71ce71735aa47a3b1d17e1b6639aaf6213b4c284243ad5ae7bb36fa1c5c9975f

Submit
Reports

Overview

overview

Static

static

SpyNote_v6...pi.dll

windows7-x64

SpyNote_v6...pi.dll

windows10-2004-x64

SpyNote_v6...6.html

windows7-x64

SpyNote_v6...6.html

windows10-2004-x64

SpyNote_v6...2.html

windows7-x64

SpyNote_v6...2.html

windows10-2004-x64

SpyNote_v6...9.html

windows7-x64

SpyNote_v6...9.html

windows10-2004-x64

SpyNote_v6...SM.dll

windows7-x64

SpyNote_v6...SM.dll

windows10-2004-x64

SpyNote_v6...SL.exe

windows7-x64

SpyNote_v6...SL.exe

windows10-2004-x64

apktool/apktool.bat

windows7-x64

apktool/apktool.bat

windows10-2004-x64

apktool/apktool.jar

windows7-x64

apktool/apktool.jar

windows10-2004-x64

apktool/signapk.jar

windows7-x64

apktool/signapk.jar

windows10-2004-x64

SpyNote_v6...ub.apk

android-9-x86

SpyNote_v6...ub.apk

android-10-x64

SpyNote_v6...ub.apk

android-11-x64

SpyNote_v6...va.jar

windows7-x64

SpyNote_v6...va.jar

windows10-2004-x64

SpyNote_v6...sS.exe

windows7-x64

SpyNote_v6...sS.exe

windows10-2004-x64

platform-t...pi.dll

windows7-x64

platform-t...pi.dll

windows10-2004-x64

platform-t...pi.dll

windows7-x64

platform-t...pi.dll

windows10-2004-x64

platform-t...db.exe

windows7-x64

platform-t...db.exe

windows10-2004-x64

platform-t...mp.exe

windows7-x64

Analysis

max time kernel
94s
max time network
136s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
29-11-2024 17:21

Sharing

Copy URL

Twitter E-mail

Static task

static1

spynote

6 signatures

Behavioral task

behavioral1

Sample

SpyNote_v6.4/CoreAudioApi.dll

Resource

win7-20241010-en

windows7-x64

0 signatures

150 seconds

Behavioral task

behavioral2

Sample

SpyNote_v6.4/CoreAudioApi.dll

Resource

win10v2004-20241007-en

windows10-2004-x64

0 signatures

150 seconds

Behavioral task

behavioral3

Sample

SpyNote_v6.4/Resources/Clients/KingB_354051091211537/Settings/2021-11-9--11-07-16.html

Resource

win7-20240903-en

discovery

windows7-x64

5 signatures

150 seconds

Behavioral task

behavioral4

Sample

SpyNote_v6.4/Resources/Clients/KingB_354051091211537/Settings/2021-11-9--11-07-16.html

Resource

win10v2004-20241007-en

discovery

windows10-2004-x64

7 signatures

150 seconds

Behavioral task

behavioral5

Sample

SpyNote_v6.4/Resources/Clients/Vicitim_354051091211537/Apps/2021-27-9--17-10-52.html

Resource

win7-20240903-en

discovery

windows7-x64

5 signatures

150 seconds

Behavioral task

behavioral6

Sample

SpyNote_v6.4/Resources/Clients/Vicitim_354051091211537/Apps/2021-27-9--17-10-52.html

Resource

win10v2004-20241007-en

discovery

windows10-2004-x64

7 signatures

150 seconds

Behavioral task

behavioral7

Sample

SpyNote_v6.4/Resources/Clients/Vicitim_354051091211537/Settings/2021-27-9--17-12-59.html

Resource

win7-20240903-en

discovery

windows7-x64

5 signatures

150 seconds

Behavioral task

behavioral8

Sample

SpyNote_v6.4/Resources/Clients/Vicitim_354051091211537/Settings/2021-27-9--17-12-59.html

Resource

win10v2004-20241007-en

discovery

windows10-2004-x64

7 signatures

150 seconds

Behavioral task

behavioral9

Sample

SpyNote_v6.4/Resources/Imports/Gsm/GSM.dll

Resource

win7-20241010-en

windows7-x64

0 signatures

150 seconds

Behavioral task

behavioral10

Sample

SpyNote_v6.4/Resources/Imports/Gsm/GSM.dll

Resource

win10v2004-20241007-en

windows10-2004-x64

0 signatures

150 seconds

Behavioral task

behavioral11

Sample

SpyNote_v6.4/Resources/Imports/Payload/SL.exe

Resource

win7-20240903-en

windows7-x64

0 signatures

150 seconds

Behavioral task

behavioral12

Sample

SpyNote_v6.4/Resources/Imports/Payload/SL.exe

Resource

win10v2004-20241007-en

windows10-2004-x64

0 signatures

150 seconds

Behavioral task

behavioral13

Sample

apktool/apktool.bat

Resource

win7-20240903-en

windows7-x64

1 signatures

150 seconds

Behavioral task

behavioral14

Sample

apktool/apktool.bat

Resource

win10v2004-20241007-en

windows10-2004-x64

1 signatures

150 seconds

Behavioral task

behavioral15

Sample

apktool/apktool.jar

Resource

win7-20240903-en

windows7-x64

0 signatures

150 seconds

Behavioral task

behavioral16

Sample

apktool/apktool.jar

Resource

win10v2004-20241007-en

windows10-2004-x64

0 signatures

150 seconds

Behavioral task

behavioral17

Sample

apktool/signapk.jar

Resource

win7-20240903-en

windows7-x64

0 signatures

150 seconds

Behavioral task

behavioral18

Sample

apktool/signapk.jar

Resource

win10v2004-20241007-en

windows10-2004-x64

0 signatures

150 seconds

Behavioral task

behavioral19

Sample

SpyNote_v6.4/Resources/Imports/Payload/stub.apk

Resource

android-x86-arm-20240624-en

android-9-x86

0 signatures

150 seconds

Behavioral task

behavioral20

Sample

SpyNote_v6.4/Resources/Imports/Payload/stub.apk

Resource

android-x64-20240624-en

android-10-x64

0 signatures

150 seconds

Behavioral task

behavioral21

Sample

SpyNote_v6.4/Resources/Imports/Payload/stub.apk

Resource

android-x64-arm64-20240624-en

android-11-x64

0 signatures

150 seconds

Behavioral task

behavioral22

Sample

SpyNote_v6.4/Resources/Imports/PlayerJava/PlayerJava.jar

Resource

win7-20240903-en

windows7-x64

0 signatures

150 seconds

Behavioral task

behavioral23

Sample

SpyNote_v6.4/Resources/Imports/PlayerJava/PlayerJava.jar

Resource

win10v2004-20241007-en

windows10-2004-x64

0 signatures

150 seconds

Behavioral task

behavioral24

Sample

SpyNote_v6.4/Resources/Imports/T/sS.exe

Resource

win7-20240903-en

windows7-x64

0 signatures

150 seconds

Behavioral task

behavioral25

Sample

SpyNote_v6.4/Resources/Imports/T/sS.exe

Resource

win10v2004-20241007-en

windows10-2004-x64

0 signatures

150 seconds

Behavioral task

behavioral26

Sample

platform-tools/AdbWinApi.dll

Resource

win7-20241010-en

discovery

windows7-x64

3 signatures

150 seconds

Behavioral task

behavioral27

Sample

platform-tools/AdbWinApi.dll

Resource

win10v2004-20241007-en

discovery

windows10-2004-x64

3 signatures

150 seconds

Behavioral task

behavioral28

Sample

platform-tools/AdbWinUsbApi.dll

Resource

win7-20240903-en

discovery

windows7-x64

2 signatures

150 seconds

Behavioral task

behavioral29

Sample

platform-tools/AdbWinUsbApi.dll

Resource

win10v2004-20241007-en

discovery

windows10-2004-x64

3 signatures

150 seconds

Behavioral task

behavioral30

Sample

platform-tools/adb.exe

Resource

win7-20240903-en

discovery

windows7-x64

1 signatures

150 seconds

Behavioral task

behavioral31

Sample

platform-tools/adb.exe

Resource

win10v2004-20241007-en

discovery

windows10-2004-x64

1 signatures

150 seconds

Behavioral task

behavioral32

Sample

platform-tools/dmtracedump.exe

Resource

win7-20240903-en

windows7-x64

0 signatures

150 seconds

Report Analysis Logs

General

Target

apktool/apktool.bat
Size

135B
MD5

b02966b106045115fa8ef94a4e67537b
SHA1

f901df8bbfe8fe50e560e625a27da1c6c4f0e9b3
SHA256

3d8108beb40535e68e7f6421a4309408ea5efab91707fa25d862154e3cc9b6df
SHA512

6274a4568285c74985b095d1dd5649044b61cb7c372dc4653c62a2b92833df477f5a5453be0e598622918b4e6c27064a57e5fba1a657dd064e6d9598fe2f94cc

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 1260 wrote to memory of 3048	1260	cmd.exe	84
PID 1260 wrote to memory of 3048	1260	cmd.exe	84

Processes

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\apktool\apktool.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:1260
- C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe
  java -jar -Duser.language=en "C:\Users\Admin\AppData\Local\Temp\apktool\\apktool.jar"
  2⤵
  PID:3048

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3048-2-0x00000255D2760000-0x00000255D29D0000-memory.dmp

Filesize
2.4MB

Download
memory/3048-11-0x00000255D0F00000-0x00000255D0F01000-memory.dmp

Filesize
4KB

Download
memory/3048-14-0x00000255D0F00000-0x00000255D0F01000-memory.dmp

Filesize
4KB

Download
memory/3048-15-0x00000255D2760000-0x00000255D29D0000-memory.dmp

Filesize
2.4MB

Download