Analysis

  • max time kernel
    66s
  • max time network
    74s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230703-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
  • submitted
    07/07/2023, 04:22

General

  • Target

    CheatoSpoofer (1).exe

  • Size

    32.3MB

  • MD5

    7a8f3ff6b456e153499088a103d51145

  • SHA1

    30f1fc37c25cd368594c0b8c9e416b3c5ed31d6f

  • SHA256

    93d8134fa11201cecedac89d6c6af96afa83783aebf347ea3f6aefc925df8ceb

  • SHA512

    e295568d314d88355ca1d681602ea00ac3419d3f583e6773eae74d6fd1eaa16789b01af8e35d4af9941ff57055d688d153bf9b2c14ffb8961c5359f2a11e31f0

  • SSDEEP

    786432:BYMfV94+jxjRtMCKIvIGviTq1LZw2OhEyKYEVwSppnu:BYAVRxNWuQGviU1JzyKFV/

Score
7/10

Malware Config

Signatures

  • Loads dropped DLL 1 IoCs
  • Obfuscated with Agile.Net obfuscator 11 IoCs

    Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.

  • Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 12 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\CheatoSpoofer (1).exe
    "C:\Users\Admin\AppData\Local\Temp\CheatoSpoofer (1).exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    PID:2688
  • C:\Windows\System32\rundll32.exe
    C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
    1⤵
      PID:2036

    Network

          MITRE ATT&CK Matrix

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • C:\Users\Admin\AppData\Local\Temp\Costura\5B2255609A942D3203015BC01089042A\64\user64.dll

            Filesize

            285KB

            MD5

            c204468635ab30602dea443c445e1821

            SHA1

            c1fa917a4604f956ef15bb53655d368c6b19d042

            SHA256

            7bdc755921404ec6bca532790460523873c3169091020f117ad3ee79d395b6f7

            SHA512

            d1558e916f31f19ab5a86f3b07aab951cb0fa2df14d5ec4f8f704b146a6e2b117c108bc68afce17859a2c81048cabb1b0510b0c43b45839dc4d82d3aea61dc5b

          • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_utackxd4.rj4.ps1

            Filesize

            60B

            MD5

            d17fe0a3f47be24a6453e9ef58c94641

            SHA1

            6ab83620379fc69f80c0242105ddffd7d98d5d9d

            SHA256

            96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

            SHA512

            5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

          • memory/2688-160-0x0000025958100000-0x0000025958122000-memory.dmp

            Filesize

            136KB

          • memory/2688-161-0x0000000000EC0000-0x0000000005958000-memory.dmp

            Filesize

            74.6MB

          • memory/2688-140-0x0000000000EC0000-0x0000000005958000-memory.dmp

            Filesize

            74.6MB

          • memory/2688-141-0x0000000000EC0000-0x0000000005958000-memory.dmp

            Filesize

            74.6MB

          • memory/2688-142-0x0000000000EC0000-0x0000000005958000-memory.dmp

            Filesize

            74.6MB

          • memory/2688-143-0x0000000000EC0000-0x0000000005958000-memory.dmp

            Filesize

            74.6MB

          • memory/2688-145-0x00007FF4531C0000-0x00007FF453591000-memory.dmp

            Filesize

            3.8MB

          • memory/2688-144-0x0000000000EC0000-0x0000000005958000-memory.dmp

            Filesize

            74.6MB

          • memory/2688-146-0x0000025957D20000-0x0000025957D30000-memory.dmp

            Filesize

            64KB

          • memory/2688-162-0x0000025957D20000-0x0000025957D30000-memory.dmp

            Filesize

            64KB

          • memory/2688-147-0x000002593E110000-0x000002593E120000-memory.dmp

            Filesize

            64KB

          • memory/2688-149-0x000002593E110000-0x000002593E120000-memory.dmp

            Filesize

            64KB

          • memory/2688-138-0x0000000000EC0000-0x0000000005958000-memory.dmp

            Filesize

            74.6MB

          • memory/2688-154-0x000002593F7C0000-0x000002593F7C8000-memory.dmp

            Filesize

            32KB

          • memory/2688-157-0x0000025957D20000-0x0000025957D30000-memory.dmp

            Filesize

            64KB

          • memory/2688-156-0x0000025957D20000-0x0000025957D30000-memory.dmp

            Filesize

            64KB

          • memory/2688-158-0x0000025957F60000-0x0000025957F68000-memory.dmp

            Filesize

            32KB

          • memory/2688-159-0x00000259580B0000-0x00000259580CA000-memory.dmp

            Filesize

            104KB

          • memory/2688-139-0x00007FFC52390000-0x00007FFC523A0000-memory.dmp

            Filesize

            64KB

          • memory/2688-136-0x00007FF4531C0000-0x00007FF453591000-memory.dmp

            Filesize

            3.8MB

          • memory/2688-148-0x000002593E110000-0x000002593E120000-memory.dmp

            Filesize

            64KB

          • memory/2688-137-0x0000000000EC0000-0x0000000005958000-memory.dmp

            Filesize

            74.6MB

          • memory/2688-172-0x0000025957D20000-0x0000025957D30000-memory.dmp

            Filesize

            64KB

          • memory/2688-173-0x000002593E110000-0x000002593E120000-memory.dmp

            Filesize

            64KB

          • memory/2688-175-0x000002593E110000-0x000002593E120000-memory.dmp

            Filesize

            64KB

          • memory/2688-174-0x000002593E110000-0x000002593E120000-memory.dmp

            Filesize

            64KB

          • memory/2688-176-0x0000025957D20000-0x0000025957D30000-memory.dmp

            Filesize

            64KB

          • memory/2688-177-0x0000025957D20000-0x0000025957D30000-memory.dmp

            Filesize

            64KB

          • memory/2688-178-0x0000000000EC0000-0x0000000005958000-memory.dmp

            Filesize

            74.6MB

          • memory/2688-179-0x0000025957D20000-0x0000025957D30000-memory.dmp

            Filesize

            64KB

          • memory/2688-180-0x0000025957D20000-0x0000025957D30000-memory.dmp

            Filesize

            64KB

          • memory/2688-181-0x000002595BD30000-0x000002595BE30000-memory.dmp

            Filesize

            1024KB

          • memory/2688-182-0x0000025957D20000-0x0000025957D30000-memory.dmp

            Filesize

            64KB

          • memory/2688-183-0x000002595C360000-0x000002595C361000-memory.dmp

            Filesize

            4KB

          • memory/2688-184-0x0000025957D20000-0x0000025957D30000-memory.dmp

            Filesize

            64KB

          • memory/2688-185-0x0000000000EC0000-0x0000000005958000-memory.dmp

            Filesize

            74.6MB

          • memory/2688-187-0x000002595BD30000-0x000002595BE30000-memory.dmp

            Filesize

            1024KB

          • memory/2688-186-0x0000000000EC0000-0x0000000005958000-memory.dmp

            Filesize

            74.6MB