Overview
overview
3Static
static
moonspoofe...er.exe
windows10-2004-x64
1moonspoofe...er.exe
windows10-2004-x64
3moonspoofe...er.exe
windows10-2004-x64
1moonspoofe...er.exe
windows10-2004-x64
1moonspoofe...er.exe
windows10-2004-x64
3moonspoofe...up.exe
windows10-2004-x64
1moonspoofe...er.exe
windows10-2004-x64
3moonspoofe...er.exe
windows10-2004-x64
3moonspoofe...er.exe
windows10-2004-x64
1moonspoofe...er.exe
windows10-2004-x64
1moonspoofe...er.exe
windows10-2004-x64
1moonspoofe...er.exe
windows10-2004-x64
1moonspoofe...er.exe
windows10-2004-x64
1moonspoofe...er.exe
windows10-2004-x64
1moonspoofe...er.exe
windows10-2004-x64
1moonspoofe...er.exe
windows10-2004-x64
1moonspoofe...er.exe
windows10-2004-x64
1moonspoofe...er.exe
windows10-2004-x64
1moonspoofe...er.exe
windows10-2004-x64
1moonspoofe...er.exe
windows10-2004-x64
1moonspoofe...er.exe
windows10-2004-x64
1moonspoofe...er.exe
windows10-2004-x64
1moonspoofe...er.exe
windows10-2004-x64
3moonspoofe...er.exe
windows10-2004-x64
1moonspoofe...er.exe
windows10-2004-x64
1moonspoofe...er.exe
windows10-2004-x64
3moonspoofe...er.exe
windows10-2004-x64
1moonspoofe...er.exe
windows10-2004-x64
3moonspoofe...er.exe
windows10-2004-x64
1moonspoofe...er.exe
windows10-2004-x64
1moonspoofe...er.exe
windows10-2004-x64
1moonspoofe...up.exe
windows10-2004-x64
1Analysis
-
max time kernel
31s -
max time network
50s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
18-12-2022 13:36
Static task
static1
Behavioral task
behavioral1
Sample
moonspoofer-main/moonspoofer/bin/Debug/MoonSpoofer.exe
Resource
win10v2004-20220812-en
Behavioral task
behavioral2
Sample
moonspoofer-main/moonspoofer/bin/Debug/app.publish/MoonSpoofer.exe
Resource
win10v2004-20220812-en
Behavioral task
behavioral3
Sample
moonspoofer-main/moonspoofer/bin/Release/MoonSpoofer.exe
Resource
win10v2004-20221111-en
Behavioral task
behavioral4
Sample
moonspoofer-main/moonspoofer/bin/Release/app.publish/Application Files/MoonSpoofer_1_0_0_26/MoonSpoofer.exe
Resource
win10v2004-20221111-en
Behavioral task
behavioral5
Sample
moonspoofer-main/moonspoofer/bin/Release/app.publish/MoonSpoofer.exe
Resource
win10v2004-20221111-en
Behavioral task
behavioral6
Sample
moonspoofer-main/moonspoofer/bin/Release/app.publish/setup.exe
Resource
win10v2004-20220812-en
Behavioral task
behavioral7
Sample
moonspoofer-main/moonspoofer/obj/Debug/MoonSpoofer.exe
Resource
win10v2004-20220812-en
Behavioral task
behavioral8
Sample
moonspoofer-main/moonspoofer/obj/Release/MoonSpoofer.exe
Resource
win10v2004-20221111-en
Behavioral task
behavioral9
Sample
moonspoofer-main/moonspoofer/publikuj/Application Files/Loader_1_0_0_0/Loader.exe
Resource
win10v2004-20220901-en
Behavioral task
behavioral10
Sample
moonspoofer-main/moonspoofer/publikuj/Application Files/Loader_1_0_0_1/Loader.exe
Resource
win10v2004-20220812-en
Behavioral task
behavioral11
Sample
moonspoofer-main/moonspoofer/publikuj/Application Files/Loader_1_0_0_2/Loader.exe
Resource
win10v2004-20221111-en
Behavioral task
behavioral12
Sample
moonspoofer-main/moonspoofer/publikuj/Application Files/MoonSpoofer_1_0_0_21/Nowy folder/MoonSpoofer.exe
Resource
win10v2004-20221111-en
Behavioral task
behavioral13
Sample
moonspoofer-main/moonspoofer/publikuj/Application Files/MoonSpoofer_1_0_0_22/MoonSpoofer.exe
Resource
win10v2004-20220812-en
Behavioral task
behavioral14
Sample
moonspoofer-main/moonspoofer/publikuj/Application Files/MoonSpoofer_1_0_0_23/MoonSpoofer.exe
Resource
win10v2004-20221111-en
Behavioral task
behavioral15
Sample
moonspoofer-main/moonspoofer/publikuj/Application Files/MoonSpoofer_1_0_0_24/MoonSpoofer.exe
Resource
win10v2004-20220812-en
Behavioral task
behavioral16
Sample
moonspoofer-main/moonspoofer/publikuj/Application Files/MoonSpoofer_1_0_0_25/MoonSpoofer.exe
Resource
win10v2004-20220901-en
Behavioral task
behavioral17
Sample
moonspoofer-main/moonspoofer/publikuj/Application Files/MoonSpoofer_1_0_0_26/MoonSpoofer.exe
Resource
win10v2004-20221111-en
Behavioral task
behavioral18
Sample
moonspoofer-main/moonspoofer/publikuj/Application Files/UranSpoofer_1_0_0_11/UranSpoofer.exe
Resource
win10v2004-20221111-en
Behavioral task
behavioral19
Sample
moonspoofer-main/moonspoofer/publikuj/Application Files/UranSpoofer_1_0_0_12/UranSpoofer.exe
Resource
win10v2004-20220812-en
Behavioral task
behavioral20
Sample
moonspoofer-main/moonspoofer/publikuj/Application Files/UranSpoofer_1_0_0_12/halo/UranSpoofer.exe
Resource
win10v2004-20220812-en
Behavioral task
behavioral21
Sample
moonspoofer-main/moonspoofer/publikuj/Application Files/UranSpoofer_1_0_0_15/UranSpoofer.exe
Resource
win10v2004-20221111-en
Behavioral task
behavioral22
Sample
moonspoofer-main/moonspoofer/publikuj/Application Files/UranSpoofer_1_0_0_16/UranSpoofer.exe
Resource
win10v2004-20220812-en
Behavioral task
behavioral23
Sample
moonspoofer-main/moonspoofer/publikuj/Application Files/UranSpoofer_1_0_0_16/UranSpoofer_Secure/UranSpoofer.exe
Resource
win10v2004-20220901-en
Behavioral task
behavioral24
Sample
moonspoofer-main/moonspoofer/publikuj/Application Files/UranSpoofer_1_0_0_17/Confused/UranSpoofer.exe
Resource
win10v2004-20221111-en
Behavioral task
behavioral25
Sample
moonspoofer-main/moonspoofer/publikuj/Application Files/UranSpoofer_1_0_0_18/UranSpoofer.exe
Resource
win10v2004-20221111-en
Behavioral task
behavioral26
Sample
moonspoofer-main/moonspoofer/publikuj/Application Files/UranSpoofer_1_0_0_19/UranSpoofer.exe
Resource
win10v2004-20220901-en
Behavioral task
behavioral27
Sample
moonspoofer-main/moonspoofer/publikuj/Application Files/UranSpoofer_1_0_0_19/UranSpoofer_Secure/Protected/UranSpoofer.exe
Resource
win10v2004-20220812-en
Behavioral task
behavioral28
Sample
moonspoofer-main/moonspoofer/publikuj/Application Files/UranSpoofer_1_0_0_19/UranSpoofer_Secure/UranSpoofer.exe
Resource
win10v2004-20220812-en
Behavioral task
behavioral29
Sample
moonspoofer-main/moonspoofer/publikuj/Application Files/UranSpoofer_1_0_0_6/UranSpoofer.exe
Resource
win10v2004-20220812-en
Behavioral task
behavioral30
Sample
moonspoofer-main/moonspoofer/publikuj/Application Files/UranSpoofer_1_0_0_7/UranSpoofer.exe
Resource
win10v2004-20220812-en
Behavioral task
behavioral31
Sample
moonspoofer-main/moonspoofer/publikuj/Application Files/UranSpoofer_1_0_0_8/UranSpoofer.exe
Resource
win10v2004-20221111-en
Behavioral task
behavioral32
Sample
moonspoofer-main/moonspoofer/publikuj/setup.exe
Resource
win10v2004-20221111-en
General
-
Target
moonspoofer-main/moonspoofer/bin/Debug/MoonSpoofer.exe
-
Size
369KB
-
MD5
2d73d569359592ac10ce35d14a6f8526
-
SHA1
886a6053e7723e1358eb1d22c339375e5a794ce9
-
SHA256
7d202f15c7fac8991417ec14c890dfc79c4ce6aef8498bb7e551473e65731ba9
-
SHA512
d5543e97545e7464cce975b14e41f60d56e8a2e3fce35fbf3d6e1ae1bad36e6a94271cc3e3107fd9797b2e3f587d1d2fdeaa7d1e5a5f663771b1b4b161943aed
-
SSDEEP
6144:CtuezJ/rvhl0bBGaA5v7xpKpQ9/3Ew/uo27pUogiDsZAEw/uo2uEw/uo2uEw/uor:Wl5B0K527lsZK52hK52hK52T6
Malware Config
Signatures
-
Delays execution with timeout.exe 1 IoCs
pid Process 4108 timeout.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 3456 MoonSpoofer.exe -
Suspicious use of WriteProcessMemory 9 IoCs
description pid Process procid_target PID 3456 wrote to memory of 1088 3456 MoonSpoofer.exe 81 PID 3456 wrote to memory of 1088 3456 MoonSpoofer.exe 81 PID 3456 wrote to memory of 1088 3456 MoonSpoofer.exe 81 PID 1088 wrote to memory of 1712 1088 cmd.exe 83 PID 1088 wrote to memory of 1712 1088 cmd.exe 83 PID 1088 wrote to memory of 1712 1088 cmd.exe 83 PID 1712 wrote to memory of 4108 1712 cmd.exe 85 PID 1712 wrote to memory of 4108 1712 cmd.exe 85 PID 1712 wrote to memory of 4108 1712 cmd.exe 85
Processes
-
C:\Users\Admin\AppData\Local\Temp\moonspoofer-main\moonspoofer\bin\Debug\MoonSpoofer.exe"C:\Users\Admin\AppData\Local\Temp\moonspoofer-main\moonspoofer\bin\Debug\MoonSpoofer.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3456 -
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c start cmd /C "color b && title Error && echo Application not found && timeout /t 5"2⤵
- Suspicious use of WriteProcessMemory
PID:1088 -
C:\Windows\SysWOW64\cmd.execmd /C "color b && title Error && echo Application not found && timeout /t 5"3⤵
- Suspicious use of WriteProcessMemory
PID:1712 -
C:\Windows\SysWOW64\timeout.exetimeout /t 54⤵
- Delays execution with timeout.exe
PID:4108
-
-
-