=PasswordImport --lang=en-US --instant-process --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1952 /prefetch:1 | C:\Program Files\Google\Chrome\Application\chrome.exe | — | chrome.exe | |||||||||||
User: admin Company: Google LLC Integrity Level: LOW Description: Google Chrome Exit code: 0 Version: 86.0.4240.198 Modules
| |||||||||||||||
| 2072 | "{path}" | C:\Users\admin\AppData\Local\Temp\Rar$EXa1408.41779\Fortnite Account Gen V3\Fortnite Account Gen V3.exe | — | Fortnite Account Gen V3.exe | |||||||||||
User: admin Company: Kee IT Integrity Level: MEDIUM Description: Leaky_Boat Exit code: 4294967295 Version: 1.0.0.0 Modules
| |||||||||||||||
| 2180 | "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1036,6012030725972146145,3809830161717053703,131072 --enable-features=PasswordImport --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3492 /prefetch:8 | C:\Program Files\Google\Chrome\Application\chrome.exe | — | chrome.exe | |||||||||||
User: admin Company: Google LLC Integrity Level: LOW Description: Google Chrome Exit code: 0 Version: 86.0.4240.198 Modules
| |||||||||||||||
| 2228 | "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1036,6012030725972146145,3809830161717053703,131072 --enable-features=PasswordImport --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=4 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2284 /prefetch:1 | C:\Program Files\Google\Chrome\Application\chrome.exe | — | chrome.exe | |||||||||||
User: admin Company: Google LLC Integrity Level: LOW Description: Google Chrome Exit code: 0 Version: 86.0.4240.198 Modules
| |||||||||||||||
| 2248 | "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1036,6012030725972146145,3809830161717053703,131072 --enable-features=PasswordImport --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1884 /prefetch:1 | C:\Program Files\Google\Chrome\Application\chrome.exe | — | chrome.exe | |||||||||||
User: admin Company: Google LLC Integrity Level: LOW Description: Google Chrome Exit code: 0 Version: 86.0.4240.198 Modules
| |||||||||||||||
| 2332 | "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1036,6012030725972146145,3809830161717053703,131072 --enable-features=PasswordImport --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2856 /prefetch:8 | C:\Program Files\Google\Chrome\Application\chrome.exe | — | chrome.exe | |||||||||||
User: admin Company: Google LLC Integrity Level: LOW Description: Google Chrome Exit code: 0 Version: 86.0.4240.198 Modules
| |||||||||||||||
Total events
6 906
Read events
6 816
Write events
89
Delete events
1
Modification events
| (PID) Process: | (1408) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes |
| Operation: | write | Name: | ShellExtBMP |
Value: | |||
| (PID) Process: | (1408) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes |
| Operation: | write | Name: | ShellExtIcon |
Value: | |||
| (PID) Process: | (1408) WinRAR.exe | Key: | HKEY_CLASSES_ROOT\Local Settings\MuiCache\16C\52C64B7E |
| Operation: | write | Name: | LanguageList |
Value: en-US | |||
| (PID) Process: | (1408) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\ArcHistory |
| Operation: | write | Name: | 2 |
Value: C:\Users\admin\Desktop\virtio_ivshmem_master_build.zip | |||
| (PID) Process: | (1408) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\ArcHistory |
| Operation: | write | Name: | 1 |
Value: C:\Users\admin\Desktop\Win7-KB3191566-x86.zip | |||
| (PID) Process: | (1408) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\ArcHistory |
| Operation: | write | Name: | 0 |
Value: C:\Users\admin\AppData\Local\Temp\Fortnite_Account_Gen_V3.rar | |||
| (PID) Process: | (1408) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths |
| Operation: | write | Name: | name |
Value: 120 | |||
| (PID) Process: | (1408) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths |
| Operation: | write | Name: | size |
Value: 80 | |||
| (PID) Process: | (1408) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths |
| Operation: | write | Name: | type |
Value: 120 | |||
| (PID) Process: | (1408) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths |
| Operation: | write | Name: | mtime |
Value: 100 | |||
Executable files
5
Suspicious files
126
Text files
111
Unknown types
12
Dropped files
PID | Process | Filename | Type | |
|---|---|---|---|---|
| 956 | chrome.exe | C:\Users\admin\AppData\Local\Google\Chrome\User Data\BrowserMetrics\BrowserMetrics-61E1F8E6-3BC.pma | — | |
MD5:— | SHA256:— | |||
| 1408 | WinRAR.exe | C:\Users\admin\AppData\Local\Temp\Rar$EXa1408.41779\Fortnite Account Gen V3\Fortnite Account Gen V3.exe | executable | |
MD5:— | SHA256:— | |||
| 956 | chrome.exe | C:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\dd937b06-958b-427f-8a28-698ad4351f15.tmp | text | |
MD5:— | SHA256:— | |||
| 1408 | WinRAR.exe | C:\Users\admin\AppData\Local\Temp\Rar$EXa1408.41779\Fortnite Account Gen V3\Accounts.dll | executable | |
MD5:5ECA94D909F1BA4C5F3E35AC65A49076 | SHA256:DE0E530D46C803D85B8AEB6D18816F1B09CB3DAFEFB5E19FDFA15C9F41E0F474 | |||
| 1408 | WinRAR.exe | C:\Users\admin\AppData\Local\Temp\Rar$EXa1408.41779\Fortnite Account Gen V3\settings.xml | text | |
MD5:8AF01757CC429D1347430084913566D1 | SHA256:F1A33CD5B1C9368F73B8FF144BED026664577317DF27BAFF774B2BD2ACBD52EF | |||
| 956 | chrome.exe | C:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Local Storage\leveldb\LOG.old | text | |
MD5:7721CDA9F5B73CE8A135471EB53B4E0E | SHA256:DD730C576766A46FFC84E682123248ECE1FF1887EC0ACAB22A5CE93A450F4500 | |||
| 1408 | WinRAR.exe | C:\Users\admin\AppData\Local\Temp\Rar$EXa1408.41779\Fortnite Account Gen V3\GenSettings.dll | executable | |
MD5:8DF4D6B5DC1629FCEFCDC20210A88EAC | SHA256:3E4288B32006FE8499B43A7F605BB7337931847A0AA79A33217A1D6D1A6C397E | |||
| 4036 | chrome.exe | C:\Users\admin\AppData\Local\Google\Chrome\User Data\CrashpadMetrics.pma | binary | |
MD5:03C4F648043A88675A920425D824E1B3 | SHA256:F91DBB7C64B4582F529C968C480D2DCE1C8727390482F31E4355A27BB3D9B450 | |||
| 956 | chrome.exe | C:\Users\admin\AppData\Local\Google\Chrome\User Data\Last Version | text | |
MD5:00046F773EFDD3C8F8F6D0F87A2B93DC | SHA256:593EDE11D17AF7F016828068BCA2E93CF240417563FB06DC8A579110AEF81731 | |||
| 956 | chrome.exe | C:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Sync Data\LevelDB\LOG.old | text | |
MD5:5BD3C311F2136A7A88D3E197E55CF902 | SHA256:FA331915E1797E59979A3E4BCC2BD0D3DEAA039B94D4DB992BE251FD02A224B9 | |||
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
3
TCP/UDP connections
22
DNS requests
16
Threats
32
HTTP requests
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
|---|---|---|---|---|---|---|---|---|---|
1888 | chrome.exe | GET | 403 | 104.23.132.78:80 | http://hackforums.net/ | US | html | 20.7 Kb | malicious |
1888 | chrome.exe | GET | 403 | 104.23.132.78:80 | http://hackforums.net/favicon.ico | US | html | 20.7 Kb | malicious |
1888 | chrome.exe | GET | 200 | 34.104.35.123:80 | http://edgedl.me.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvNzI0QUFXNV9zT2RvdUwyMERESEZGVmJnQQ/1.0.0.6_nmmhkkegccagdldgiimedpiccmgmieda.crx | US | crx | 242 Kb | whitelisted |
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
Connections
PID | Process | IP | Domain | ASN | CN | Reputation |
|---|---|---|---|---|---|---|
1888 | chrome.exe | 142.250.186.132:443 | www.google.com | Google Inc. | US | whitelisted |
1888 | chrome.exe | 142.250.185.174:443 | clients2.google.com | Google Inc. | US | whitelisted |
1888 | chrome.exe | 142.250.185.77:443 | accounts.google.com | Google Inc. | US | suspicious |
1888 | chrome.exe | 142.250.185.74:443 | fonts.googleapis.com | Google Inc. | US | whitelisted |
1888 | chrome.exe | 142.250.186.163:443 | fonts.gstatic.com | Google Inc. | US | whitelisted |
1888 | chrome.exe | 142.250.185.227:443 | www.gstatic.com | Google Inc. | US | whitelisted |
1888 | chrome.exe | 142.250.186.174:443 | apis.google.com | Google Inc. | US | whitelisted |
1888 | chrome.exe | 104.23.132.78:80 | hackforums.net | Cloudflare Inc | US | unknown |
1888 | chrome.exe | 34.104.35.123:80 | edgedl.me.gvt1.com | — | US | whitelisted |
3556 | Fortnite Account Gen V3.exe | 107.182.237.15:61529 | — | Hosting Services, Inc. | US | malicious |
DNS requests
Domain | IP | Reputation |
|---|---|---|
www.google.com |
| malicious |
clients2.google.com |
| whitelisted |
accounts.google.com |
| shared |
fonts.googleapis.com |
| whitelisted |
www.gstatic.com |
| whitelisted |
fonts.gstatic.com |
| whitelisted |
apis.google.com |
| whitelisted |
clientservices.googleapis.com |
| whitelisted |
encrypted-tbn0.gstatic.com |
| whitelisted |
ssl.gstatic.com |
| whitelisted |
Threats
PID | Process | Class | Message |
|---|---|---|---|
3556 | Fortnite Account Gen V3.exe | A Network Trojan was detected | ET TROJAN Possible NanoCore C2 60B |
31 ETPRO signatures available at the full report