Malware Analysis Report

2025-05-28 16:41

Sample ID 230707-ezdffsgd2s
Target CheatoSpoofer (1).exe
SHA256 93d8134fa11201cecedac89d6c6af96afa83783aebf347ea3f6aefc925df8ceb
Tags
agilenet
score
7/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
7/10

SHA256

93d8134fa11201cecedac89d6c6af96afa83783aebf347ea3f6aefc925df8ceb

Threat Level: Shows suspicious behavior

The file CheatoSpoofer (1).exe was found to be: Shows suspicious behavior.

Malicious Activity Summary

agilenet

Loads dropped DLL

Obfuscated with Agile.Net obfuscator

Suspicious use of NtSetInformationThreadHideFromDebugger

Unsigned PE

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

MITRE ATT&CK

N/A

Analysis: static1

Detonation Overview

Reported

2023-07-07 04:22

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2023-07-07 04:22

Reported

2023-07-07 04:24

Platform

win10v2004-20230703-en

Max time kernel

66s

Max time network

74s

Command Line

"C:\Users\Admin\AppData\Local\Temp\CheatoSpoofer (1).exe"

Signatures

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\CheatoSpoofer (1).exe N/A

Obfuscated with Agile.Net obfuscator

agilenet
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Suspicious use of NtSetInformationThreadHideFromDebugger

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\CheatoSpoofer (1).exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\CheatoSpoofer (1).exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\CheatoSpoofer (1).exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\CheatoSpoofer (1).exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\CheatoSpoofer (1).exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\CheatoSpoofer (1).exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\CheatoSpoofer (1).exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\CheatoSpoofer (1).exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\CheatoSpoofer (1).exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\CheatoSpoofer (1).exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\CheatoSpoofer (1).exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\CheatoSpoofer (1).exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\CheatoSpoofer (1).exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\CheatoSpoofer (1).exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\CheatoSpoofer (1).exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\CheatoSpoofer (1).exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\CheatoSpoofer (1).exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\CheatoSpoofer (1).exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\CheatoSpoofer (1).exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\CheatoSpoofer (1).exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\CheatoSpoofer (1).exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\CheatoSpoofer (1).exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\CheatoSpoofer (1).exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\CheatoSpoofer (1).exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\CheatoSpoofer (1).exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\CheatoSpoofer (1).exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\CheatoSpoofer (1).exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\CheatoSpoofer (1).exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\CheatoSpoofer (1).exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\CheatoSpoofer (1).exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\CheatoSpoofer (1).exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\CheatoSpoofer (1).exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\CheatoSpoofer (1).exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\CheatoSpoofer (1).exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\CheatoSpoofer (1).exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\CheatoSpoofer (1).exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\CheatoSpoofer (1).exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\CheatoSpoofer (1).exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\CheatoSpoofer (1).exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\CheatoSpoofer (1).exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\CheatoSpoofer (1).exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\CheatoSpoofer (1).exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\CheatoSpoofer (1).exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\CheatoSpoofer (1).exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\CheatoSpoofer (1).exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\CheatoSpoofer (1).exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\CheatoSpoofer (1).exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\CheatoSpoofer (1).exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\CheatoSpoofer (1).exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\CheatoSpoofer (1).exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\CheatoSpoofer (1).exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\CheatoSpoofer (1).exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\CheatoSpoofer (1).exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\CheatoSpoofer (1).exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\CheatoSpoofer (1).exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\CheatoSpoofer (1).exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\CheatoSpoofer (1).exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\CheatoSpoofer (1).exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\CheatoSpoofer (1).exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\CheatoSpoofer (1).exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\CheatoSpoofer (1).exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\CheatoSpoofer (1).exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\CheatoSpoofer (1).exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\CheatoSpoofer (1).exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\CheatoSpoofer (1).exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\CheatoSpoofer (1).exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\CheatoSpoofer (1).exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Users\Admin\AppData\Local\Temp\CheatoSpoofer (1).exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\CheatoSpoofer (1).exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Users\Admin\AppData\Local\Temp\CheatoSpoofer (1).exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\CheatoSpoofer (1).exe N/A
Token: SeRestorePrivilege N/A C:\Users\Admin\AppData\Local\Temp\CheatoSpoofer (1).exe N/A
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Temp\CheatoSpoofer (1).exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\CheatoSpoofer (1).exe N/A
Token: SeAuditPrivilege N/A C:\Users\Admin\AppData\Local\Temp\CheatoSpoofer (1).exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Users\Admin\AppData\Local\Temp\CheatoSpoofer (1).exe N/A
Token: SeManageVolumePrivilege N/A C:\Users\Admin\AppData\Local\Temp\CheatoSpoofer (1).exe N/A
Token: SeImpersonatePrivilege N/A C:\Users\Admin\AppData\Local\Temp\CheatoSpoofer (1).exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\CheatoSpoofer (1).exe

"C:\Users\Admin\AppData\Local\Temp\CheatoSpoofer (1).exe"

C:\Windows\System32\rundll32.exe

C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding

Network

Country Destination Domain Proto
US 8.8.8.8:53 57.169.31.20.in-addr.arpa udp
US 8.8.8.8:53 68.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 assets.msn.com udp
DE 2.16.241.76:443 assets.msn.com tcp
US 8.8.8.8:53 76.241.16.2.in-addr.arpa udp
US 8.8.8.8:53 sentry.chea.to udp
US 104.26.9.75:443 sentry.chea.to tcp
US 8.8.8.8:53 75.9.26.104.in-addr.arpa udp
US 8.8.8.8:53 dev.virtualearth.net udp
IE 52.156.193.145:443 dev.virtualearth.net tcp
US 8.8.8.8:53 maps.googleapis.com udp
NL 142.251.39.106:443 maps.googleapis.com tcp
US 8.8.8.8:53 202.23.217.172.in-addr.arpa udp
US 8.8.8.8:53 145.193.156.52.in-addr.arpa udp
US 8.8.8.8:53 106.39.251.142.in-addr.arpa udp

Files

memory/2688-136-0x00007FF4531C0000-0x00007FF453591000-memory.dmp

memory/2688-137-0x0000000000EC0000-0x0000000005958000-memory.dmp

memory/2688-138-0x0000000000EC0000-0x0000000005958000-memory.dmp

memory/2688-139-0x00007FFC52390000-0x00007FFC523A0000-memory.dmp

memory/2688-140-0x0000000000EC0000-0x0000000005958000-memory.dmp

memory/2688-141-0x0000000000EC0000-0x0000000005958000-memory.dmp

memory/2688-142-0x0000000000EC0000-0x0000000005958000-memory.dmp

memory/2688-143-0x0000000000EC0000-0x0000000005958000-memory.dmp

memory/2688-145-0x00007FF4531C0000-0x00007FF453591000-memory.dmp

memory/2688-144-0x0000000000EC0000-0x0000000005958000-memory.dmp

memory/2688-146-0x0000025957D20000-0x0000025957D30000-memory.dmp

memory/2688-148-0x000002593E110000-0x000002593E120000-memory.dmp

memory/2688-147-0x000002593E110000-0x000002593E120000-memory.dmp

memory/2688-149-0x000002593E110000-0x000002593E120000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\Costura\5B2255609A942D3203015BC01089042A\64\user64.dll

MD5 c204468635ab30602dea443c445e1821
SHA1 c1fa917a4604f956ef15bb53655d368c6b19d042
SHA256 7bdc755921404ec6bca532790460523873c3169091020f117ad3ee79d395b6f7
SHA512 d1558e916f31f19ab5a86f3b07aab951cb0fa2df14d5ec4f8f704b146a6e2b117c108bc68afce17859a2c81048cabb1b0510b0c43b45839dc4d82d3aea61dc5b

memory/2688-154-0x000002593F7C0000-0x000002593F7C8000-memory.dmp

memory/2688-157-0x0000025957D20000-0x0000025957D30000-memory.dmp

memory/2688-156-0x0000025957D20000-0x0000025957D30000-memory.dmp

memory/2688-158-0x0000025957F60000-0x0000025957F68000-memory.dmp

memory/2688-159-0x00000259580B0000-0x00000259580CA000-memory.dmp

memory/2688-160-0x0000025958100000-0x0000025958122000-memory.dmp

memory/2688-161-0x0000000000EC0000-0x0000000005958000-memory.dmp

memory/2688-162-0x0000025957D20000-0x0000025957D30000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_utackxd4.rj4.ps1

MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

memory/2688-172-0x0000025957D20000-0x0000025957D30000-memory.dmp

memory/2688-173-0x000002593E110000-0x000002593E120000-memory.dmp

memory/2688-175-0x000002593E110000-0x000002593E120000-memory.dmp

memory/2688-174-0x000002593E110000-0x000002593E120000-memory.dmp

memory/2688-176-0x0000025957D20000-0x0000025957D30000-memory.dmp

memory/2688-177-0x0000025957D20000-0x0000025957D30000-memory.dmp

memory/2688-178-0x0000000000EC0000-0x0000000005958000-memory.dmp

memory/2688-179-0x0000025957D20000-0x0000025957D30000-memory.dmp

memory/2688-180-0x0000025957D20000-0x0000025957D30000-memory.dmp

memory/2688-181-0x000002595BD30000-0x000002595BE30000-memory.dmp

memory/2688-182-0x0000025957D20000-0x0000025957D30000-memory.dmp

memory/2688-183-0x000002595C360000-0x000002595C361000-memory.dmp

memory/2688-184-0x0000025957D20000-0x0000025957D30000-memory.dmp

memory/2688-185-0x0000000000EC0000-0x0000000005958000-memory.dmp

memory/2688-187-0x000002595BD30000-0x000002595BE30000-memory.dmp

memory/2688-186-0x0000000000EC0000-0x0000000005958000-memory.dmp