| download: | Fortnite_Checker.zip |
| Full analysis: | https://app.any.run/tasks/ca443ec2-d569-4bfe-8e29-09e1d057ef1e |
| Verdict: | Malicious activity |
| Threats: | Crypto mining malware is a resource-intensive threat that infiltrates computers with the purpose of mining cryptocurrencies. This type of threat can be deployed either on an infected machine or a compromised website. In both cases the miner will utilize the computing power of the device and its network bandwidth. |
| Analysis date: | August 13, 2019, 23:30:13 |
| OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
| Tags: | |
| Indicators: | |
| MIME: | application/zip |
| File info: | Zip archive data, at least v1.0 to extract |
| MD5: | C652596102C559FBF82AE80300BCA92C |
| SHA1: | 32CD9F2DEBF6C939B73A76C4957DCD714DC10B69 |
| SHA256: | 8911756307C903F12774A4D2B70C1A8BD2549985BDDF8981516366BC14CE0FC3 |
| SSDEEP: | 49152:SBx9ngCf3K4JlW/2cnjtbmzC58t0asyBttVhXcQavb8wLh:Sx9nDfK4COcnjU258QyBtFcFvbjN |
MALICIOUS
Application was injected by another process
- explorer.exe (PID: 128)
Writes to a start menu file
- wscript.exe (PID: 2540)
Application was dropped or rewritten from another process
- vbc.exe (PID: 252)
Connects to CnC server
- wuapp.exe (PID: 2572)
Runs injected code in another process
- vbc.exe (PID: 252)
MINER was detected
- wuapp.exe (PID: 2572)
SUSPICIOUS
Creates files in the program directory
- vbc.exe (PID: 252)
Executes scripts
- Fortnite_Checker.exe (PID: 3164)
- cmd.exe (PID: 2840)
Starts CMD.EXE for commands execution
- vbc.exe (PID: 252)
Executable content was dropped or overwritten
- vbc.exe (PID: 252)
Creates files in the user directory
- wscript.exe (PID: 2540)
INFO
Manual execution by user
- Fortnite_Checker.exe (PID: 3164)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
TRiD
| .zip | | | ZIP compressed archive (100) |
|---|
EXIF
ZIP
| ZipRequiredVersion: | 10 |
|---|---|
| ZipBitFlag: | - |
| ZipCompression: | None |
| ZipModifyDate: | 2019:05:16 13:49:09 |
| ZipCRC: | 0x00000000 |
| ZipCompressedSize: | - |
| ZipUncompressedSize: | - |
| ZipFileName: | Fortnite_Checker/ |
Total processes
41
Monitored processes
7
Malicious processes
4
Suspicious processes
0
Behavior graph
Click at the process to see the details
Process information
PID | CMD | Path | Indicators | Parent process | |||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 128 | C:\Windows\Explorer.EXE | C:\Windows\explorer.exe | — | ||||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows Explorer Exit code: 0 Version: 6.1.7600.16385 (win7_rtm.090713-1255) Modules
| |||||||||||||||
| 252 | "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" | C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe | Fortnite_Checker.exe | ||||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Visual Basic Command Line Compiler Exit code: 0 Version: 8.0.50727.5420 Modules
| |||||||||||||||
| 2540 | WScript "C:\ProgramData\LUGATnburW\r.vbs" | C:\Windows\system32\wscript.exe | cmd.exe | ||||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Microsoft ® Windows Based Script Host Exit code: 0 Version: 5.8.7600.16385 Modules
| |||||||||||||||
| 2572 | "C:\Windows\System32\wuapp.exe" -c "C:\ProgramData\LUGATnburW\cfg" | C:\Windows\System32\wuapp.exe | vbc.exe | ||||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows Update Application Launcher Exit code: 0 Version: 7.5.7601.17514 (win7sp1_rtm.101119-1850) Modules
| |||||||||||||||
| 2840 | cmd.exe /C WScript "C:\ProgramData\LUGATnburW\r.vbs" | C:\Windows\system32\cmd.exe | — | vbc.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows Command Processor Exit code: 0 Version: 6.1.7601.17514 (win7sp1_rtm.101119-1850) Modules
| |||||||||||||||
| 3164 | "C:\Users\admin\Desktop\Fortnite_Checker\Fortnite_Checker.exe" | C:\Users\admin\Desktop\Fortnite_Checker\Fortnite_Checker.exe | — | explorer.exe | |||||||||||
User: admin Company: Coilz Integrity Level: MEDIUM Description: SoundCloud Api Library Exit code: 0 Version: 1.1.0.0 Modules
| |||||||||||||||
| 3268 | "C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Local\Temp\Fortnite_Checker.zip" | C:\Program Files\WinRAR\WinRAR.exe | — | explorer.exe | |||||||||||
User: admin Company: Alexander Roshal Integrity Level: MEDIUM Description: WinRAR archiver Exit code: 0 Version: 5.60.0 Modules
| |||||||||||||||
Total events
2 318
Read events
2 264
Write events
54
Delete events
0
Modification events
| (PID) Process: | (3268) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes |
| Operation: | write | Name: | ShellExtBMP |
Value: | |||
| (PID) Process: | (3268) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes |
| Operation: | write | Name: | ShellExtIcon |
Value: | |||
| (PID) Process: | (3268) WinRAR.exe | Key: | HKEY_CLASSES_ROOT\Local Settings\MuiCache\72\52C64B7E |
| Operation: | write | Name: | LanguageList |
Value: en-US | |||
| (PID) Process: | (3268) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\ArcHistory |
| Operation: | write | Name: | 0 |
Value: C:\Users\admin\AppData\Local\Temp\Fortnite_Checker.zip | |||
| (PID) Process: | (3268) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths |
| Operation: | write | Name: | name |
Value: 120 | |||
| (PID) Process: | (3268) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths |
| Operation: | write | Name: | size |
Value: 80 | |||
| (PID) Process: | (3268) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths |
| Operation: | write | Name: | type |
Value: 120 | |||
| (PID) Process: | (3268) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths |
| Operation: | write | Name: | mtime |
Value: 100 | |||
| (PID) Process: | (128) explorer.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.zip\OpenWithList |
| Operation: | write | Name: | a |
Value: WinRAR.exe | |||
| (PID) Process: | (128) explorer.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.zip\OpenWithList |
| Operation: | write | Name: | MRUList |
Value: a | |||
Executable files
1
Suspicious files
1
Text files
3
Unknown types
0
Dropped files
PID | Process | Filename | Type | |
|---|---|---|---|---|
| 3268 | WinRAR.exe | C:\Users\admin\AppData\Local\Temp\Rar$DRa3268.8255\Fortnite_Checker\Fortnite_Checker.exe | — | |
MD5:— | SHA256:— | |||
| 3268 | WinRAR.exe | C:\Users\admin\AppData\Local\Temp\Rar$DRa3268.8255\Fortnite_Checker\MetroFramework.Design.dll | — | |
MD5:— | SHA256:— | |||
| 3268 | WinRAR.exe | C:\Users\admin\AppData\Local\Temp\Rar$DRa3268.8255\Fortnite_Checker\MetroFramework.dll | — | |
MD5:— | SHA256:— | |||
| 3268 | WinRAR.exe | C:\Users\admin\AppData\Local\Temp\Rar$DRa3268.8255\Fortnite_Checker\MetroFramework.Fonts.dll | — | |
MD5:— | SHA256:— | |||
| 128 | explorer.exe | C:\Users\admin\Desktop\Fortnite_Checker | — | |
MD5:— | SHA256:— | |||
| 252 | vbc.exe | C:\ProgramData\LUGATnburW\SXMR.exe | — | |
MD5:— | SHA256:— | |||
| 252 | vbc.exe | C:\ProgramData\LUGATnburW\cfgi | text | |
MD5:— | SHA256:— | |||
| 252 | vbc.exe | C:\ProgramData\LUGATnburW\r.vbs | binary | |
MD5:— | SHA256:— | |||
| 252 | vbc.exe | C:\ProgramData\LUGATnburW\SXMR | executable | |
MD5:— | SHA256:— | |||
| 2540 | wscript.exe | C:\Users\admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cIQcavYWZA.url | text | |
MD5:— | SHA256:— | |||
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
1
DNS requests
1
Threats
9
HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
Connections
PID | Process | IP | Domain | ASN | CN | Reputation |
|---|---|---|---|---|---|---|
— | — | 136.243.102.167:45700 | xmr.pool.minergate.com | Hetzner Online GmbH | DE | malicious |
DNS requests
Domain | IP | Reputation |
|---|---|---|
xmr.pool.minergate.com |
| suspicious |
Threats
PID | Process | Class | Message |
|---|---|---|---|
1064 | svchost.exe | A Network Trojan was detected | ET POLICY Monero Mining Pool DNS Lookup |
2572 | wuapp.exe | Potential Corporate Privacy Violation | ET POLICY Cryptocurrency Miner Checkin |
2572 | wuapp.exe | Misc activity | MINER [PTsecurity] CoinMiner CryptoNight XMRig JSON_RPC Client Login |
2572 | wuapp.exe | Misc activity | MINER [PTsecurity] Riskware/CoinMiner JSON_RPC Response |
2572 | wuapp.exe | Misc activity | MINER [PTsecurity] Risktool.W32.coinminer!c |
2572 | wuapp.exe | Misc activity | MINER [PTsecurity] CoinMiner CryptoNight algo JSON_RPC server Response |
2572 | wuapp.exe | Misc activity | MINER [PTsecurity] Riskware/CoinMiner JSON_RPC Response |
2572 | wuapp.exe | Misc activity | MINER [PTsecurity] Risktool.W32.coinminer!c |
2572 | wuapp.exe | Misc activity | MINER [PTsecurity] CoinMiner CryptoNight algo JSON_RPC server Response |