Analysis

  • max time kernel
    122s
  • max time network
    124s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    19-12-2024 11:15

General

  • Target

    mcz-spoofer.exe

  • Size

    36.5MB

  • MD5

    298f6c8bbd619015d98cfa918b9f30f3

  • SHA1

    0bd73c07bf1c4222b537ce1d1e24cba2579c0d95

  • SHA256

    422c1eb1e01e9d72b37b0a86f0735f299ce4665cd9f71e8aeb317f647eb108be

  • SHA512

    f98b5b43e6438ac141f96d7fda1e6b61034ee95ab10cd662ac1b88ea0751bd246cf0576bb54d3937c14eac49c379c2499be80f3f515832625f58df50b2f0c660

  • SSDEEP

    786432:5KNOIwbZcKc3oZ9wI4P1Dh5Y1LtO5po7mvDe4y/pW2w6G:NLc3u4P1D38LtO5KCs06G

Score
7/10
upx

Malware Config

Signatures

  • Loads dropped DLL 17 IoCs
  • UPX packed file 2 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\mcz-spoofer.exe
    "C:\Users\Admin\AppData\Local\Temp\mcz-spoofer.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2440
    • C:\Users\Admin\AppData\Local\Temp\mcz-spoofer.exe
      "C:\Users\Admin\AppData\Local\Temp\mcz-spoofer.exe"
      2⤵
      • Loads dropped DLL
      PID:2552

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\_MEI24402\api-ms-win-core-file-l1-2-0.dll

    Filesize

    21KB

    MD5

    1c58526d681efe507deb8f1935c75487

    SHA1

    0e6d328faf3563f2aae029bc5f2272fb7a742672

    SHA256

    ef13dce8f71173315dfc64ab839b033ab19a968ee15230e9d4d2c9d558efeee2

    SHA512

    8edb9a0022f417648e2ece9e22c96e2727976332025c3e7d8f15bcf6d7d97e680d1bf008eb28e2e0bd57787dcbb71d38b2deb995b8edc35fa6852ab1d593f3d1

  • C:\Users\Admin\AppData\Local\Temp\_MEI24402\api-ms-win-core-file-l2-1-0.dll

    Filesize

    18KB

    MD5

    bfffa7117fd9b1622c66d949bac3f1d7

    SHA1

    402b7b8f8dcfd321b1d12fc85a1ee5137a5569b2

    SHA256

    1ea267a2e6284f17dd548c6f2285e19f7edb15d6e737a55391140ce5cb95225e

    SHA512

    b319cc7b436b1be165cdf6ffcab8a87fe29de78f7e0b14c8f562be160481fb5483289bd5956fdc1d8660da7a3f86d8eede35c6cc2b7c3d4c852decf4b2dcdb7f

  • C:\Users\Admin\AppData\Local\Temp\_MEI24402\api-ms-win-core-localization-l1-2-0.dll

    Filesize

    21KB

    MD5

    724223109e49cb01d61d63a8be926b8f

    SHA1

    072a4d01e01dbbab7281d9bd3add76f9a3c8b23b

    SHA256

    4e975f618df01a492ae433dff0dd713774d47568e44c377ceef9e5b34aad1210

    SHA512

    19b0065b894dc66c30a602c9464f118e7f84d83010e74457d48e93aaca4422812b093b15247b24d5c398b42ef0319108700543d13f156067b169ccfb4d7b6b7c

  • C:\Users\Admin\AppData\Local\Temp\_MEI24402\api-ms-win-core-processthreads-l1-1-1.dll

    Filesize

    21KB

    MD5

    517eb9e2cb671ae49f99173d7f7ce43f

    SHA1

    4ccf38fed56166ddbf0b7efb4f5314c1f7d3b7ab

    SHA256

    57cc66bf0909c430364d35d92b64eb8b6a15dc201765403725fe323f39e8ac54

    SHA512

    492be2445b10f6bfe6c561c1fc6f5d1af6d1365b7449bc57a8f073b44ae49c88e66841f5c258b041547fcd33cbdcb4eb9dd3e24f0924db32720e51651e9286be

  • C:\Users\Admin\AppData\Local\Temp\_MEI24402\api-ms-win-core-synch-l1-2-0.dll

    Filesize

    21KB

    MD5

    1281e9d1750431d2fe3b480a8175d45c

    SHA1

    bc982d1c750b88dcb4410739e057a86ff02d07ef

    SHA256

    433bd8ddc4f79aee65ca94a54286d75e7d92b019853a883e51c2b938d2469baa

    SHA512

    a954e6ce76f1375a8beac51d751b575bbc0b0b8ba6aa793402b26404e45718165199c2c00ccbcba3783c16bdd96f0b2c17addcc619c39c8031becebef428ce77

  • C:\Users\Admin\AppData\Local\Temp\_MEI24402\api-ms-win-core-timezone-l1-1-0.dll

    Filesize

    21KB

    MD5

    d12403ee11359259ba2b0706e5e5111c

    SHA1

    03cc7827a30fd1dee38665c0cc993b4b533ac138

    SHA256

    f60e1751a6ac41f08e46480bf8e6521b41e2e427803996b32bdc5e78e9560781

    SHA512

    9004f4e59835af57f02e8d9625814db56f0e4a98467041da6f1367ef32366ad96e0338d48fff7cc65839a24148e2d9989883bcddc329d9f4d27cae3f843117d0

  • C:\Users\Admin\AppData\Local\Temp\_MEI24402\api-ms-win-crt-convert-l1-1-0.dll

    Filesize

    25KB

    MD5

    edf71c5c232f5f6ef3849450f2100b54

    SHA1

    ed46da7d59811b566dd438fa1d09c20f5dc493ce

    SHA256

    b987ab40cdd950ebe7a9a9176b80b8fffc005ccd370bb1cbbcad078c1a506bdc

    SHA512

    481a3c8dc5bef793ee78ce85ec0f193e3e9f6cd57868b813965b312bd0fadeb5f4419707cd3004fbdb407652101d52e061ef84317e8bd458979443e9f8e4079a

  • C:\Users\Admin\AppData\Local\Temp\_MEI24402\api-ms-win-crt-environment-l1-1-0.dll

    Filesize

    21KB

    MD5

    f9235935dd3ba2aa66d3aa3412accfbf

    SHA1

    281e548b526411bcb3813eb98462f48ffaf4b3eb

    SHA256

    2f6bd6c235e044755d5707bd560a6afc0ba712437530f76d11079d67c0cf3200

    SHA512

    ad0c0a7891fb8328f6f0cf1ddc97523a317d727c15d15498afa53c07610210d2610db4bc9bd25958d47adc1af829ad4d7cf8aabcab3625c783177ccdb7714246

  • C:\Users\Admin\AppData\Local\Temp\_MEI24402\api-ms-win-crt-filesystem-l1-1-0.dll

    Filesize

    21KB

    MD5

    5107487b726bdcc7b9f7e4c2ff7f907c

    SHA1

    ebc46221d3c81a409fab9815c4215ad5da62449c

    SHA256

    94a86e28e829276974e01f8a15787fde6ed699c8b9dc26f16a51765c86c3eade

    SHA512

    a0009b80ad6a928580f2b476c1bdf4352b0611bb3a180418f2a42cfa7a03b9f0575ed75ec855d30b26e0cca96a6da8affb54862b6b9aff33710d2f3129283faa

  • C:\Users\Admin\AppData\Local\Temp\_MEI24402\api-ms-win-crt-heap-l1-1-0.dll

    Filesize

    21KB

    MD5

    d5d77669bd8d382ec474be0608afd03f

    SHA1

    1558f5a0f5facc79d3957ff1e72a608766e11a64

    SHA256

    8dd9218998b4c4c9e8d8b0f8b9611d49419b3c80daa2f437cbf15bcfd4c0b3b8

    SHA512

    8defa71772105fd9128a669f6ff19b6fe47745a0305beb9a8cadb672ed087077f7538cd56e39329f7daa37797a96469eae7cd5e4cca57c9a183b35bdc44182f3

  • C:\Users\Admin\AppData\Local\Temp\_MEI24402\api-ms-win-crt-math-l1-1-0.dll

    Filesize

    29KB

    MD5

    b8f0210c47847fc6ec9fbe2a1ad4debb

    SHA1

    e99d833ae730be1fedc826bf1569c26f30da0d17

    SHA256

    1c4a70a73096b64b536be8132ed402bcfb182c01b8a451bff452efe36ddf76e7

    SHA512

    992d790e18ac7ae33958f53d458d15bff522a3c11a6bd7ee2f784ac16399de8b9f0a7ee896d9f2c96d1e2c8829b2f35ff11fc5d8d1b14c77e22d859a1387797c

  • C:\Users\Admin\AppData\Local\Temp\_MEI24402\api-ms-win-crt-runtime-l1-1-0.dll

    Filesize

    25KB

    MD5

    20c0afa78836b3f0b692c22f12bda70a

    SHA1

    60bb74615a71bd6b489c500e6e69722f357d283e

    SHA256

    962d725d089f140482ee9a8ff57f440a513387dd03fdc06b3a28562c8090c0bc

    SHA512

    65f0e60136ab358661e5156b8ecd135182c8aaefd3ec320abdf9cfc8aeab7b68581890e0bbc56bad858b83d47b7a0143fa791195101dc3e2d78956f591641d16

  • C:\Users\Admin\AppData\Local\Temp\_MEI24402\api-ms-win-crt-stdio-l1-1-0.dll

    Filesize

    25KB

    MD5

    96498dc4c2c879055a7aff2a1cc2451e

    SHA1

    fecbc0f854b1adf49ef07beacad3cec9358b4fb2

    SHA256

    273817a137ee049cbd8e51dc0bb1c7987df7e3bf4968940ee35376f87ef2ef8d

    SHA512

    4e0b2ef0efe81a8289a447eb48898992692feee4739ceb9d87f5598e449e0059b4e6f4eb19794b9dcdce78c05c8871264797c14e4754fd73280f37ec3ea3c304

  • C:\Users\Admin\AppData\Local\Temp\_MEI24402\api-ms-win-crt-string-l1-1-0.dll

    Filesize

    25KB

    MD5

    115e8275eb570b02e72c0c8a156970b3

    SHA1

    c305868a014d8d7bbef9abbb1c49a70e8511d5a6

    SHA256

    415025dce5a086dbffc4cf322e8ead55cb45f6d946801f6f5193df044db2f004

    SHA512

    b97ef7c5203a0105386e4949445350d8ff1c83bdeaee71ccf8dc22f7f6d4f113cb0a9be136717895c36ee8455778549f629bf8d8364109185c0bf28f3cb2b2ca

  • C:\Users\Admin\AppData\Local\Temp\_MEI24402\api-ms-win-crt-time-l1-1-0.dll

    Filesize

    21KB

    MD5

    001e60f6bbf255a60a5ea542e6339706

    SHA1

    f9172ec37921432d5031758d0c644fe78cdb25fa

    SHA256

    82fba9bc21f77309a649edc8e6fc1900f37e3ffcb45cd61e65e23840c505b945

    SHA512

    b1a6dc5a34968fbdc8147d8403adf8b800a06771cc9f15613f5ce874c29259a156bab875aae4caaec2117817ce79682a268aa6e037546aeca664cd4eea60adbf

  • C:\Users\Admin\AppData\Local\Temp\_MEI24402\python311.dll

    Filesize

    1.6MB

    MD5

    bb46b85029b543b70276ad8e4c238799

    SHA1

    123bdcd9eebcac1ec0fd2764a37e5e5476bb0c1c

    SHA256

    72c24e1db1ba4df791720a93ca9502d77c3738eebf8b9092a5d82aa8d80121d0

    SHA512

    5e993617509c1cf434938d6a467eb0494e04580ad242535a04937f7c174d429da70a6e71792fc3de69e103ffc5d9de51d29001a4df528cfffefdaa2cef4eaf31

  • C:\Users\Admin\AppData\Local\Temp\_MEI24402\ucrtbase.DLL

    Filesize

    992KB

    MD5

    0e0bac3d1dcc1833eae4e3e4cf83c4ef

    SHA1

    4189f4459c54e69c6d3155a82524bda7549a75a6

    SHA256

    8a91052ef261b5fbf3223ae9ce789af73dfe1e9b0ba5bdbc4d564870a24f2bae

    SHA512

    a45946e3971816f66dd7ea3788aacc384a9e95011500b458212dc104741315b85659e0d56a41570731d338bdf182141c093d3ced222c007038583ceb808e26fd

  • memory/2440-141-0x000000013FCB0000-0x000000013FCEB000-memory.dmp

    Filesize

    236KB

  • memory/2552-95-0x000007FEF59D0000-0x000007FEF5FB8000-memory.dmp

    Filesize

    5.9MB

  • memory/2552-96-0x000000013FCB0000-0x000000013FCEB000-memory.dmp

    Filesize

    236KB