Analysis
-
max time kernel
122s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system -
submitted
04-02-2024 07:27
Behavioral task
behavioral1
Sample
vexxo_spooferV2.0.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
vexxo_spooferV2.0.exe
Resource
win10v2004-20231215-en
Behavioral task
behavioral3
Sample
main.pyc
Resource
win7-20231215-en
Behavioral task
behavioral4
Sample
main.pyc
Resource
win10v2004-20231215-en
General
-
Target
vexxo_spooferV2.0.exe
-
Size
20.6MB
-
MD5
9914bb3dc0da7d27b98d17d3870cf55f
-
SHA1
d9640d7f83eec1678aeb9371a37fd961a3caf479
-
SHA256
43b2600177b3bc09934bd5800380b2eca62170a4a5d22a1ba77ecd002c138a58
-
SHA512
57a822adb3a12b871f0b289371dd83c7f611d57ee1fc16f6bc713ec82c4bdee6f94f09fa86fecd7a3a71bdcd979fafb3d6bf0839195ff23ad60bb78d645224b2
-
SSDEEP
393216:GqPnLFXlrlSeqzbQpDOETgsvfGFwdKg02mvE4/RAkypm:rPLFXNhabQoEk1Gpm
Malware Config
Signatures
-
Loads dropped DLL 1 IoCs
pid Process 952 vexxo_spooferV2.0.exe -
resource yara_rule behavioral1/files/0x0005000000019a7d-128.dat upx -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 2988 wrote to memory of 952 2988 vexxo_spooferV2.0.exe 28 PID 2988 wrote to memory of 952 2988 vexxo_spooferV2.0.exe 28 PID 2988 wrote to memory of 952 2988 vexxo_spooferV2.0.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\vexxo_spooferV2.0.exe"C:\Users\Admin\AppData\Local\Temp\vexxo_spooferV2.0.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2988 -
C:\Users\Admin\AppData\Local\Temp\vexxo_spooferV2.0.exe"C:\Users\Admin\AppData\Local\Temp\vexxo_spooferV2.0.exe"2⤵
- Loads dropped DLL
PID:952
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.4MB
MD569d4f13fbaeee9b551c2d9a4a94d4458
SHA169540d8dfc0ee299a7ff6585018c7db0662aa629
SHA256801317463bd116e603878c7c106093ba7db2bece11e691793e93065223fc7046
SHA5128e632f141daf44bc470f8ee677c6f0fdcbcacbfce1472d928576bf7b9f91d6b76639d18e386d5e1c97e538a8fe19dd2d22ea47ae1acf138a0925e3c6dd156378
-
Filesize
4B
MD5365c9bfeb7d89244f2ce01c1de44cb85
SHA1d7a03141d5d6b1e88b6b59ef08b6681df212c599
SHA256ceebae7b8927a3227e5303cf5e0f1f7b34bb542ad7250ac03fbcde36ec2f1508
SHA512d220d322a4053d84130567d626a9f7bb2fb8f0b854da1621f001826dc61b0ed6d3f91793627e6f0ac2ac27aea2b986b6a7a63427f05fe004d8a2adfbdadc13c1