Overview
overview
8Static
static
Spoofer_Va...es.url
windows7-x64
1Spoofer_Va...es.url
windows10-2004-x64
1Spoofer_Va...ck.bat
windows7-x64
1Spoofer_Va...ck.bat
windows10-2004-x64
1Spoofer_Va...er.exe
windows7-x64
1Spoofer_Va...er.exe
windows10-2004-x64
1Spoofer_Va.../s.exe
windows7-x64
Spoofer_Va.../s.exe
windows10-2004-x64
Spoofer_Va...of.bat
windows7-x64
8Spoofer_Va...of.bat
windows10-2004-x64
8Analysis
-
max time kernel
91s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
28-09-2022 20:44
Static task
static1
Behavioral task
behavioral1
Sample
Spoofer_Valorant_CHEATER.FUN_/Free Hacks for Games.url
Resource
win7-20220812-en
windows7-x64
Behavioral task
behavioral2
Sample
Spoofer_Valorant_CHEATER.FUN_/Free Hacks for Games.url
Resource
win10v2004-20220812-en
windows10-2004-x64
Behavioral task
behavioral3
Sample
Spoofer_Valorant_CHEATER.FUN_/_Serial_check.bat
Resource
win7-20220901-en
windows7-x64
Behavioral task
behavioral4
Sample
Spoofer_Valorant_CHEATER.FUN_/_Serial_check.bat
Resource
win10v2004-20220812-en
windows10-2004-x64
Behavioral task
behavioral5
Sample
Spoofer_Valorant_CHEATER.FUN_/kdmapper.exe
Resource
win7-20220812-en
windows7-x64
Behavioral task
behavioral6
Sample
Spoofer_Valorant_CHEATER.FUN_/kdmapper.exe
Resource
win10v2004-20220812-en
windows10-2004-x64
Behavioral task
behavioral7
Sample
Spoofer_Valorant_CHEATER.FUN_/s.exe
Resource
win7-20220901-en
windows7-x64
Behavioral task
behavioral8
Sample
Spoofer_Valorant_CHEATER.FUN_/s.exe
Resource
win10v2004-20220812-en
windows10-2004-x64
Behavioral task
behavioral9
Sample
Spoofer_Valorant_CHEATER.FUN_/spoof.bat
Resource
win7-20220812-en
windows7-x64
Behavioral task
behavioral10
Sample
Spoofer_Valorant_CHEATER.FUN_/spoof.bat
Resource
win10v2004-20220812-en
windows10-2004-x64
General
-
Target
Spoofer_Valorant_CHEATER.FUN_/spoof.bat
-
Size
403B
-
MD5
38b51184c9cd21a76ae49435485051c1
-
SHA1
2a35f39dc6620b84b88132100715d5e7e3c19fb5
-
SHA256
16e7770ef24530977e9717229940770fd3f8b9934ab09ccd6bbc1f61100caa4e
-
SHA512
138390fd4568a0097ab004b4851bb5cf391d00f94f162af75937ca6ea68e93f21e178f6190d5d2dfa9a6bf6f15480c8361545db8295cdf9714fb5e8a0c97b2fb
Malware Config
Signatures
-
Sets service image path in registry 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\RqcXIfVMyGphGB\ImagePath = "\\??\\C:\\Users\\Admin\\AppData\\Local\\Temp\\RqcXIfVMyGphGB" kdmapper.exe -
Suspicious behavior: LoadsDriver 1 IoCs
pid Process 4020 kdmapper.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeLoadDriverPrivilege 4020 kdmapper.exe Token: SeIncreaseQuotaPrivilege 4300 WMIC.exe Token: SeSecurityPrivilege 4300 WMIC.exe Token: SeTakeOwnershipPrivilege 4300 WMIC.exe Token: SeLoadDriverPrivilege 4300 WMIC.exe Token: SeSystemProfilePrivilege 4300 WMIC.exe Token: SeSystemtimePrivilege 4300 WMIC.exe Token: SeProfSingleProcessPrivilege 4300 WMIC.exe Token: SeIncBasePriorityPrivilege 4300 WMIC.exe Token: SeCreatePagefilePrivilege 4300 WMIC.exe Token: SeBackupPrivilege 4300 WMIC.exe Token: SeRestorePrivilege 4300 WMIC.exe Token: SeShutdownPrivilege 4300 WMIC.exe Token: SeDebugPrivilege 4300 WMIC.exe Token: SeSystemEnvironmentPrivilege 4300 WMIC.exe Token: SeRemoteShutdownPrivilege 4300 WMIC.exe Token: SeUndockPrivilege 4300 WMIC.exe Token: SeManageVolumePrivilege 4300 WMIC.exe Token: 33 4300 WMIC.exe Token: 34 4300 WMIC.exe Token: 35 4300 WMIC.exe Token: 36 4300 WMIC.exe Token: SeIncreaseQuotaPrivilege 4300 WMIC.exe Token: SeSecurityPrivilege 4300 WMIC.exe Token: SeTakeOwnershipPrivilege 4300 WMIC.exe Token: SeLoadDriverPrivilege 4300 WMIC.exe Token: SeSystemProfilePrivilege 4300 WMIC.exe Token: SeSystemtimePrivilege 4300 WMIC.exe Token: SeProfSingleProcessPrivilege 4300 WMIC.exe Token: SeIncBasePriorityPrivilege 4300 WMIC.exe Token: SeCreatePagefilePrivilege 4300 WMIC.exe Token: SeBackupPrivilege 4300 WMIC.exe Token: SeRestorePrivilege 4300 WMIC.exe Token: SeShutdownPrivilege 4300 WMIC.exe Token: SeDebugPrivilege 4300 WMIC.exe Token: SeSystemEnvironmentPrivilege 4300 WMIC.exe Token: SeRemoteShutdownPrivilege 4300 WMIC.exe Token: SeUndockPrivilege 4300 WMIC.exe Token: SeManageVolumePrivilege 4300 WMIC.exe Token: 33 4300 WMIC.exe Token: 34 4300 WMIC.exe Token: 35 4300 WMIC.exe Token: 36 4300 WMIC.exe Token: SeIncreaseQuotaPrivilege 3264 WMIC.exe Token: SeSecurityPrivilege 3264 WMIC.exe Token: SeTakeOwnershipPrivilege 3264 WMIC.exe Token: SeLoadDriverPrivilege 3264 WMIC.exe Token: SeSystemProfilePrivilege 3264 WMIC.exe Token: SeSystemtimePrivilege 3264 WMIC.exe Token: SeProfSingleProcessPrivilege 3264 WMIC.exe Token: SeIncBasePriorityPrivilege 3264 WMIC.exe Token: SeCreatePagefilePrivilege 3264 WMIC.exe Token: SeBackupPrivilege 3264 WMIC.exe Token: SeRestorePrivilege 3264 WMIC.exe Token: SeShutdownPrivilege 3264 WMIC.exe Token: SeDebugPrivilege 3264 WMIC.exe Token: SeSystemEnvironmentPrivilege 3264 WMIC.exe Token: SeRemoteShutdownPrivilege 3264 WMIC.exe Token: SeUndockPrivilege 3264 WMIC.exe Token: SeManageVolumePrivilege 3264 WMIC.exe Token: 33 3264 WMIC.exe Token: 34 3264 WMIC.exe Token: 35 3264 WMIC.exe Token: 36 3264 WMIC.exe -
Suspicious use of WriteProcessMemory 14 IoCs
description pid Process procid_target PID 976 wrote to memory of 4020 976 cmd.exe 80 PID 976 wrote to memory of 4020 976 cmd.exe 80 PID 976 wrote to memory of 4300 976 cmd.exe 81 PID 976 wrote to memory of 4300 976 cmd.exe 81 PID 976 wrote to memory of 3264 976 cmd.exe 83 PID 976 wrote to memory of 3264 976 cmd.exe 83 PID 976 wrote to memory of 2068 976 cmd.exe 84 PID 976 wrote to memory of 2068 976 cmd.exe 84 PID 976 wrote to memory of 3384 976 cmd.exe 85 PID 976 wrote to memory of 3384 976 cmd.exe 85 PID 976 wrote to memory of 308 976 cmd.exe 87 PID 976 wrote to memory of 308 976 cmd.exe 87 PID 976 wrote to memory of 4972 976 cmd.exe 88 PID 976 wrote to memory of 4972 976 cmd.exe 88
Processes
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\Spoofer_Valorant_CHEATER.FUN_\spoof.bat"1⤵
- Suspicious use of WriteProcessMemory
PID:976 -
C:\Users\Admin\AppData\Local\Temp\Spoofer_Valorant_CHEATER.FUN_\kdmapper.exekdmapper.exe s.sys2⤵
- Sets service image path in registry
- Suspicious behavior: LoadsDriver
- Suspicious use of AdjustPrivilegeToken
PID:4020
-
-
C:\Windows\System32\Wbem\WMIC.exewmic memorychip get serialnumber2⤵
- Suspicious use of AdjustPrivilegeToken
PID:4300
-
-
C:\Windows\System32\Wbem\WMIC.exewmic diskdrive get serialnumber2⤵
- Suspicious use of AdjustPrivilegeToken
PID:3264
-
-
C:\Windows\System32\Wbem\WMIC.exewmic baseboard get serialnumber2⤵PID:2068
-
-
C:\Windows\system32\getmac.exegetmac /NH2⤵PID:3384
-
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get ProcessorId,name2⤵PID:308
-
-
C:\Windows\System32\Wbem\WMIC.exewmic csproduct get uuid,name,version2⤵PID:4972
-