Analysis Overview
SHA256
93d8134fa11201cecedac89d6c6af96afa83783aebf347ea3f6aefc925df8ceb
Threat Level: Shows suspicious behavior
The file CheatoSpoofer (1).exe was found to be: Shows suspicious behavior.
Malicious Activity Summary
Loads dropped DLL
Obfuscated with Agile.Net obfuscator
Suspicious use of NtSetInformationThreadHideFromDebugger
Unsigned PE
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
MITRE ATT&CK
Analysis: static1
Detonation Overview
Reported
2023-07-07 04:22
Signatures
Unsigned PE
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
Analysis: behavioral1
Detonation Overview
Submitted
2023-07-07 04:22
Reported
2023-07-07 04:24
Platform
win10v2004-20230703-en
Max time kernel
66s
Max time network
74s
Command Line
Signatures
Loads dropped DLL
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\CheatoSpoofer (1).exe | N/A |
Obfuscated with Agile.Net obfuscator
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
Suspicious use of NtSetInformationThreadHideFromDebugger
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\CheatoSpoofer (1).exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\CheatoSpoofer (1).exe | N/A |
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Processes
C:\Users\Admin\AppData\Local\Temp\CheatoSpoofer (1).exe
"C:\Users\Admin\AppData\Local\Temp\CheatoSpoofer (1).exe"
C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
Network
| Country | Destination | Domain | Proto |
| US | 8.8.8.8:53 | 57.169.31.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 68.159.190.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | assets.msn.com | udp |
| DE | 2.16.241.76:443 | assets.msn.com | tcp |
| US | 8.8.8.8:53 | 76.241.16.2.in-addr.arpa | udp |
| US | 8.8.8.8:53 | sentry.chea.to | udp |
| US | 104.26.9.75:443 | sentry.chea.to | tcp |
| US | 8.8.8.8:53 | 75.9.26.104.in-addr.arpa | udp |
| US | 8.8.8.8:53 | dev.virtualearth.net | udp |
| IE | 52.156.193.145:443 | dev.virtualearth.net | tcp |
| US | 8.8.8.8:53 | maps.googleapis.com | udp |
| NL | 142.251.39.106:443 | maps.googleapis.com | tcp |
| US | 8.8.8.8:53 | 202.23.217.172.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 145.193.156.52.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 106.39.251.142.in-addr.arpa | udp |
Files
memory/2688-136-0x00007FF4531C0000-0x00007FF453591000-memory.dmp
memory/2688-137-0x0000000000EC0000-0x0000000005958000-memory.dmp
memory/2688-138-0x0000000000EC0000-0x0000000005958000-memory.dmp
memory/2688-139-0x00007FFC52390000-0x00007FFC523A0000-memory.dmp
memory/2688-140-0x0000000000EC0000-0x0000000005958000-memory.dmp
memory/2688-141-0x0000000000EC0000-0x0000000005958000-memory.dmp
memory/2688-142-0x0000000000EC0000-0x0000000005958000-memory.dmp
memory/2688-143-0x0000000000EC0000-0x0000000005958000-memory.dmp
memory/2688-145-0x00007FF4531C0000-0x00007FF453591000-memory.dmp
memory/2688-144-0x0000000000EC0000-0x0000000005958000-memory.dmp
memory/2688-146-0x0000025957D20000-0x0000025957D30000-memory.dmp
memory/2688-148-0x000002593E110000-0x000002593E120000-memory.dmp
memory/2688-147-0x000002593E110000-0x000002593E120000-memory.dmp
memory/2688-149-0x000002593E110000-0x000002593E120000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\Costura\5B2255609A942D3203015BC01089042A\64\user64.dll
| MD5 | c204468635ab30602dea443c445e1821 |
| SHA1 | c1fa917a4604f956ef15bb53655d368c6b19d042 |
| SHA256 | 7bdc755921404ec6bca532790460523873c3169091020f117ad3ee79d395b6f7 |
| SHA512 | d1558e916f31f19ab5a86f3b07aab951cb0fa2df14d5ec4f8f704b146a6e2b117c108bc68afce17859a2c81048cabb1b0510b0c43b45839dc4d82d3aea61dc5b |
memory/2688-154-0x000002593F7C0000-0x000002593F7C8000-memory.dmp
memory/2688-157-0x0000025957D20000-0x0000025957D30000-memory.dmp
memory/2688-156-0x0000025957D20000-0x0000025957D30000-memory.dmp
memory/2688-158-0x0000025957F60000-0x0000025957F68000-memory.dmp
memory/2688-159-0x00000259580B0000-0x00000259580CA000-memory.dmp
memory/2688-160-0x0000025958100000-0x0000025958122000-memory.dmp
memory/2688-161-0x0000000000EC0000-0x0000000005958000-memory.dmp
memory/2688-162-0x0000025957D20000-0x0000025957D30000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_utackxd4.rj4.ps1
| MD5 | d17fe0a3f47be24a6453e9ef58c94641 |
| SHA1 | 6ab83620379fc69f80c0242105ddffd7d98d5d9d |
| SHA256 | 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7 |
| SHA512 | 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82 |
memory/2688-172-0x0000025957D20000-0x0000025957D30000-memory.dmp
memory/2688-173-0x000002593E110000-0x000002593E120000-memory.dmp
memory/2688-175-0x000002593E110000-0x000002593E120000-memory.dmp
memory/2688-174-0x000002593E110000-0x000002593E120000-memory.dmp
memory/2688-176-0x0000025957D20000-0x0000025957D30000-memory.dmp
memory/2688-177-0x0000025957D20000-0x0000025957D30000-memory.dmp
memory/2688-178-0x0000000000EC0000-0x0000000005958000-memory.dmp
memory/2688-179-0x0000025957D20000-0x0000025957D30000-memory.dmp
memory/2688-180-0x0000025957D20000-0x0000025957D30000-memory.dmp
memory/2688-181-0x000002595BD30000-0x000002595BE30000-memory.dmp
memory/2688-182-0x0000025957D20000-0x0000025957D30000-memory.dmp
memory/2688-183-0x000002595C360000-0x000002595C361000-memory.dmp
memory/2688-184-0x0000025957D20000-0x0000025957D30000-memory.dmp
memory/2688-185-0x0000000000EC0000-0x0000000005958000-memory.dmp
memory/2688-187-0x000002595BD30000-0x000002595BE30000-memory.dmp
memory/2688-186-0x0000000000EC0000-0x0000000005958000-memory.dmp