Overview
overview
10Static
static
10SpyNote_By...er.exe
windows7-x64
3SpyNote_By...er.exe
windows10-2004-x64
3SpyNote_By...pi.dll
windows7-x64
1SpyNote_By...pi.dll
windows10-2004-x64
1SpyNote_By...io.dll
windows7-x64
1SpyNote_By...io.dll
windows10-2004-x64
1SpyNote_By...SM.dll
windows7-x64
1SpyNote_By...SM.dll
windows10-2004-x64
1SpyNote_By...nt.exe
windows7-x64
1SpyNote_By...nt.exe
windows10-2004-x64
1SpyNote_By...va.jar
windows7-x64
1SpyNote_By...va.jar
windows10-2004-x64
7SpyNote_By...sS.exe
windows7-x64
1SpyNote_By...sS.exe
windows10-2004-x64
1SpyNote_By...in.exe
windows7-x64
1SpyNote_By...in.exe
windows10-2004-x64
1Analysis
-
max time kernel
150s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
14-03-2024 15:41
Behavioral task
behavioral1
Sample
SpyNote_By 30Deep/Android Tester.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
SpyNote_By 30Deep/Android Tester.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral3
Sample
SpyNote_By 30Deep/CoreAudioApi.dll
Resource
win7-20240221-en
Behavioral task
behavioral4
Sample
SpyNote_By 30Deep/CoreAudioApi.dll
Resource
win10v2004-20240226-en
Behavioral task
behavioral5
Sample
SpyNote_By 30Deep/NAudio.dll
Resource
win7-20240221-en
Behavioral task
behavioral6
Sample
SpyNote_By 30Deep/NAudio.dll
Resource
win10v2004-20240226-en
Behavioral task
behavioral7
Sample
SpyNote_By 30Deep/Resources/Imports/Gsm/GSM.dll
Resource
win7-20240221-en
Behavioral task
behavioral8
Sample
SpyNote_By 30Deep/Resources/Imports/Gsm/GSM.dll
Resource
win10v2004-20240226-en
Behavioral task
behavioral9
Sample
SpyNote_By 30Deep/Resources/Imports/Payload/BuildClient.exe
Resource
win7-20240221-en
Behavioral task
behavioral10
Sample
SpyNote_By 30Deep/Resources/Imports/Payload/BuildClient.exe
Resource
win10v2004-20231215-en
Behavioral task
behavioral11
Sample
SpyNote_By 30Deep/Resources/Imports/PlayerJava/PlayerJava.jar
Resource
win7-20240221-en
Behavioral task
behavioral12
Sample
SpyNote_By 30Deep/Resources/Imports/PlayerJava/PlayerJava.jar
Resource
win10v2004-20240226-en
Behavioral task
behavioral13
Sample
SpyNote_By 30Deep/Resources/Imports/T/sS.exe
Resource
win7-20240215-en
Behavioral task
behavioral14
Sample
SpyNote_By 30Deep/Resources/Imports/T/sS.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral15
Sample
SpyNote_By 30Deep/Resources/Imports/platform-tools/plwin.exe
Resource
win7-20240221-en
Behavioral task
behavioral16
Sample
SpyNote_By 30Deep/Resources/Imports/platform-tools/plwin.exe
Resource
win10v2004-20240226-en
General
-
Target
SpyNote_By 30Deep/Android Tester.exe
-
Size
1.2MB
-
MD5
b4011069f308adfd9aaf162a048af52a
-
SHA1
5bd8e0a87315fae31a00c686117fa9e68cf68028
-
SHA256
5a43db2cdbafc97ffaa72c5dfc8c806c03fe48205c2f1924e9fddc64e94a6a6f
-
SHA512
cde1f70a991d17cd284b40e34a45044104856672d0bed5b0d3da08271ec854d4669bf7e8289d8c9a1e94be485b424ba5c7752bd40d7b286453619897f3e5ab5b
-
SSDEEP
24576:O3cM3co+GmVct8O2rKRZE+qR9O08k8sVW40PyQ:O3cM3cLoRZENLr
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
Android Tester.exedescription ioc process Key opened \Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0 Android Tester.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz Android Tester.exe -
Processes:
Android Tester.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-513485977-2495024337-1260977654-1000\Software\Microsoft\Internet Explorer\TypedURLs Android Tester.exe -
Modifies registry class 1 IoCs
Processes:
Android Tester.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-513485977-2495024337-1260977654-1000_Classes\Local Settings Android Tester.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
Android Tester.exepid process 1240 Android Tester.exe 1240 Android Tester.exe 1240 Android Tester.exe 1240 Android Tester.exe 1240 Android Tester.exe 1240 Android Tester.exe 1240 Android Tester.exe 1240 Android Tester.exe 1240 Android Tester.exe 1240 Android Tester.exe 1240 Android Tester.exe 1240 Android Tester.exe 1240 Android Tester.exe 1240 Android Tester.exe 1240 Android Tester.exe 1240 Android Tester.exe 1240 Android Tester.exe 1240 Android Tester.exe 1240 Android Tester.exe 1240 Android Tester.exe 1240 Android Tester.exe 1240 Android Tester.exe 1240 Android Tester.exe 1240 Android Tester.exe 1240 Android Tester.exe 1240 Android Tester.exe 1240 Android Tester.exe 1240 Android Tester.exe 1240 Android Tester.exe 1240 Android Tester.exe 1240 Android Tester.exe 1240 Android Tester.exe 1240 Android Tester.exe 1240 Android Tester.exe 1240 Android Tester.exe 1240 Android Tester.exe 1240 Android Tester.exe 1240 Android Tester.exe 1240 Android Tester.exe 1240 Android Tester.exe 1240 Android Tester.exe 1240 Android Tester.exe 1240 Android Tester.exe 1240 Android Tester.exe 1240 Android Tester.exe 1240 Android Tester.exe 1240 Android Tester.exe 1240 Android Tester.exe 1240 Android Tester.exe 1240 Android Tester.exe 1240 Android Tester.exe 1240 Android Tester.exe 1240 Android Tester.exe 1240 Android Tester.exe 1240 Android Tester.exe 1240 Android Tester.exe 1240 Android Tester.exe 1240 Android Tester.exe 1240 Android Tester.exe 1240 Android Tester.exe 1240 Android Tester.exe 1240 Android Tester.exe 1240 Android Tester.exe 1240 Android Tester.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
Android Tester.exedescription pid process Token: SeDebugPrivilege 1240 Android Tester.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\SpyNote_By 30Deep\Android Tester.exe"C:\Users\Admin\AppData\Local\Temp\SpyNote_By 30Deep\Android Tester.exe"1⤵
- Checks processor information in registry
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1240
-
C:\Windows\system32\wbem\WmiApSrv.exeC:\Windows\system32\wbem\WmiApSrv.exe1⤵PID:3964
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵PID:3080
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1240-1-0x0000000074940000-0x00000000750F0000-memory.dmpFilesize
7.7MB
-
memory/1240-0-0x00000000004F0000-0x0000000000634000-memory.dmpFilesize
1.3MB
-
memory/1240-2-0x0000000005090000-0x000000000512C000-memory.dmpFilesize
624KB
-
memory/1240-3-0x00000000056E0000-0x0000000005C84000-memory.dmpFilesize
5.6MB
-
memory/1240-4-0x0000000005130000-0x00000000051C2000-memory.dmpFilesize
584KB
-
memory/1240-5-0x00000000053A0000-0x00000000053B0000-memory.dmpFilesize
64KB
-
memory/1240-6-0x0000000005030000-0x000000000503A000-memory.dmpFilesize
40KB
-
memory/1240-7-0x0000000005230000-0x0000000005286000-memory.dmpFilesize
344KB
-
memory/1240-8-0x00000000053A0000-0x00000000053B0000-memory.dmpFilesize
64KB
-
memory/1240-9-0x00000000053A0000-0x00000000053B0000-memory.dmpFilesize
64KB
-
memory/1240-10-0x0000000074940000-0x00000000750F0000-memory.dmpFilesize
7.7MB
-
memory/1240-11-0x00000000053A0000-0x00000000053B0000-memory.dmpFilesize
64KB
-
memory/1240-12-0x00000000053A0000-0x00000000053B0000-memory.dmpFilesize
64KB
-
memory/1240-13-0x00000000053A0000-0x00000000053B0000-memory.dmpFilesize
64KB