Overview
overview
9Static
static
7Impact Spo...er.exe
windows10-1703-x64
9Impact Spo...40.dll
windows10-1703-x64
1Impact Spo...40.dll
windows10-1703-x64
1Impact Spo..._1.dll
windows10-1703-x64
1Impact Spo...er.bat
windows10-1703-x64
1Impact Spo...ed.exe
windows10-1703-x64
7x64/Beamer x64.exe
windows10-1703-x64
1x64/Device...er.dll
windows10-1703-x64
1x64/GleeBu...ne.dll
windows10-1703-x64
1x64/LLVMDemangle.dll
windows10-1703-x64
1x64/Qt5Core.dll
windows10-1703-x64
1x64/Qt5Gui.dll
windows10-1703-x64
1x64/Qt5Network.dll
windows10-1703-x64
1x64/Qt5Svg.dll
windows10-1703-x64
1x64/Qt5Widgets.dll
windows10-1703-x64
1x64/Qt5WinExtras.dll
windows10-1703-x64
1x64/Scylla.dll
windows10-1703-x64
1x64/Static...ne.dll
windows10-1703-x64
1x64/TitanEngine.dll
windows10-1703-x64
1x64/XEDParse.dll
windows10-1703-x64
1x64/asmjit.dll
windows10-1703-x64
1x64/dbghelp.dll
windows10-1703-x64
1x64/iconen...on.dll
windows10-1703-x64
1x64/imagef...if.dll
windows10-1703-x64
1x64/imagef...ns.dll
windows10-1703-x64
1x64/imagef...co.dll
windows10-1703-x64
1x64/imagef...eg.dll
windows10-1703-x64
1x64/imagef...vg.dll
windows10-1703-x64
1x64/imagef...ga.dll
windows10-1703-x64
1x64/imagef...ff.dll
windows10-1703-x64
1x64/imagef...mp.dll
windows10-1703-x64
1x64/imagef...bp.dll
windows10-1703-x64
1Analysis
-
max time kernel
141s -
max time network
137s -
platform
windows10-1703_x64 -
resource
win10-20240404-en -
resource tags
arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system -
submitted
24-04-2024 20:39
Behavioral task
behavioral1
Sample
Impact Spoofer/Apple_Cleaner.exe
Resource
win10-20240404-en
Behavioral task
behavioral2
Sample
Impact Spoofer/Fixer/Dll/msvcp140.dll
Resource
win10-20240404-en
Behavioral task
behavioral3
Sample
Impact Spoofer/Fixer/Dll/vcruntime140.dll
Resource
win10-20240404-en
Behavioral task
behavioral4
Sample
Impact Spoofer/Fixer/Dll/vcruntime140_1.dll
Resource
win10-20240404-en
Behavioral task
behavioral5
Sample
Impact Spoofer/Fixer/MAC Changer.bat
Resource
win10-20240404-en
Behavioral task
behavioral6
Sample
Impact Spoofer/Impact_fixed.exe
Resource
win10-20240404-en
Behavioral task
behavioral7
Sample
x64/Beamer x64.exe
Resource
win10-20240404-en
Behavioral task
behavioral8
Sample
x64/DeviceNameResolver.dll
Resource
win10-20240404-en
Behavioral task
behavioral9
Sample
x64/GleeBug/TitanEngine.dll
Resource
win10-20240404-en
Behavioral task
behavioral10
Sample
x64/LLVMDemangle.dll
Resource
win10-20240404-en
Behavioral task
behavioral11
Sample
x64/Qt5Core.dll
Resource
win10-20240404-en
Behavioral task
behavioral12
Sample
x64/Qt5Gui.dll
Resource
win10-20240404-en
Behavioral task
behavioral13
Sample
x64/Qt5Network.dll
Resource
win10-20240404-en
Behavioral task
behavioral14
Sample
x64/Qt5Svg.dll
Resource
win10-20240404-en
Behavioral task
behavioral15
Sample
x64/Qt5Widgets.dll
Resource
win10-20240404-en
Behavioral task
behavioral16
Sample
x64/Qt5WinExtras.dll
Resource
win10-20240404-en
Behavioral task
behavioral17
Sample
x64/Scylla.dll
Resource
win10-20240404-en
Behavioral task
behavioral18
Sample
x64/StaticEngine/TitanEngine.dll
Resource
win10-20240404-en
Behavioral task
behavioral19
Sample
x64/TitanEngine.dll
Resource
win10-20240404-en
Behavioral task
behavioral20
Sample
x64/XEDParse.dll
Resource
win10-20240404-en
Behavioral task
behavioral21
Sample
x64/asmjit.dll
Resource
win10-20240404-en
Behavioral task
behavioral22
Sample
x64/dbghelp.dll
Resource
win10-20240404-en
Behavioral task
behavioral23
Sample
x64/iconengines/qsvgicon.dll
Resource
win10-20240404-en
Behavioral task
behavioral24
Sample
x64/imageformats/qgif.dll
Resource
win10-20240404-en
Behavioral task
behavioral25
Sample
x64/imageformats/qicns.dll
Resource
win10-20240404-en
Behavioral task
behavioral26
Sample
x64/imageformats/qico.dll
Resource
win10-20240404-en
Behavioral task
behavioral27
Sample
x64/imageformats/qjpeg.dll
Resource
win10-20240404-en
Behavioral task
behavioral28
Sample
x64/imageformats/qsvg.dll
Resource
win10-20240404-en
Behavioral task
behavioral29
Sample
x64/imageformats/qtga.dll
Resource
win10-20240404-en
Behavioral task
behavioral30
Sample
x64/imageformats/qtiff.dll
Resource
win10-20240404-en
Behavioral task
behavioral31
Sample
x64/imageformats/qwbmp.dll
Resource
win10-20240404-en
Behavioral task
behavioral32
Sample
x64/imageformats/qwebp.dll
Resource
win10-20240404-en
General
-
Target
Impact Spoofer/Apple_Cleaner.exe
-
Size
3.3MB
-
MD5
ba268b881bccd2784fe98289eec8ad72
-
SHA1
0c4e7f1473fb7ab22427480c3d784b6e0e404956
-
SHA256
c83921c8dda800ef24ebe873ec175617110dc9deb2629d1107f219ca30caece3
-
SHA512
30c836bb91ef96f5952571bba27d08c32011e619890fae392f882e5c7db7558ed26e6aa1fbdc2ce7d22c0a6aebc580e17ae807de70d99945cb2b438bd8cbbb3b
-
SSDEEP
49152:98jzvhuGMsOTenal2tV594MzhJD3TMgwQiPRxksa2EQUFO0JIbn6/ubWYY725hXQ:9QFXlbnal2XDhZRwRVsE0JDoWYJPXLk
Malware Config
Signatures
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
Processes:
Apple_Cleaner.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ Apple_Cleaner.exe -
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
Processes:
Apple_Cleaner.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion Apple_Cleaner.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion Apple_Cleaner.exe -
Processes:
resource yara_rule behavioral1/memory/4044-0-0x00007FF65FC50000-0x00007FF660573000-memory.dmp themida behavioral1/memory/4044-2-0x00007FF65FC50000-0x00007FF660573000-memory.dmp themida behavioral1/memory/4044-3-0x00007FF65FC50000-0x00007FF660573000-memory.dmp themida behavioral1/memory/4044-4-0x00007FF65FC50000-0x00007FF660573000-memory.dmp themida behavioral1/memory/4044-5-0x00007FF65FC50000-0x00007FF660573000-memory.dmp themida behavioral1/memory/4044-6-0x00007FF65FC50000-0x00007FF660573000-memory.dmp themida behavioral1/memory/4044-7-0x00007FF65FC50000-0x00007FF660573000-memory.dmp themida -
Processes:
Apple_Cleaner.exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA Apple_Cleaner.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
Processes:
Apple_Cleaner.exepid process 4044 Apple_Cleaner.exe -
Kills process with taskkill 3 IoCs
Processes:
taskkill.exetaskkill.exetaskkill.exepid process 3356 taskkill.exe 2792 taskkill.exe 1884 taskkill.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
taskkill.exetaskkill.exetaskkill.exedescription pid process Token: SeDebugPrivilege 3356 taskkill.exe Token: SeDebugPrivilege 2792 taskkill.exe Token: SeDebugPrivilege 1884 taskkill.exe -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
Apple_Cleaner.execmd.execmd.execmd.exedescription pid process target process PID 4044 wrote to memory of 1424 4044 Apple_Cleaner.exe cmd.exe PID 4044 wrote to memory of 1424 4044 Apple_Cleaner.exe cmd.exe PID 1424 wrote to memory of 3356 1424 cmd.exe taskkill.exe PID 1424 wrote to memory of 3356 1424 cmd.exe taskkill.exe PID 4044 wrote to memory of 3876 4044 Apple_Cleaner.exe cmd.exe PID 4044 wrote to memory of 3876 4044 Apple_Cleaner.exe cmd.exe PID 3876 wrote to memory of 2792 3876 cmd.exe taskkill.exe PID 3876 wrote to memory of 2792 3876 cmd.exe taskkill.exe PID 4044 wrote to memory of 4332 4044 Apple_Cleaner.exe cmd.exe PID 4044 wrote to memory of 4332 4044 Apple_Cleaner.exe cmd.exe PID 4332 wrote to memory of 1884 4332 cmd.exe taskkill.exe PID 4332 wrote to memory of 1884 4332 cmd.exe taskkill.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Impact Spoofer\Apple_Cleaner.exe"C:\Users\Admin\AppData\Local\Temp\Impact Spoofer\Apple_Cleaner.exe"1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of WriteProcessMemory
PID:4044 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c taskkill /f /im EpicGamesLauncher.exe >nul 2>&12⤵
- Suspicious use of WriteProcessMemory
PID:1424 -
C:\Windows\system32\taskkill.exetaskkill /f /im EpicGamesLauncher.exe3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:3356 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c taskkill /f /im FortniteClient-Win64-Shipping.exe >nul 2>&12⤵
- Suspicious use of WriteProcessMemory
PID:3876 -
C:\Windows\system32\taskkill.exetaskkill /f /im FortniteClient-Win64-Shipping.exe3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2792 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c taskkill /f /im Battle.net.exe >nul 2>&12⤵
- Suspicious use of WriteProcessMemory
PID:4332 -
C:\Windows\system32\taskkill.exetaskkill /f /im Battle.net.exe3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1884
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/4044-0-0x00007FF65FC50000-0x00007FF660573000-memory.dmpFilesize
9.1MB
-
memory/4044-1-0x00007FFC7A540000-0x00007FFC7A71B000-memory.dmpFilesize
1.9MB
-
memory/4044-2-0x00007FF65FC50000-0x00007FF660573000-memory.dmpFilesize
9.1MB
-
memory/4044-3-0x00007FF65FC50000-0x00007FF660573000-memory.dmpFilesize
9.1MB
-
memory/4044-4-0x00007FF65FC50000-0x00007FF660573000-memory.dmpFilesize
9.1MB
-
memory/4044-5-0x00007FF65FC50000-0x00007FF660573000-memory.dmpFilesize
9.1MB
-
memory/4044-6-0x00007FF65FC50000-0x00007FF660573000-memory.dmpFilesize
9.1MB
-
memory/4044-7-0x00007FF65FC50000-0x00007FF660573000-memory.dmpFilesize
9.1MB
-
memory/4044-9-0x00007FFC7A540000-0x00007FFC7A71B000-memory.dmpFilesize
1.9MB