Windows Analysis Report
fortnite.exe

Overview

General Information

Sample name: fortnite.exe
Analysis ID: 1430587
MD5: cc6f6df38d0fea8b42fcd035e99f07dc
SHA1: 1dd58a9f514dee0d39cd552e8569083954b1f793
SHA256: 285764399eb12bb724439f11f6eeb5955eef858a2e3b59ee01cca12cda72e447
Tags: exe
Infos:

Detection

Score: 12
Range: 0 - 100
Whitelisted: false
Confidence: 40%

Signatures

Sigma detected: Suspicious Creation TXT File in User Desktop
Drops PE files
Found dropped PE file which has not been started or loaded
PE file contains executable resources (Code or Archives)
PE file contains sections with non-standard names
Sample execution stops while process was sleeping (likely an evasion)
Sample file is different than original file name gathered from version info
Stores files to the Windows start menu directory
Uses 32bit PE files

Classification

Uses 32bit PE files
Source: fortnite.exe Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, BYTES_REVERSED_LO, 32BIT_MACHINE, BYTES_REVERSED_HI
Source: C:\Users\user\AppData\Local\Temp\is-2NDQA.tmp\fortnite.tmp Registry value created: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{69A49BEC-FC90-4841-8F7E-E6EA7A9D452C}_is1 Jump to behavior
Source: fortnite.exe Static PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
Source: fortnite.exe, 00000000.00000003.1804231378.00000000023A1000.00000004.00001000.00020000.00000000.sdmp, fortnite.tmp, 00000001.00000003.1800269667.0000000002511000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://fortnitehack.download
Source: fortnite.exe, 00000000.00000003.1676398590.00000000025F0000.00000004.00001000.00020000.00000000.sdmp, fortnite.tmp, 00000001.00000003.1681366133.00000000034A0000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://fortnitehack.download:https://fortnitehack.download:https://fortnitehack.download
Source: fortnite.exe, 00000000.00000003.1804231378.00000000023A1000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://fortnitehack.downloadA
Source: fortnite.tmp, 00000001.00000003.1800269667.0000000002511000.00000004.00001000.00020000.00000000.sdmp String found in binary or memory: https://fortnitehack.downloadQ
Source: fortnite.exe String found in binary or memory: https://jrsoftware.org/ishelp/index.php?topic=setupcmdlineSetupU
Source: fortnite.exe, 00000000.00000003.1677991727.000000007FB50000.00000004.00001000.00020000.00000000.sdmp, fortnite.exe, 00000000.00000003.1677505171.00000000025F0000.00000004.00001000.00020000.00000000.sdmp, fortnite.tmp, 00000001.00000000.1679977354.0000000000401000.00000020.00000001.01000000.00000004.sdmp, is-PD2GU.tmp.1.dr, fortnite.tmp.0.dr String found in binary or memory: https://www.innosetup.com/
Source: fortnite.exe, 00000000.00000003.1677991727.000000007FB50000.00000004.00001000.00020000.00000000.sdmp, fortnite.exe, 00000000.00000003.1677505171.00000000025F0000.00000004.00001000.00020000.00000000.sdmp, fortnite.tmp, 00000001.00000000.1679977354.0000000000401000.00000020.00000001.01000000.00000004.sdmp, is-PD2GU.tmp.1.dr, fortnite.tmp.0.dr String found in binary or memory: https://www.remobjects.com/ps
PE file contains executable resources (Code or Archives)
Source: fortnite.tmp.0.dr Static PE information: Resource name: RT_RCDATA type: PE32+ executable (console) x86-64, for MS Windows
Source: is-PD2GU.tmp.1.dr Static PE information: Resource name: RT_RCDATA type: PE32+ executable (console) x86-64, for MS Windows
Sample file is different than original file name gathered from version info
Source: fortnite.exe, 00000000.00000003.1677991727.000000007FE36000.00000004.00001000.00020000.00000000.sdmp Binary or memory string: OriginalFileName vs fortnite.exe
Source: fortnite.exe, 00000000.00000003.1677505171.00000000026DA000.00000004.00001000.00020000.00000000.sdmp Binary or memory string: OriginalFileName vs fortnite.exe
Source: fortnite.exe, 00000000.00000000.1676088471.00000000004C6000.00000002.00000001.01000000.00000003.sdmp Binary or memory string: OriginalFileName vs fortnite.exe
Source: fortnite.exe, 00000000.00000003.1804231378.0000000002358000.00000004.00001000.00020000.00000000.sdmp Binary or memory string: OriginalFilenamekernel32j% vs fortnite.exe
Source: fortnite.exe Binary or memory string: OriginalFileName vs fortnite.exe
Uses 32bit PE files
Source: fortnite.exe Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, BYTES_REVERSED_LO, 32BIT_MACHINE, BYTES_REVERSED_HI
Source: classification engine Classification label: clean12.winEXE@6/1008@0/0
Source: C:\Users\user\AppData\Local\Temp\is-2NDQA.tmp\fortnite.tmp File created: C:\Users\user\AppData\Local\Programs Jump to behavior
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7544:120:WilError_03
Source: C:\Users\user\Desktop\fortnite.exe File created: C:\Users\user\AppData\Local\Temp\is-2NDQA.tmp Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-2NDQA.tmp\fortnite.tmp Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /C ""C:\Users\user\AppData\Local\Programs\Fortnite\Fortnite.bat""
Source: C:\Users\user\Desktop\fortnite.exe Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales Jump to behavior
Source: C:\Users\user\Desktop\fortnite.exe Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-2NDQA.tmp\fortnite.tmp Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-2NDQA.tmp\fortnite.tmp Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-2NDQA.tmp\fortnite.tmp File read: C:\Users\desktop.ini Jump to behavior
Source: C:\Users\user\Desktop\fortnite.exe Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-2NDQA.tmp\fortnite.tmp Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion RegisteredOrganization Jump to behavior
Source: fortnite.exe String found in binary or memory: /LOADINF="filename"
Source: C:\Users\user\Desktop\fortnite.exe File read: C:\Users\user\Desktop\fortnite.exe Jump to behavior
Source: unknown Process created: C:\Users\user\Desktop\fortnite.exe "C:\Users\user\Desktop\fortnite.exe"
Source: C:\Users\user\Desktop\fortnite.exe Process created: C:\Users\user\AppData\Local\Temp\is-2NDQA.tmp\fortnite.tmp "C:\Users\user\AppData\Local\Temp\is-2NDQA.tmp\fortnite.tmp" /SL5="$1046E,791896,791552,C:\Users\user\Desktop\fortnite.exe"
Source: C:\Users\user\AppData\Local\Temp\is-2NDQA.tmp\fortnite.tmp Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /C ""C:\Users\user\AppData\Local\Programs\Fortnite\Fortnite.bat""
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\fortnite.exe Process created: C:\Users\user\AppData\Local\Temp\is-2NDQA.tmp\fortnite.tmp "C:\Users\user\AppData\Local\Temp\is-2NDQA.tmp\fortnite.tmp" /SL5="$1046E,791896,791552,C:\Users\user\Desktop\fortnite.exe" Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-2NDQA.tmp\fortnite.tmp Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /C ""C:\Users\user\AppData\Local\Programs\Fortnite\Fortnite.bat"" Jump to behavior
Source: C:\Users\user\Desktop\fortnite.exe Section loaded: version.dll Jump to behavior
Source: C:\Users\user\Desktop\fortnite.exe Section loaded: netapi32.dll Jump to behavior
Source: C:\Users\user\Desktop\fortnite.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Users\user\Desktop\fortnite.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Users\user\Desktop\fortnite.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-2NDQA.tmp\fortnite.tmp Section loaded: mpr.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-2NDQA.tmp\fortnite.tmp Section loaded: version.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-2NDQA.tmp\fortnite.tmp Section loaded: netapi32.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-2NDQA.tmp\fortnite.tmp Section loaded: winhttp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-2NDQA.tmp\fortnite.tmp Section loaded: netutils.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-2NDQA.tmp\fortnite.tmp Section loaded: uxtheme.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-2NDQA.tmp\fortnite.tmp Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-2NDQA.tmp\fortnite.tmp Section loaded: wtsapi32.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-2NDQA.tmp\fortnite.tmp Section loaded: winsta.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-2NDQA.tmp\fortnite.tmp Section loaded: textinputframework.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-2NDQA.tmp\fortnite.tmp Section loaded: coreuicomponents.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-2NDQA.tmp\fortnite.tmp Section loaded: coremessaging.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-2NDQA.tmp\fortnite.tmp Section loaded: ntmarta.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-2NDQA.tmp\fortnite.tmp Section loaded: coremessaging.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-2NDQA.tmp\fortnite.tmp Section loaded: wintypes.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-2NDQA.tmp\fortnite.tmp Section loaded: wintypes.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-2NDQA.tmp\fortnite.tmp Section loaded: wintypes.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-2NDQA.tmp\fortnite.tmp Section loaded: windows.storage.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-2NDQA.tmp\fortnite.tmp Section loaded: wldp.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-2NDQA.tmp\fortnite.tmp Section loaded: profapi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-2NDQA.tmp\fortnite.tmp Section loaded: shfolder.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-2NDQA.tmp\fortnite.tmp Section loaded: rstrtmgr.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-2NDQA.tmp\fortnite.tmp Section loaded: ncrypt.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-2NDQA.tmp\fortnite.tmp Section loaded: ntasn1.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-2NDQA.tmp\fortnite.tmp Section loaded: textshaping.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-2NDQA.tmp\fortnite.tmp Section loaded: dwmapi.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-2NDQA.tmp\fortnite.tmp Section loaded: sspicli.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-2NDQA.tmp\fortnite.tmp Section loaded: explorerframe.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-2NDQA.tmp\fortnite.tmp Section loaded: sfc.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-2NDQA.tmp\fortnite.tmp Section loaded: sfc_os.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-2NDQA.tmp\fortnite.tmp Section loaded: propsys.dll Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe Section loaded: cmdext.dll Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-2NDQA.tmp\fortnite.tmp Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{00BB2765-6A77-11D0-A535-00C04FD7D062}\InProcServer32 Jump to behavior
Source: Fortnite.lnk.1.dr LNK file: ..\..\..\..\..\Local\Programs\Fortnite\FortniteHack.exe
Source: C:\Users\user\AppData\Local\Temp\is-2NDQA.tmp\fortnite.tmp Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion RegisteredOwner Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-2NDQA.tmp\fortnite.tmp Window found: window name: TMainForm Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-2NDQA.tmp\fortnite.tmp Automated click: Install
Source: C:\Users\user\AppData\Local\Temp\is-2NDQA.tmp\fortnite.tmp Automated click: Next
Source: C:\Users\user\AppData\Local\Temp\is-2NDQA.tmp\fortnite.tmp Automated click: Next
Source: C:\Users\user\AppData\Local\Temp\is-2NDQA.tmp\fortnite.tmp Automated click: Next
Source: Window Recorder Window detected: More than 3 window changes detected
Source: C:\Users\user\AppData\Local\Temp\is-2NDQA.tmp\fortnite.tmp Registry value created: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{69A49BEC-FC90-4841-8F7E-E6EA7A9D452C}_is1 Jump to behavior
Source: fortnite.exe Static file information: File size 1630505 > 1048576
Source: fortnite.exe Static PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
PE file contains sections with non-standard names
Source: fortnite.exe Static PE information: section name: .didata
Source: fortnite.tmp.0.dr Static PE information: section name: .didata
Source: is-PD2GU.tmp.1.dr Static PE information: section name: .didata
Drops PE files
Source: C:\Users\user\Desktop\fortnite.exe File created: C:\Users\user\AppData\Local\Temp\is-2NDQA.tmp\fortnite.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2NDQA.tmp\fortnite.tmp File created: C:\Users\user\AppData\Local\Programs\Fortnite\is-PD2GU.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2NDQA.tmp\fortnite.tmp File created: C:\Users\user\AppData\Local\Programs\Fortnite\unins000.exe (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2NDQA.tmp\fortnite.tmp File created: C:\Users\user\AppData\Local\Temp\is-IJRBJ.tmp\_isetup\_setup64.tmp Jump to dropped file
Stores files to the Windows start menu directory
Source: C:\Users\user\AppData\Local\Temp\is-2NDQA.tmp\fortnite.tmp File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Fortnite.lnk Jump to behavior
Source: C:\Users\user\Desktop\fortnite.exe Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-2NDQA.tmp\fortnite.tmp Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-2NDQA.tmp\fortnite.tmp Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-2NDQA.tmp\fortnite.tmp Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-2NDQA.tmp\fortnite.tmp Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-2NDQA.tmp\fortnite.tmp Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-2NDQA.tmp\fortnite.tmp Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-2NDQA.tmp\fortnite.tmp Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-2NDQA.tmp\fortnite.tmp Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-2NDQA.tmp\fortnite.tmp Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-2NDQA.tmp\fortnite.tmp Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-2NDQA.tmp\fortnite.tmp Process information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Found dropped PE file which has not been started or loaded
Source: C:\Users\user\AppData\Local\Temp\is-2NDQA.tmp\fortnite.tmp Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\Fortnite\is-PD2GU.tmp Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2NDQA.tmp\fortnite.tmp Dropped PE file which has not been started: C:\Users\user\AppData\Local\Programs\Fortnite\unins000.exe (copy) Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-2NDQA.tmp\fortnite.tmp Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\is-IJRBJ.tmp\_isetup\_setup64.tmp Jump to dropped file
Sample execution stops while process was sleeping (likely an evasion)
Source: C:\Windows\System32\conhost.exe Last function: Thread delayed
Source: fortnite.tmp, 00000001.00000003.1801817718.00000000008D9000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\
Source: fortnite.tmp, 00000001.00000003.1801817718.00000000008D9000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}Sx
windows-stand
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 signatures2 2 Behavior Graph ID: 1430587 Sample: fortnite.exe Startdate: 23/04/2024 Architecture: WINDOWS Score: 12 29 Sigma detected: Suspicious Creation TXT File in User Desktop 2->29 8 fortnite.exe 2 2->8         started        process3 file4 19 C:\Users\user\AppData\Local\...\fortnite.tmp, PE32 8->19 dropped 11 fortnite.tmp 25 18 8->11         started        process5 file6 21 C:\Users\user\AppData\Local\...\_setup64.tmp, PE32+ 11->21 dropped 23 C:\Users\user\AppData\...\unins000.exe (copy), PE32 11->23 dropped 25 C:\Users\user\AppData\Local\...\is-PD2GU.tmp, PE32 11->25 dropped 14 cmd.exe 1001 11->14         started        process7 file8 27 C:\Users\user\Desktop\LOL1.txt, ASCII 14->27 dropped 17 conhost.exe 14->17         started        process9
⊘No contacted IP infos