Analysis

  • max time kernel
    301s
  • max time network
    324s
  • platform
    windows7_x64
  • resource
    win7-20230831-en
  • resource tags

    arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
  • submitted
    07/10/2023, 11:23

Errors

Reason
Machine shutdown

General

  • Target

    sigma/CheatoSpoofer.exe

  • Size

    31.7MB

  • MD5

    e089f7eb07b684126ffa1d105d675f4e

  • SHA1

    688c59394b08c11f42f0d91a7c21d46cf4173d97

  • SHA256

    c5a5752a69f7b8c3e6b0ef34befb3baa0ee237eec74de7f9c6eba42e19850b18

  • SHA512

    b4a44cf5d100700d5a302d3873c0781b82420df0817f94a2dca20eabe945197e5ed3c47a8e9b42cee4fdb8b80efd656b4b17c81cd121ac8368843ceb0a74ccf7

  • SSDEEP

    786432:AF6hldW39X3/s+3/Du5n10x5v2LawEYcnd:lrCRvLbu7AfhYcd

Score
7/10

Malware Config

Signatures

  • Loads dropped DLL 1 IoCs
  • Obfuscated with Agile.Net obfuscator 13 IoCs

    Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.

  • Suspicious use of NtSetInformationThreadHideFromDebugger 4 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 5 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\sigma\CheatoSpoofer.exe
    "C:\Users\Admin\AppData\Local\Temp\sigma\CheatoSpoofer.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    PID:2456
  • C:\Windows\system32\LogonUI.exe
    "LogonUI.exe" /flags:0x0
    1⤵
      PID:1088
    • C:\Windows\system32\AUDIODG.EXE
      C:\Windows\system32\AUDIODG.EXE 0xc4
      1⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:1764
    • C:\Windows\system32\LogonUI.exe
      "LogonUI.exe" /flags:0x1
      1⤵
        PID:1960

      Network

      MITRE ATT&CK Matrix

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • \Users\Admin\AppData\Local\Temp\Costura\1E86214F0E241413D5D58494E90760E9\64\user64.dll

        Filesize

        226KB

        MD5

        519f34494d7484d85ecfad85f23bac05

        SHA1

        8f1be6ce8501ca1def6d02fde760d48169677bc5

        SHA256

        1f7a51dd23092e70b8e323c86229de242568ffc7d27271aaf88d051662ba32f9

        SHA512

        d9e34321e6d32c5da664200bb5609bb2d19fcd44d36f8109e7ad2e44b5dbf1cb46e3d5b8c529d90f051e6f4cc2891301f213c9d3faac8fc4a0f3b0b8d9a3f81b

      • memory/1088-67-0x00000000029C0000-0x00000000029C1000-memory.dmp

        Filesize

        4KB

      • memory/1960-68-0x0000000002820000-0x0000000002821000-memory.dmp

        Filesize

        4KB

      • memory/2456-0-0x000007FFFFBD0000-0x000007FFFFFA1000-memory.dmp

        Filesize

        3.8MB

      • memory/2456-1-0x0000000000EA0000-0x0000000005854000-memory.dmp

        Filesize

        73.7MB

      • memory/2456-2-0x0000000000EA0000-0x0000000005854000-memory.dmp

        Filesize

        73.7MB

      • memory/2456-3-0x0000000077700000-0x0000000077710000-memory.dmp

        Filesize

        64KB

      • memory/2456-4-0x000007FEF5960000-0x000007FEF634C000-memory.dmp

        Filesize

        9.9MB

      • memory/2456-5-0x0000000000EA0000-0x0000000005854000-memory.dmp

        Filesize

        73.7MB

      • memory/2456-6-0x0000000000EA0000-0x0000000005854000-memory.dmp

        Filesize

        73.7MB

      • memory/2456-7-0x0000000000EA0000-0x0000000005854000-memory.dmp

        Filesize

        73.7MB

      • memory/2456-8-0x000007FFFFBD0000-0x000007FFFFFA1000-memory.dmp

        Filesize

        3.8MB

      • memory/2456-9-0x000007FEF5960000-0x000007FEF634C000-memory.dmp

        Filesize

        9.9MB

      • memory/2456-10-0x0000000000EA0000-0x0000000005854000-memory.dmp

        Filesize

        73.7MB

      • memory/2456-11-0x0000000000EA0000-0x0000000005854000-memory.dmp

        Filesize

        73.7MB

      • memory/2456-12-0x0000000000EA0000-0x0000000005854000-memory.dmp

        Filesize

        73.7MB

      • memory/2456-13-0x0000000024160000-0x00000000241E0000-memory.dmp

        Filesize

        512KB

      • memory/2456-14-0x0000000024160000-0x00000000241E0000-memory.dmp

        Filesize

        512KB

      • memory/2456-15-0x0000000024160000-0x00000000241E0000-memory.dmp

        Filesize

        512KB

      • memory/2456-16-0x0000000000EA0000-0x0000000005854000-memory.dmp

        Filesize

        73.7MB

      • memory/2456-17-0x0000000024160000-0x00000000241E0000-memory.dmp

        Filesize

        512KB

      • memory/2456-18-0x0000000000EA0000-0x0000000005854000-memory.dmp

        Filesize

        73.7MB

      • memory/2456-19-0x0000000024160000-0x00000000241E0000-memory.dmp

        Filesize

        512KB

      • memory/2456-20-0x0000000024160000-0x00000000241E0000-memory.dmp

        Filesize

        512KB

      • memory/2456-21-0x0000000006ED0000-0x0000000006F0E000-memory.dmp

        Filesize

        248KB

      • memory/2456-26-0x00000000082B0000-0x00000000082E8000-memory.dmp

        Filesize

        224KB

      • memory/2456-27-0x00000000090C0000-0x0000000009154000-memory.dmp

        Filesize

        592KB

      • memory/2456-28-0x0000000006F30000-0x0000000006F38000-memory.dmp

        Filesize

        32KB

      • memory/2456-29-0x0000000008320000-0x0000000008328000-memory.dmp

        Filesize

        32KB

      • memory/2456-30-0x0000000007ED0000-0x0000000007ED8000-memory.dmp

        Filesize

        32KB

      • memory/2456-31-0x00000000082F0000-0x00000000082FA000-memory.dmp

        Filesize

        40KB

      • memory/2456-32-0x0000000008310000-0x0000000008318000-memory.dmp

        Filesize

        32KB

      • memory/2456-33-0x0000000008330000-0x000000000833A000-memory.dmp

        Filesize

        40KB

      • memory/2456-34-0x0000000000EA0000-0x0000000005854000-memory.dmp

        Filesize

        73.7MB

      • memory/2456-36-0x0000000009150000-0x0000000009176000-memory.dmp

        Filesize

        152KB

      • memory/2456-35-0x0000000008340000-0x0000000008354000-memory.dmp

        Filesize

        80KB

      • memory/2456-38-0x0000000008760000-0x0000000008768000-memory.dmp

        Filesize

        32KB

      • memory/2456-37-0x0000000008750000-0x0000000008758000-memory.dmp

        Filesize

        32KB

      • memory/2456-40-0x0000000008B70000-0x0000000008B94000-memory.dmp

        Filesize

        144KB

      • memory/2456-41-0x00000000099C0000-0x0000000009A1A000-memory.dmp

        Filesize

        360KB

      • memory/2456-42-0x0000000008B90000-0x0000000008B9C000-memory.dmp

        Filesize

        48KB

      • memory/2456-43-0x0000000008BA0000-0x0000000008BB4000-memory.dmp

        Filesize

        80KB

      • memory/2456-44-0x0000000029FA0000-0x000000002A282000-memory.dmp

        Filesize

        2.9MB

      • memory/2456-45-0x0000000009F40000-0x0000000009F88000-memory.dmp

        Filesize

        288KB

      • memory/2456-46-0x0000000022D40000-0x0000000022DF2000-memory.dmp

        Filesize

        712KB

      • memory/2456-48-0x000000000A130000-0x000000000A14A000-memory.dmp

        Filesize

        104KB

      • memory/2456-47-0x0000000009A20000-0x0000000009A2E000-memory.dmp

        Filesize

        56KB

      • memory/2456-49-0x000000000A150000-0x000000000A16A000-memory.dmp

        Filesize

        104KB

      • memory/2456-50-0x0000000024160000-0x00000000241E0000-memory.dmp

        Filesize

        512KB

      • memory/2456-51-0x0000000000EA0000-0x0000000005854000-memory.dmp

        Filesize

        73.7MB

      • memory/2456-52-0x000000000A180000-0x000000000A19C000-memory.dmp

        Filesize

        112KB

      • memory/2456-53-0x00000000240F0000-0x0000000024138000-memory.dmp

        Filesize

        288KB

      • memory/2456-54-0x000000000A1A0000-0x000000000A1A8000-memory.dmp

        Filesize

        32KB

      • memory/2456-55-0x0000000026580000-0x0000000026626000-memory.dmp

        Filesize

        664KB

      • memory/2456-56-0x00000000241E0000-0x0000000024214000-memory.dmp

        Filesize

        208KB

      • memory/2456-57-0x0000000024A20000-0x0000000024A6A000-memory.dmp

        Filesize

        296KB

      • memory/2456-58-0x0000000024140000-0x0000000024156000-memory.dmp

        Filesize

        88KB

      • memory/2456-59-0x0000000024B00000-0x0000000024B32000-memory.dmp

        Filesize

        200KB

      • memory/2456-60-0x0000000026E30000-0x0000000026EA6000-memory.dmp

        Filesize

        472KB

      • memory/2456-61-0x0000000025440000-0x0000000025458000-memory.dmp

        Filesize

        96KB

      • memory/2456-62-0x0000000025460000-0x0000000025492000-memory.dmp

        Filesize

        200KB

      • memory/2456-63-0x00000000276F0000-0x00000000276F8000-memory.dmp

        Filesize

        32KB

      • memory/2456-64-0x000000000A1B0000-0x000000000A1BA000-memory.dmp

        Filesize

        40KB

      • memory/2456-65-0x0000000000EA0000-0x0000000005854000-memory.dmp

        Filesize

        73.7MB

      • memory/2456-66-0x000007FEF5960000-0x000007FEF634C000-memory.dmp

        Filesize

        9.9MB