36bc30177e29b9a1a440df85c764d0fa6c9e5c7ff6119ff41a05fadee36f0b82

Submit
Reports

Overview

overview

Static

static

SpyNote_v6...pi.dll

windows10-2004-x64

SpyNote_v6...6.html

windows10-2004-x64

SpyNote_v6...2.html

windows10-2004-x64

SpyNote_v6...9.html

windows10-2004-x64

SpyNote_v6...SM.dll

windows10-2004-x64

SpyNote_v6...SL.exe

windows10-2004-x64

apktool/apktool.bat

windows10-2004-x64

apktool/apktool.jar

windows10-2004-x64

apktool/signapk.jar

windows10-2004-x64

SpyNote_v6...ub.apk

windows10-2004-x64

SpyNote_v6...va.jar

windows10-2004-x64

SpyNote_v6...sS.exe

windows10-2004-x64

platform-t...pi.dll

windows10-2004-x64

platform-t...pi.dll

windows10-2004-x64

platform-t...db.exe

windows10-2004-x64

platform-t...mp.exe

windows10-2004-x64

platform-t...ol.exe

windows10-2004-x64

platform-t...ot.exe

windows10-2004-x64

platform-t...nv.exe

windows10-2004-x64

platform-t...c++.so

windows10-2004-x64

platform-t...-1.dll

windows10-2004-x64

platform-t...fs.exe

windows10-2004-x64

platform-t...fs.exe

windows10-2004-x64

platform-t...e3.exe

windows10-2004-x64

platform-t...t__.py

windows10-2004-x64

platform-t...ror.py

windows10-2004-x64

platform-t...per.py

windows10-2004-x64

platform-t...est.py

windows10-2004-x64

platform-t...est.py

windows10-2004-x64

platform-t..._tests

windows10-2004-x64

SpyNote_v6...in.exe

windows10-2004-x64

SpyNote_v6...te.exe

windows10-2004-x64

Analysis

max time kernel
106s
max time network
100s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
15-05-2024 13:08

Sharing

Copy URL

Twitter E-mail

Static task

static1

spynote

6 signatures

Behavioral task

behavioral1

Sample

SpyNote_v6.4/CoreAudioApi.dll

Resource

win10v2004-20240508-en

windows10-2004-x64

0 signatures

150 seconds

Behavioral task

behavioral2

Sample

SpyNote_v6.4/Resources/Clients/KingB_354051091211537/Settings/2021-11-9--11-07-16.html

Resource

win10v2004-20240426-en

windows10-2004-x64

6 signatures

150 seconds

Behavioral task

behavioral3

Sample

SpyNote_v6.4/Resources/Clients/Vicitim_354051091211537/Apps/2021-27-9--17-10-52.html

Resource

win10v2004-20240426-en

windows10-2004-x64

6 signatures

150 seconds

Behavioral task

behavioral4

Sample

SpyNote_v6.4/Resources/Clients/Vicitim_354051091211537/Settings/2021-27-9--17-12-59.html

Resource

win10v2004-20240508-en

windows10-2004-x64

6 signatures

150 seconds

Behavioral task

behavioral5

Sample

SpyNote_v6.4/Resources/Imports/Gsm/GSM.dll

Resource

win10v2004-20240426-en

windows10-2004-x64

0 signatures

150 seconds

Behavioral task

behavioral6

Sample

SpyNote_v6.4/Resources/Imports/Payload/SL.exe

Resource

win10v2004-20240226-en

windows10-2004-x64

0 signatures

150 seconds

Behavioral task

behavioral7

Sample

apktool/apktool.bat

Resource

win10v2004-20240426-en

discovery

windows10-2004-x64

2 signatures

150 seconds

Behavioral task

behavioral8

Sample

apktool/apktool.jar

Resource

win10v2004-20240508-en

discovery

windows10-2004-x64

2 signatures

150 seconds

Behavioral task

behavioral9

Sample

apktool/signapk.jar

Resource

win10v2004-20240426-en

discovery

windows10-2004-x64

2 signatures

150 seconds

Behavioral task

behavioral10

Sample

SpyNote_v6.4/Resources/Imports/Payload/stub.apk

Resource

win10v2004-20240426-en

windows10-2004-x64

3 signatures

150 seconds

Behavioral task

behavioral11

Sample

SpyNote_v6.4/Resources/Imports/PlayerJava/PlayerJava.jar

Resource

win10v2004-20240426-en

discovery

windows10-2004-x64

2 signatures

150 seconds

Behavioral task

behavioral12

Sample

SpyNote_v6.4/Resources/Imports/T/sS.exe

Resource

win10v2004-20240508-en

windows10-2004-x64

0 signatures

150 seconds

Behavioral task

behavioral13

Sample

platform-tools/AdbWinApi.dll

Resource

win10v2004-20240508-en

windows10-2004-x64

2 signatures

150 seconds

Behavioral task

behavioral14

Sample

platform-tools/AdbWinUsbApi.dll

Resource

win10v2004-20240508-en

windows10-2004-x64

2 signatures

150 seconds

Behavioral task

behavioral15

Sample

platform-tools/adb.exe

Resource

win10v2004-20240508-en

windows10-2004-x64

0 signatures

150 seconds

Behavioral task

behavioral16

Sample

platform-tools/dmtracedump.exe

Resource

win10v2004-20240508-en

windows10-2004-x64

0 signatures

150 seconds

Behavioral task

behavioral17

Sample

platform-tools/etc1tool.exe

Resource

win10v2004-20240426-en

windows10-2004-x64

0 signatures

150 seconds

Behavioral task

behavioral18

Sample

platform-tools/fastboot.exe

Resource

win10v2004-20240426-en

windows10-2004-x64

0 signatures

150 seconds

Behavioral task

behavioral19

Sample

platform-tools/hprof-conv.exe

Resource

win10v2004-20240226-en

windows10-2004-x64

0 signatures

150 seconds

Behavioral task

behavioral20

Sample

platform-tools/lib64/libc++.so

Resource

win10v2004-20240508-en

windows10-2004-x64

3 signatures

150 seconds

Behavioral task

behavioral21

Sample

platform-tools/libwinpthread-1.dll

Resource

win10v2004-20240426-en

windows10-2004-x64

1 signatures

150 seconds

Behavioral task

behavioral22

Sample

platform-tools/make_f2fs.exe

Resource

win10v2004-20240426-en

windows10-2004-x64

0 signatures

150 seconds

Behavioral task

behavioral23

Sample

platform-tools/mke2fs.exe

Resource

win10v2004-20240508-en

windows10-2004-x64

0 signatures

150 seconds

Behavioral task

behavioral24

Sample

platform-tools/sqlite3.exe

Resource

win10v2004-20240426-en

windows10-2004-x64

0 signatures

150 seconds

Behavioral task

behavioral25

Sample

platform-tools/systrace/catapult/common/battor/battor/__init__.py

Resource

win10v2004-20240508-en

windows10-2004-x64

3 signatures

150 seconds

Behavioral task

behavioral26

Sample

platform-tools/systrace/catapult/common/battor/battor/battor_error.py

Resource

win10v2004-20240508-en

windows10-2004-x64

3 signatures

150 seconds

Behavioral task

behavioral27

Sample

platform-tools/systrace/catapult/common/battor/battor/battor_wrapper.py

Resource

win10v2004-20240508-en

windows10-2004-x64

3 signatures

150 seconds

Behavioral task

behavioral28

Sample

platform-tools/systrace/catapult/common/battor/battor/battor_wrapper_devicetest.py

Resource

win10v2004-20240508-en

windows10-2004-x64

3 signatures

150 seconds

Behavioral task

behavioral29

Sample

platform-tools/systrace/catapult/common/battor/battor/battor_wrapper_unittest.py

Resource

win10v2004-20240426-en

windows10-2004-x64

3 signatures

150 seconds

Behavioral task

behavioral30

Sample

platform-tools/systrace/catapult/common/battor/bin/run_py_tests

Resource

win10v2004-20240426-en

windows10-2004-x64

0 signatures

150 seconds

Behavioral task

behavioral31

Sample

SpyNote_v6.4/Resources/Imports/platform-tools/plwin.exe

Resource

win10v2004-20240426-en

windows10-2004-x64

0 signatures

150 seconds

Behavioral task

behavioral32

Sample

SpyNote_v6.4/SpyNote.exe

Resource

win10v2004-20240226-en

windows10-2004-x64

3 signatures

150 seconds

Report Analysis Logs

General

Target

platform-tools/AdbWinUsbApi.dll
Size

61KB
MD5

0e24119daf1909e398fa1850b6112077
SHA1

293eedadb3172e756a421790d551e407457e0a8c
SHA256

25207c506d29c4e8dceb61b4bd50e8669ba26012988a43fbf26a890b1e60fc97
SHA512

9cbb26e555ab40b019a446337db58770b9a0c9c08316ff1e1909c4b6d99c00bd33522d05890870a91b4b581e20c7dce87488ab0d22fc3c4bbdd7e9b38f164b43
SSDEEP

1536:l72doFmOiHizFbPlspcsbj5ZsP+YeTs1p:lSSfN9+YeTs1p

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1268 1592 WerFault.exe rundll32.exe

pid	pid_target	process	target process
1268	1592	WerFault.exe	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 3572 wrote to memory of 1592	3572	rundll32.exe	rundll32.exe
PID 3572 wrote to memory of 1592	3572	rundll32.exe	rundll32.exe
PID 3572 wrote to memory of 1592	3572	rundll32.exe	rundll32.exe

Processes

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\platform-tools\AdbWinUsbApi.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3572

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\platform-tools\AdbWinUsbApi.dll,#1
2⤵
PID:1592

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1592 -s 616
3⤵
- Program crash
PID:1268

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 1592 -ip 1592
1⤵
PID:1136

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads