Analysis
-
max time kernel
146s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system -
submitted
25/05/2024, 16:15
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
spoof.exe
Resource
win7-20231129-en
windows7-x64
4 signatures
150 seconds
Behavioral task
behavioral2
Sample
spoof.exe
Resource
win10v2004-20240508-en
windows10-2004-x64
4 signatures
150 seconds
General
-
Target
spoof.exe
-
Size
9.9MB
-
MD5
2ee7d683165d04a622cf2452c3318c20
-
SHA1
a3b8229c2e6bddd68bc5fe20fb7521679afea88a
-
SHA256
f2cad0df5f992f1e8ff04ea15b5e0430d3a058eac1362b1e0c1b286a38cc0d05
-
SHA512
72a04bf53c8c5ae87d70f72833ec889260e78d4ebf89416f25172e8c857eb854a5713dddf61f8dd33e4e97015a237220442f4179c4fe94e15521b5eb491d583a
-
SSDEEP
196608:4HnSQ6aH3BMbOuT3gduz5NffE4y/kMDz6F5ap1V1WgTNYA3qP:4L6aH3+bRbWuVNfBy/kMDzY5a/V1Nq
Score
6/10
Malware Config
Signatures
-
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 2 api.ipify.org 5 api.ipify.org -
Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
pid Process 2548 spoof.exe 2548 spoof.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2548 spoof.exe 2548 spoof.exe 2548 spoof.exe 2548 spoof.exe 2548 spoof.exe 2548 spoof.exe 2548 spoof.exe 2548 spoof.exe 2548 spoof.exe 2548 spoof.exe 2548 spoof.exe 2548 spoof.exe 2548 spoof.exe 2548 spoof.exe 2548 spoof.exe 2548 spoof.exe 2548 spoof.exe 2548 spoof.exe 2548 spoof.exe 2548 spoof.exe 2548 spoof.exe 2548 spoof.exe 2548 spoof.exe 2548 spoof.exe 2548 spoof.exe 2548 spoof.exe 2548 spoof.exe 2548 spoof.exe 2548 spoof.exe 2548 spoof.exe 2548 spoof.exe 2548 spoof.exe 2548 spoof.exe 2548 spoof.exe 2548 spoof.exe 2548 spoof.exe 2548 spoof.exe 2548 spoof.exe 2548 spoof.exe 2548 spoof.exe 2548 spoof.exe 2548 spoof.exe 2548 spoof.exe 2548 spoof.exe 2548 spoof.exe 2548 spoof.exe 2548 spoof.exe 2548 spoof.exe 2548 spoof.exe 2548 spoof.exe 2548 spoof.exe 2548 spoof.exe 2548 spoof.exe 2548 spoof.exe 2548 spoof.exe 2548 spoof.exe 2548 spoof.exe 2548 spoof.exe 2548 spoof.exe 2548 spoof.exe 2548 spoof.exe 2548 spoof.exe 2548 spoof.exe 2548 spoof.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 2548 wrote to memory of 2740 2548 spoof.exe 30 PID 2548 wrote to memory of 2740 2548 spoof.exe 30 PID 2548 wrote to memory of 2740 2548 spoof.exe 30
Processes
-
C:\Users\Admin\AppData\Local\Temp\spoof.exe"C:\Users\Admin\AppData\Local\Temp\spoof.exe"1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2548 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cls2⤵PID:2740
-