Analysis Overview
SHA256
3527b49df60aebfc45c67fdeb5ebf439299029eaaa1b20bc7a90132f8b940449
Threat Level: Known bad
The file Spoofer__Cleaner.rar was found to be: Known bad.
Malicious Activity Summary
ElysiumStealer
ElysiumStealer Support DLL
Loads dropped DLL
Suspicious use of AdjustPrivilegeToken
Suspicious use of SetWindowsHookEx
MITRE ATT&CK Matrix
Analysis: static1
Detonation Overview
Reported
2022-12-09 02:30
Signatures
Analysis: behavioral3
Detonation Overview
Submitted
2022-12-09 02:30
Reported
2022-12-09 02:32
Platform
win7-20220812-en
Max time kernel
1s
Command Line
Signatures
Processes
C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\Smelo Woofer\Guna.UI2.dll",#1
Network
Files
Analysis: behavioral5
Detonation Overview
Submitted
2022-12-09 02:30
Reported
2022-12-09 02:33
Platform
win7-20220812-en
Max time kernel
69s
Max time network
142s
Command Line
Signatures
ElysiumStealer
ElysiumStealer Support DLL
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
Loads dropped DLL
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\Smelo Woofer\HwidSpoofer.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\Smelo Woofer\HwidSpoofer.exe | N/A |
Suspicious use of AdjustPrivilegeToken
| Description | Indicator | Process | Target |
| Token: SeDebugPrivilege | N/A | C:\Users\Admin\AppData\Local\Temp\Smelo Woofer\HwidSpoofer.exe | N/A |
Suspicious use of SetWindowsHookEx
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\Smelo Woofer\HwidSpoofer.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\Smelo Woofer\HwidSpoofer.exe | N/A |
Processes
C:\Users\Admin\AppData\Local\Temp\Smelo Woofer\HwidSpoofer.exe
"C:\Users\Admin\AppData\Local\Temp\Smelo Woofer\HwidSpoofer.exe"
Network
| Country | Destination | Domain | Proto |
| N/A | 8.8.8.8:53 | keyauth.win | udp |
| N/A | 188.114.97.0:443 | keyauth.win | tcp |
Files
memory/1248-54-0x00000000000B0000-0x0000000000784000-memory.dmp
memory/1248-55-0x00000000009D0000-0x00000000009DC000-memory.dmp
\Users\Admin\AppData\Local\Temp\Runtime.MSIL.1.0.0.0\NativePRo.dll
| MD5 | 94173de2e35aa8d621fc1c4f54b2a082 |
| SHA1 | fbb2266ee47f88462560f0370edb329554cd5869 |
| SHA256 | 7e2c70b7732fb1a9a61d7ce3d7290bc7b31ea28cbfb1dbc79d377835615b941f |
| SHA512 | cadbf4db0417283a02febbabd337bf17b254a6eb6e771f8a553a140dd2b04efd0672b1f3175c044a3edd0a911ce59d6695f765555262560925f3159bb8f3b798 |
memory/1248-57-0x0000000075351000-0x0000000075353000-memory.dmp
memory/1248-58-0x0000000005170000-0x000000000528A000-memory.dmp
memory/1248-59-0x0000000004D80000-0x0000000004DE6000-memory.dmp
memory/1248-60-0x0000000000CC5000-0x0000000000CD6000-memory.dmp
memory/1248-61-0x0000000009760000-0x000000000999E000-memory.dmp
\Users\Admin\AppData\Local\Temp\71ca6684-c388-4e5d-bf7c-156dde04d7d5\awalsenin.dll
| MD5 | 14ff402962ad21b78ae0b4c43cd1f194 |
| SHA1 | f8a510eb26666e875a5bdd1cadad40602763ad72 |
| SHA256 | fb9646cb956945bdc503e69645f6b5316d3826b780d3c36738d6b944e884d15b |
| SHA512 | daa7a08bf3709119a944bce28f6ebdd24e54a22b18cd9f86a87873e958df121a3881dcdd5e162f6b4e543238c7aef20f657c9830df01d4c79290f7c9a4fcc54b |
Analysis: behavioral6
Detonation Overview
Submitted
2022-12-09 02:30
Reported
2022-12-09 02:34
Platform
win10v2004-20221111-en
Max time kernel
163s
Max time network
204s
Command Line
Signatures
ElysiumStealer
ElysiumStealer Support DLL
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
Loads dropped DLL
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\Smelo Woofer\HwidSpoofer.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\Smelo Woofer\HwidSpoofer.exe | N/A |
Suspicious use of AdjustPrivilegeToken
| Description | Indicator | Process | Target |
| Token: SeDebugPrivilege | N/A | C:\Users\Admin\AppData\Local\Temp\Smelo Woofer\HwidSpoofer.exe | N/A |
Suspicious use of SetWindowsHookEx
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\Smelo Woofer\HwidSpoofer.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\Smelo Woofer\HwidSpoofer.exe | N/A |
Processes
C:\Users\Admin\AppData\Local\Temp\Smelo Woofer\HwidSpoofer.exe
"C:\Users\Admin\AppData\Local\Temp\Smelo Woofer\HwidSpoofer.exe"
Network
| Country | Destination | Domain | Proto |
| N/A | 93.184.221.240:80 | tcp | |
| N/A | 52.182.143.211:443 | tcp | |
| N/A | 104.80.225.205:443 | tcp | |
| N/A | 93.184.220.29:80 | tcp | |
| N/A | 20.54.89.106:443 | tcp | |
| N/A | 93.184.220.29:80 | tcp | |
| N/A | 93.184.221.240:80 | tcp | |
| N/A | 93.184.221.240:80 | tcp | |
| N/A | 8.8.8.8:53 | 176.122.125.40.in-addr.arpa | udp |
| N/A | 8.8.8.8:53 | keyauth.win | udp |
| N/A | 188.114.97.0:443 | keyauth.win | tcp |
| N/A | 87.248.202.1:80 | tcp | |
| N/A | 8.8.8.8:53 | a.2.0.0.0.0.0.0.0.0.0.0.0.0.0.0.3.0.0.0.5.0.8.0.0.3.0.1.3.0.6.2.ip6.arpa | udp |
| N/A | 188.114.96.0:443 | keyauth.win | tcp |
| N/A | 8.238.23.254:80 | tcp |
Files
memory/1740-132-0x00000000002D0000-0x00000000009A4000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\Runtime.MSIL.1.0.0.0\NativePRo.dll
| MD5 | 94173de2e35aa8d621fc1c4f54b2a082 |
| SHA1 | fbb2266ee47f88462560f0370edb329554cd5869 |
| SHA256 | 7e2c70b7732fb1a9a61d7ce3d7290bc7b31ea28cbfb1dbc79d377835615b941f |
| SHA512 | cadbf4db0417283a02febbabd337bf17b254a6eb6e771f8a553a140dd2b04efd0672b1f3175c044a3edd0a911ce59d6695f765555262560925f3159bb8f3b798 |
memory/1740-134-0x0000000005A00000-0x0000000005FA4000-memory.dmp
memory/1740-135-0x0000000005450000-0x00000000054E2000-memory.dmp
memory/1740-136-0x00000000055E0000-0x00000000055EA000-memory.dmp
memory/1740-137-0x0000000005720000-0x000000000583A000-memory.dmp
memory/1740-138-0x0000000006250000-0x00000000062EC000-memory.dmp
memory/1740-139-0x0000000007F10000-0x0000000007F22000-memory.dmp
memory/1740-140-0x000000000A950000-0x000000000AB8E000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\71ca6684-c388-4e5d-bf7c-156dde04d7d5\awalsenin.dll
| MD5 | 14ff402962ad21b78ae0b4c43cd1f194 |
| SHA1 | f8a510eb26666e875a5bdd1cadad40602763ad72 |
| SHA256 | fb9646cb956945bdc503e69645f6b5316d3826b780d3c36738d6b944e884d15b |
| SHA512 | daa7a08bf3709119a944bce28f6ebdd24e54a22b18cd9f86a87873e958df121a3881dcdd5e162f6b4e543238c7aef20f657c9830df01d4c79290f7c9a4fcc54b |
memory/1740-142-0x00000000739D0000-0x0000000073A59000-memory.dmp
Analysis: behavioral7
Detonation Overview
Submitted
2022-12-09 02:30
Reported
2022-12-09 02:31
Platform
win7-20221111-en
Max time kernel
1s
Command Line
Signatures
Processes
C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\Smelo Woofer\Siticone.UI.dll",#1
Network
Files
Analysis: behavioral2
Detonation Overview
Submitted
2022-12-09 02:30
Reported
2022-12-09 02:31
Platform
win10v2004-20221111-en
Max time kernel
18s
Max time network
33s
Command Line
Signatures
Processes
C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\Smelo Woofer\Guna.UI.dll",#1
Network
| Country | Destination | Domain | Proto |
| N/A | 72.21.81.240:80 | tcp | |
| N/A | 72.21.81.240:80 | tcp | |
| N/A | 72.21.81.240:80 | tcp | |
| N/A | 72.21.81.240:80 | tcp | |
| N/A | 72.21.81.240:80 | tcp | |
| N/A | 72.21.81.240:80 | tcp |
Files
Analysis: behavioral4
Detonation Overview
Submitted
2022-12-09 02:30
Reported
2022-12-09 02:34
Platform
win10v2004-20221111-en
Max time kernel
144s
Max time network
208s
Command Line
Signatures
Processes
C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\Smelo Woofer\Guna.UI2.dll",#1
Network
| Country | Destination | Domain | Proto |
| N/A | 72.21.91.29:80 | tcp | |
| N/A | 209.197.3.8:80 | tcp | |
| N/A | 93.184.221.240:80 | tcp | |
| N/A | 51.105.71.136:443 | tcp | |
| N/A | 93.184.221.240:80 | tcp | |
| N/A | 93.184.221.240:80 | tcp | |
| N/A | 93.184.221.240:80 | tcp | |
| N/A | 93.184.221.240:80 | tcp | |
| N/A | 93.184.221.240:80 | tcp | |
| N/A | 40.126.32.74:443 | tcp | |
| N/A | 93.184.221.240:80 | tcp | |
| N/A | 8.8.8.8:53 | 106.89.54.20.in-addr.arpa | udp |
| N/A | 8.8.8.8:53 | 9.9.0.0.0.0.0.0.0.0.0.0.0.0.0.0.3.0.0.0.2.0.0.0.0.2.0.1.3.0.6.2.ip6.arpa | udp |
Files
Analysis: behavioral8
Detonation Overview
Submitted
2022-12-09 02:30
Reported
2022-12-09 02:33
Platform
win10v2004-20220812-en
Max time kernel
100s
Max time network
150s
Command Line
Signatures
Processes
C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\Smelo Woofer\Siticone.UI.dll",#1
Network
| Country | Destination | Domain | Proto |
| N/A | 8.252.118.126:80 | tcp | |
| N/A | 8.252.118.126:80 | tcp | |
| N/A | 13.69.239.74:443 | tcp | |
| N/A | 8.252.118.126:80 | tcp | |
| N/A | 93.184.220.29:80 | tcp | |
| N/A | 8.8.8.8:53 | 96.108.152.52.in-addr.arpa | udp |
| N/A | 8.252.118.126:80 | tcp | |
| N/A | 8.252.118.126:80 | tcp | |
| N/A | 8.252.118.126:80 | tcp | |
| N/A | 93.184.221.240:80 | tcp | |
| N/A | 104.80.225.205:443 | tcp |
Files
Analysis: behavioral1
Detonation Overview
Submitted
2022-12-09 02:30
Reported
2022-12-09 02:30
Platform
win7-20220901-en
Max time kernel
9s
Command Line
Signatures
Processes
C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\Smelo Woofer\Guna.UI.dll",#1