Analysis
-
max time kernel
121s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
13-12-2024 22:21
Behavioral task
behavioral1
Sample
spoofer.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
spoofer.exe
Resource
win10v2004-20241007-en
General
-
Target
spoofer.exe
-
Size
6.9MB
-
MD5
1bacb2e6ffc8fae25e783746b468de7c
-
SHA1
569baa380e871a0364b9caab0520662916b0370b
-
SHA256
a4c5665030b1c69b89131e842bf413a402a85c4096a046e219eb0fb51951fe28
-
SHA512
9018de863a71880071d90b9fec0da73642480a385309fc2e7643317b0d684d1690fe6bb73685fbee578c704b26efdfface49890628697e30bc1232b47dff0931
-
SSDEEP
98304:MeDjWM8JEE1FEnamaHl3Ne4i3Tf2PkOpfW9hZMMoVmkzhxIdfXeRpYRJJcGhEIFV:Me0aKeNTfm/pf+xk4dWRpmrbW3jmrt
Malware Config
Signatures
-
Loads dropped DLL 1 IoCs
pid Process 2692 spoofer.exe -
resource yara_rule behavioral1/files/0x00050000000191f8-21.dat upx -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 2432 wrote to memory of 2692 2432 spoofer.exe 30 PID 2432 wrote to memory of 2692 2432 spoofer.exe 30 PID 2432 wrote to memory of 2692 2432 spoofer.exe 30
Processes
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.6MB
MD5bb46b85029b543b70276ad8e4c238799
SHA1123bdcd9eebcac1ec0fd2764a37e5e5476bb0c1c
SHA25672c24e1db1ba4df791720a93ca9502d77c3738eebf8b9092a5d82aa8d80121d0
SHA5125e993617509c1cf434938d6a467eb0494e04580ad242535a04937f7c174d429da70a6e71792fc3de69e103ffc5d9de51d29001a4df528cfffefdaa2cef4eaf31