Analysis

  • max time kernel
    31s
  • max time network
    50s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220812-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
  • submitted
    18-12-2022 13:36

General

  • Target

    moonspoofer-main/moonspoofer/bin/Debug/MoonSpoofer.exe

  • Size

    369KB

  • MD5

    2d73d569359592ac10ce35d14a6f8526

  • SHA1

    886a6053e7723e1358eb1d22c339375e5a794ce9

  • SHA256

    7d202f15c7fac8991417ec14c890dfc79c4ce6aef8498bb7e551473e65731ba9

  • SHA512

    d5543e97545e7464cce975b14e41f60d56e8a2e3fce35fbf3d6e1ae1bad36e6a94271cc3e3107fd9797b2e3f587d1d2fdeaa7d1e5a5f663771b1b4b161943aed

  • SSDEEP

    6144:CtuezJ/rvhl0bBGaA5v7xpKpQ9/3Ew/uo27pUogiDsZAEw/uo2uEw/uo2uEw/uor:Wl5B0K527lsZK52hK52hK52T6

Score
1/10

Malware Config

Signatures

  • Delays execution with timeout.exe 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 9 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\moonspoofer-main\moonspoofer\bin\Debug\MoonSpoofer.exe
    "C:\Users\Admin\AppData\Local\Temp\moonspoofer-main\moonspoofer\bin\Debug\MoonSpoofer.exe"
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:3456
    • C:\Windows\SysWOW64\cmd.exe
      "cmd.exe" /c start cmd /C "color b && title Error && echo Application not found && timeout /t 5"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:1088
      • C:\Windows\SysWOW64\cmd.exe
        cmd /C "color b && title Error && echo Application not found && timeout /t 5"
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:1712
        • C:\Windows\SysWOW64\timeout.exe
          timeout /t 5
          4⤵
          • Delays execution with timeout.exe
          PID:4108

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/1088-139-0x0000000000000000-mapping.dmp

  • memory/1712-140-0x0000000000000000-mapping.dmp

  • memory/3456-132-0x0000000000900000-0x0000000000962000-memory.dmp

    Filesize

    392KB

  • memory/3456-133-0x0000000005860000-0x0000000005E04000-memory.dmp

    Filesize

    5.6MB

  • memory/3456-134-0x0000000005350000-0x00000000053E2000-memory.dmp

    Filesize

    584KB

  • memory/3456-135-0x00000000052D0000-0x00000000052E2000-memory.dmp

    Filesize

    72KB

  • memory/3456-136-0x0000000005340000-0x000000000534A000-memory.dmp

    Filesize

    40KB

  • memory/3456-137-0x0000000005690000-0x00000000057DE000-memory.dmp

    Filesize

    1.3MB

  • memory/3456-138-0x0000000006440000-0x0000000006800000-memory.dmp

    Filesize

    3.8MB

  • memory/4108-141-0x0000000000000000-mapping.dmp