Overview
overview
10Static
static
3SpooferPack.rar
windows10-2004-x64
3SpooferPac...32.dll
windows10-2004-x64
3SpooferPac...64.dll
windows10-2004-x64
1SpooferPac...rs.dll
windows10-2004-x64
1SpooferPac...64.dll
windows10-2004-x64
4SpooferPac...47.dll
windows10-2004-x64
3SpooferPac...re.dll
windows10-2004-x64
3SpooferPac...ui.dll
windows10-2004-x64
1SpooferPac...rk.dll
windows10-2004-x64
3SpooferPac...ml.dll
windows10-2004-x64
3SpooferPac...ck.dll
windows10-2004-x64
1SpooferPac...ts.dll
windows10-2004-x64
3SpooferPac...er.dll
windows10-2004-x64
3SpooferPac...V2.dll
windows10-2004-x64
1SpooferPac..._1.dll
windows10-2004-x64
3SpooferPac...sw.dll
windows10-2004-x64
1SpooferPac...se.dll
windows10-2004-x64
1SpooferPac...er.exe
windows10-2004-x64
10SpooferPac...s.json
windows10-2004-x64
3SpooferPac...ID.exe
windows10-2004-x64
1SpooferPac...ID.pdb
windows10-2004-x64
3SpooferPac...g.json
windows10-2004-x64
3SpooferPac...er.exe
windows10-2004-x64
1SpooferPac...47.dll
windows10-2004-x64
3SpooferPac...rs.dll
windows10-2004-x64
1SpooferPac...64.dll
windows10-2004-x64
4SpooferPac..._1.dll
windows10-2004-x64
3SpooferPac...es.dll
windows10-2004-x64
1SpooferPac...og.dll
windows10-2004-x64
1SpooferPac...er.dll
windows10-2004-x64
1SpooferPac...ml.dll
windows10-2004-x64
1SpooferPac...me.dll
windows10-2004-x64
1Analysis
- max time kernel
92s - max time network
151s - platform
windows10-2004_x64 - resource
win10v2004-20240508-en - resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system - submitted
09/06/2024, 09:08
Static task
static1
Behavioral task
behavioral1
Sample
SpooferPack.rar
Resource
win10v2004-20240426-en
windows10-2004-x64
Behavioral task
behavioral2
Sample
SpooferPack/Spoofer(NEW VERSION)/Additional/CiWinCng32.dll
Resource
win10v2004-20240508-en
windows10-2004-x64
Behavioral task
behavioral3
Sample
SpooferPack/Spoofer(NEW VERSION)/Additional/CiWinCng64.dll
Resource
win10v2004-20240426-en
windows10-2004-x64
Behavioral task
behavioral4
Sample
SpooferPack/Spoofer(NEW VERSION)/Additional/bdfilters.dll
Resource
win10v2004-20240508-en
windows10-2004-x64
Behavioral task
behavioral5
Sample
SpooferPack/Spoofer(NEW VERSION)/Additional/bdfilters64.dll
Resource
win10v2004-20240426-en
windows10-2004-x64
Behavioral task
behavioral6
Sample
SpooferPack/Spoofer(NEW VERSION)/DLL/D3Dcompiler_47.dll
Resource
win10v2004-20240508-en
windows10-2004-x64
Behavioral task
behavioral7
Sample
SpooferPack/Spoofer(NEW VERSION)/DLL/Qt5Core.dll
Resource
win10v2004-20240508-en
windows10-2004-x64
Behavioral task
behavioral8
Sample
SpooferPack/Spoofer(NEW VERSION)/DLL/Qt5Gui.dll
Resource
win10v2004-20240226-en
windows10-2004-x64
Behavioral task
behavioral9
Sample
SpooferPack/Spoofer(NEW VERSION)/DLL/Qt5Network.dll
Resource
win10v2004-20240508-en
windows10-2004-x64
Behavioral task
behavioral10
Sample
SpooferPack/Spoofer(NEW VERSION)/DLL/Qt5Qml.dll
Resource
win10v2004-20240508-en
windows10-2004-x64
Behavioral task
behavioral11
Sample
SpooferPack/Spoofer(NEW VERSION)/DLL/Qt5Quick.dll
Resource
win10v2004-20240508-en
windows10-2004-x64
Behavioral task
behavioral12
Sample
SpooferPack/Spoofer(NEW VERSION)/DLL/Qt5Widgets.dll
Resource
win10v2004-20240426-en
windows10-2004-x64
Behavioral task
behavioral13
Sample
SpooferPack/Spoofer(NEW VERSION)/DLL/browser.dll
Resource
win10v2004-20240508-en
windows10-2004-x64
Behavioral task
behavioral14
Sample
SpooferPack/Spoofer(NEW VERSION)/DLL/libGLESV2.dll
Resource
win10v2004-20240508-en
windows10-2004-x64
Behavioral task
behavioral15
Sample
SpooferPack/Spoofer(NEW VERSION)/DLL/libcrypto-1_1.dll
Resource
win10v2004-20240426-en
windows10-2004-x64
Behavioral task
behavioral16
Sample
SpooferPack/Spoofer(NEW VERSION)/DLL/opengl32sw.dll
Resource
win10v2004-20240508-en
windows10-2004-x64
Behavioral task
behavioral17
Sample
SpooferPack/Spoofer(NEW VERSION)/DLL/ucrtbase.dll
Resource
win10v2004-20240426-en
windows10-2004-x64
Behavioral task
behavioral18
Sample
SpooferPack/Spoofer(NEW VERSION)/FileInstaller.exe
Resource
win10v2004-20240508-en
windows10-2004-x64
Behavioral task
behavioral19
Sample
SpooferPack/Spoofer(OLD VERSION)/SPOOFER HWID.deps.json
Resource
win10v2004-20240508-en
windows10-2004-x64
Behavioral task
behavioral20
Sample
SpooferPack/Spoofer(OLD VERSION)/SPOOFER HWID.exe
Resource
win10v2004-20240426-en
windows10-2004-x64
Behavioral task
behavioral21
Sample
SpooferPack/Spoofer(OLD VERSION)/SPOOFER HWID.pdb
Resource
win10v2004-20240426-en
windows10-2004-x64
Behavioral task
behavioral22
Sample
SpooferPack/Spoofer(OLD VERSION)/SPOOFER HWID.runtimeconfig.json
Resource
win10v2004-20240426-en
windows10-2004-x64
Behavioral task
behavioral23
Sample
SpooferPack/Spoofer(OLD VERSION)/Spoofer_Installer.exe
Resource
win10v2004-20240508-en
windows10-2004-x64
Behavioral task
behavioral24
Sample
SpooferPack/Spoofer(OLD VERSION)/runtimes/D3Dcompiler_47.dll
Resource
win10v2004-20240226-en
windows10-2004-x64
Behavioral task
behavioral25
Sample
SpooferPack/Spoofer(OLD VERSION)/runtimes/bdfilters.dll
Resource
win10v2004-20240426-en
windows10-2004-x64
Behavioral task
behavioral26
Sample
SpooferPack/Spoofer(OLD VERSION)/runtimes/bdfilters64.dll
Resource
win10v2004-20240508-en
windows10-2004-x64
Behavioral task
behavioral27
Sample
SpooferPack/Spoofer(OLD VERSION)/runtimes/libcrypto-1_1.dll
Resource
win10v2004-20240426-en
windows10-2004-x64
Behavioral task
behavioral28
Sample
SpooferPack/Spoofer(OLD VERSION)/runtimes/win/lib/net6.0/System.Diagnostics.EventLog.Messages.dll
Resource
win10v2004-20240508-en
windows10-2004-x64
Behavioral task
behavioral29
Sample
SpooferPack/Spoofer(OLD VERSION)/runtimes/win/lib/net6.0/System.Diagnostics.EventLog.dll
Resource
win10v2004-20240426-en
windows10-2004-x64
Behavioral task
behavioral30
Sample
SpooferPack/Spoofer(OLD VERSION)/runtimes/win/lib/net6.0/System.ServiceProcess.ServiceController.dll
Resource
win10v2004-20240508-en
windows10-2004-x64
Behavioral task
behavioral31
Sample
SpooferPack/Spoofer(OLD VERSION)/runtimes/win/lib/netcoreapp3.0/System.Runtime.WindowsRuntime.UI.Xaml.dll
Resource
win10v2004-20240426-en
windows10-2004-x64
Behavioral task
behavioral32
Sample
SpooferPack/Spoofer(OLD VERSION)/runtimes/win/lib/netcoreapp3.0/System.Runtime.WindowsRuntime.dll
Resource
win10v2004-20240426-en
windows10-2004-x64
General
- Target SpooferPack/Spoofer(NEW VERSION)/Additional/bdfilters.dll
- Size 4.1MB
- Sample240609-k4ef7sge2v
- SHA256 9cbc29696ad2d582e251bf9c4be5cce618753fa43551d2474e1ae5cc5e1245e5
- MD5 ed730387fdcd684b756601b863c47417
- SHA1 c49ed6d0d46facf4ceaeb21f5d6bfdf9e3587fde
- SHA512 e32df727799d33922c6e92f94a7bdb0bc2772d6a6636d15e285d94d3ae4661062e5bc89ec3546b76ec853398f88d972f461327ef687f89093acf1096560d5c3f
- SSDEEP 98304:Xl4qYuQxqYfHYosUiJovT7DBmmhjSF5og3Vk9O0KChvvvveo:XuqYuQxqYfHYosUiJoviVKvvvvJ
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Signatures
- Modifies registry class 28 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F4F5C9E9-CFCC-4C65-A8BD-0423A338F188}\InprocServer32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{083863F1-70DE-11D0-BD40-00A0C911CE86}\Instance\{E2E7539A-CECF-4A6A-B187-939943ECEF05}\CLSID = "{E2E7539A-CECF-4A6A-B187-939943ECEF05}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A1C6833E-A3EC-4397-9FA9-151792F3408F}\InprocServer32\ThreadingModel = "Both" regsvr32.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{083863F1-70DE-11D0-BD40-00A0C911CE86}\Instance\{E2E7539A-CECF-4A6A-B187-939943ECEF05}\FilterData = 02000000010080ff020000000000000030706933000000000000000001000000000000000000000030747933000000006000000070000000317069330800000000000000010000000000000000000000307479330000000060000000800000006175647300001000800000aa00389b715000000000001000800000aa00389b710100000000001000800000aa00389b71 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{083863F1-70DE-11D0-BD40-00A0C911CE86}\Instance\{89C4B786-A490-4A3E-AA70-E6A8C61D3689}\FriendlyName = "Bandicam MPEG-1 Video Decoder" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{083863F1-70DE-11D0-BD40-00A0C911CE86}\Instance\{89C4B786-A490-4A3E-AA70-E6A8C61D3689}\CLSID = "{89C4B786-A490-4A3E-AA70-E6A8C61D3689}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{083863F1-70DE-11D0-BD40-00A0C911CE86}\Instance\{E2E7539A-CECF-4A6A-B187-939943ECEF05}\FriendlyName = "Bandicam MPEG-1 Audio Decoder" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{89C4B786-A490-4A3E-AA70-E6A8C61D3689}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\SpooferPack\\Spoofer(NEW VERSION)\\Additional\\bdfilters.dll" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{89C4B786-A490-4A3E-AA70-E6A8C61D3689}\InprocServer32\ThreadingModel = "Both" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E2E7539A-CECF-4A6A-B187-939943ECEF05} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E2E7539A-CECF-4A6A-B187-939943ECEF05}\ = "Bandicam MPEG-1 Audio Decoder" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F4F5C9E9-CFCC-4C65-A8BD-0423A338F188}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\SpooferPack\\Spoofer(NEW VERSION)\\Additional\\bdfilters.dll" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A1C6833E-A3EC-4397-9FA9-151792F3408F}\InprocServer32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E2E7539A-CECF-4A6A-B187-939943ECEF05}\InprocServer32\ThreadingModel = "Both" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{083863F1-70DE-11D0-BD40-00A0C911CE86}\Instance\{E2E7539A-CECF-4A6A-B187-939943ECEF05} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{89C4B786-A490-4A3E-AA70-E6A8C61D3689} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E2E7539A-CECF-4A6A-B187-939943ECEF05}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\SpooferPack\\Spoofer(NEW VERSION)\\Additional\\bdfilters.dll" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F4F5C9E9-CFCC-4C65-A8BD-0423A338F188}\InprocServer32\ThreadingModel = "Both" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{083863F1-70DE-11D0-BD40-00A0C911CE86}\Instance\{89C4B786-A490-4A3E-AA70-E6A8C61D3689} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A1C6833E-A3EC-4397-9FA9-151792F3408F}\ = "Bandicam MPEG-1 Video Property" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A1C6833E-A3EC-4397-9FA9-151792F3408F}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\SpooferPack\\Spoofer(NEW VERSION)\\Additional\\bdfilters.dll" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E2E7539A-CECF-4A6A-B187-939943ECEF05}\InprocServer32 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F4F5C9E9-CFCC-4C65-A8BD-0423A338F188} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{89C4B786-A490-4A3E-AA70-E6A8C61D3689}\ = "Bandicam MPEG-1 Video Decoder" regsvr32.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{083863F1-70DE-11D0-BD40-00A0C911CE86}\Instance\{89C4B786-A490-4A3E-AA70-E6A8C61D3689}\FilterData = 02000000010080ff02000000000000003070693300000000000000000200000000000000000000003074793300000000700000008000000031747933000000007000000090000000317069330800000000000000010000000000000000000000307479330000000070000000a00000007669647300001000800000aa00389b714d50454700001000800000aa00389b714d50473100001000800000aa00389b7100000000000000000000000000000000 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{89C4B786-A490-4A3E-AA70-E6A8C61D3689}\InprocServer32 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A1C6833E-A3EC-4397-9FA9-151792F3408F} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F4F5C9E9-CFCC-4C65-A8BD-0423A338F188}\ = "Bandicam MPEG-1 Audio Property" regsvr32.exe - Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 2452 wrote to memory of 2736 2452 regsvr32.exe 82 PID 2452 wrote to memory of 2736 2452 regsvr32.exe 82 PID 2452 wrote to memory of 2736 2452 regsvr32.exe 82
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s "C:\Users\Admin\AppData\Local\Temp\SpooferPack\Spoofer(NEW VERSION)\Additional\bdfilters.dll"1⤵
- Suspicious use of WriteProcessMemory
PID:2452 -
C:\Windows\SysWOW64\regsvr32.exe/s "C:\Users\Admin\AppData\Local\Temp\SpooferPack\Spoofer(NEW VERSION)\Additional\bdfilters.dll"2⤵
- Modifies registry class
PID:2736
-