Analysis
-
max time kernel
120s -
max time network
130s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
01-07-2024 10:45
Behavioral task
behavioral1
Sample
lowkey_spoofer_cracked_fixed_by_nemesis_team.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
lowkey_spoofer_cracked_fixed_by_nemesis_team.exe
Resource
win10v2004-20240508-en
General
-
Target
lowkey_spoofer_cracked_fixed_by_nemesis_team.exe
-
Size
75.3MB
-
MD5
c0263a62d2c03a92ab3936520f1a7edb
-
SHA1
79804d69c109308b10123eda45a722508dfc40be
-
SHA256
c824242e6bd784f592d34e6ab946c4784b8144bc15e1e5ad637151ef3a205d12
-
SHA512
19d91f494162b1d7adbd705af565c0cf3137c9617e7328231eeb93a062be2ba189bc9abb8ff5d2e8d5cb2dcf7f63b8bd18ec2132d6b0df3d10c024edeb41322f
-
SSDEEP
1572864:DvFUQpjkuwSk8IpG7V+VPhqS0E7WZRjRH2PRQvS6f97PyhonB08yfXWulZvFVN:DvFUqA7SkB05awSgZRdW2S6f9jnB08Qd
Malware Config
Signatures
-
Loads dropped DLL 1 IoCs
pid Process 2512 lowkey_spoofer_cracked_fixed_by_nemesis_team.exe -
resource yara_rule behavioral1/files/0x000400000001ccc7-1261.dat upx -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 1988 wrote to memory of 2512 1988 lowkey_spoofer_cracked_fixed_by_nemesis_team.exe 28 PID 1988 wrote to memory of 2512 1988 lowkey_spoofer_cracked_fixed_by_nemesis_team.exe 28 PID 1988 wrote to memory of 2512 1988 lowkey_spoofer_cracked_fixed_by_nemesis_team.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\lowkey_spoofer_cracked_fixed_by_nemesis_team.exe"C:\Users\Admin\AppData\Local\Temp\lowkey_spoofer_cracked_fixed_by_nemesis_team.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1988 -
C:\Users\Admin\AppData\Local\Temp\lowkey_spoofer_cracked_fixed_by_nemesis_team.exe"C:\Users\Admin\AppData\Local\Temp\lowkey_spoofer_cracked_fixed_by_nemesis_team.exe"2⤵
- Loads dropped DLL
PID:2512
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.4MB
MD5178a0f45fde7db40c238f1340a0c0ec0
SHA1dcd2d3d14e06da3e8d7dc91a69b5fd785768b5fe
SHA2569fcb5ad15bd33dd72122a171a5d950e8e47ceda09372f25df828010cde24b8ed
SHA5124b790046787e57b9414a796838a026b1530f497a75c8e62d62b56f8c16a0cbedbefad3d4be957bc18379f64374d8d3bf62d3c64b53476c7c5005a7355acd2cee