Overview
overview
7Static
static
7velocityty...RU.exe
windows7-x64
1velocityty...RU.exe
windows10-2004-x64
1velocityty...ll.exe
windows7-x64
1velocityty...ll.exe
windows10-2004-x64
1velocityty...rt.exe
windows7-x64
4velocityty...rt.exe
windows10-2004-x64
5velocityty...64.exe
windows7-x64
4velocityty...64.exe
windows10-2004-x64
5velocityty...SO.exe
windows7-x64
7velocityty...SO.exe
windows10-2004-x64
7velocityty...ST.exe
windows7-x64
7velocityty...ST.exe
windows10-2004-x64
7velocityty...ed.exe
windows7-x64
7velocityty...ed.exe
windows10-2004-x64
7velocityty...in.bat
windows7-x64
1velocityty...in.bat
windows10-2004-x64
1velocityty...rl.dll
windows7-x64
1velocityty...rl.dll
windows10-2004-x64
1velocityty...b1.dll
windows7-x64
1velocityty...b1.dll
windows10-2004-x64
1Analysis
-
max time kernel
121s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
16-06-2024 17:08
Behavioral task
behavioral1
Sample
velocitytytytyt/Monitor Spoof/CRU.exe
Resource
win7-20240611-en
Behavioral task
behavioral2
Sample
velocitytytytyt/Monitor Spoof/CRU.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral3
Sample
velocitytytytyt/Monitor Spoof/reset-all.exe
Resource
win7-20240611-en
Behavioral task
behavioral4
Sample
velocitytytytyt/Monitor Spoof/reset-all.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral5
Sample
velocitytytytyt/Monitor Spoof/restart.exe
Resource
win7-20240508-en
Behavioral task
behavioral6
Sample
velocitytytytyt/Monitor Spoof/restart.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral7
Sample
velocitytytytyt/Monitor Spoof/restart64.exe
Resource
win7-20240220-en
Behavioral task
behavioral8
Sample
velocitytytytyt/Monitor Spoof/restart64.exe
Resource
win10v2004-20240611-en
Behavioral task
behavioral9
Sample
velocitytytytyt/RUN ME ALSO.exe
Resource
win7-20240611-en
Behavioral task
behavioral10
Sample
velocitytytytyt/RUN ME ALSO.exe
Resource
win10v2004-20240611-en
Behavioral task
behavioral11
Sample
velocitytytytyt/RUN ME FIRST.exe
Resource
win7-20240611-en
Behavioral task
behavioral12
Sample
velocitytytytyt/RUN ME FIRST.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral13
Sample
velocitytytytyt/Velo.cc Spoofer_protected.exe
Resource
win7-20240611-en
Behavioral task
behavioral14
Sample
velocitytytytyt/Velo.cc Spoofer_protected.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral15
Sample
velocitytytytyt/Wifi & Bluetooth disabler/Disabler_Run_Admin.bat
Resource
win7-20240221-en
Behavioral task
behavioral16
Sample
velocitytytytyt/Wifi & Bluetooth disabler/Disabler_Run_Admin.bat
Resource
win10v2004-20240611-en
Behavioral task
behavioral17
Sample
velocitytytytyt/libcurl.dll
Resource
win7-20240508-en
Behavioral task
behavioral18
Sample
velocitytytytyt/libcurl.dll
Resource
win10v2004-20240611-en
Behavioral task
behavioral19
Sample
velocitytytytyt/zlib1.dll
Resource
win7-20240220-en
Behavioral task
behavioral20
Sample
velocitytytytyt/zlib1.dll
Resource
win10v2004-20240508-en
General
-
Target
velocitytytytyt/Monitor Spoof/restart.exe
-
Size
63KB
-
MD5
8242ce426ad462eff02edae1487a6949
-
SHA1
9a4f382d427e0de729053535aaa3310cac5f087b
-
SHA256
b68ee265308dc9da7dbb521bb71238d27ac50a5ee816f21c13818393be982d7a
-
SHA512
aff43a78d29ede49eac386d9b0b44d0f37d5a20bdda8553369d68dec90bbc727c6dd8fe239987a9d2e3affaeff8b72b5023ed973d7aecfbb99de46dca8c99ef1
-
SSDEEP
768:xa+/MMnf2XivrjhmxEQSQIjDaGva2XaT+CSxKUAch9Itvo7vq2XFelWn2iED5Vx0:xa0wstmSpDaGS2RCSxK28otXFQwUx
Malware Config
Signatures
-
Drops file in Windows directory 3 IoCs
Processes:
restart64.exedescription ioc process File opened for modification C:\Windows\INF\setupapi.app.log restart64.exe File opened for modification C:\Windows\setupact.log restart64.exe File opened for modification C:\Windows\setuperr.log restart64.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
restart64.exedescription pid process Token: SeLoadDriverPrivilege 2124 restart64.exe Token: SeLoadDriverPrivilege 2124 restart64.exe -
Suspicious use of WriteProcessMemory 4 IoCs
Processes:
restart.exedescription pid process target process PID 1700 wrote to memory of 2124 1700 restart.exe restart64.exe PID 1700 wrote to memory of 2124 1700 restart.exe restart64.exe PID 1700 wrote to memory of 2124 1700 restart.exe restart64.exe PID 1700 wrote to memory of 2124 1700 restart.exe restart64.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\velocitytytytyt\Monitor Spoof\restart.exe"C:\Users\Admin\AppData\Local\Temp\velocitytytytyt\Monitor Spoof\restart.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1700 -
C:\Users\Admin\AppData\Local\Temp\velocitytytytyt\Monitor Spoof\restart64.exerestart64.exe2⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:2124