b2665f90c1c54dcc77aa3cc62acde7f92101b570159a13dc7c5b774665a9bee6

Submit
Reports

Overview

overview

Static

static

spoofer.exe

windows7-x64

spoofer.exe

windows10-2004-x64

$PLUGINSDI...ls.dll

windows7-x64

$PLUGINSDI...ls.dll

windows10-2004-x64

$PLUGINSDI...em.dll

windows7-x64

$PLUGINSDI...em.dll

windows10-2004-x64

LICENSES.c...m.html

windows7-x64

LICENSES.c...m.html

windows10-2004-x64

d3dcompiler_47.dll

windows10-2004-x64

ffmpeg.dll

windows7-x64

ffmpeg.dll

windows10-2004-x64

libEGL.dll

windows7-x64

libEGL.dll

windows10-2004-x64

libGLESv2.dll

windows7-x64

libGLESv2.dll

windows10-2004-x64

resources/...c.node

ubuntu-20.04-amd64

resources/...c.node

ubuntu-22.04-amd64

resources/...c.node

ubuntu-24.04-amd64

resources/...c.node

ubuntu-24.04-amd64

resources/...c.node

ubuntu-22.04-amd64

resources/...c.node

ubuntu-24.04-amd64

resources/...c.node

ubuntu-24.04-amd64

resources/...c.node

ubuntu-20.04-amd64

resources/...c.node

ubuntu-24.04-amd64

resources/...c.node

ubuntu-24.04-amd64

resources/...c.node

ubuntu-22.04-amd64

resources/...c.node

ubuntu-20.04-amd64

resources/...c.node

ubuntu-24.04-amd64

resources/...c.node

ubuntu-20.04-amd64

resources/...c.node

ubuntu-24.04-amd64

resources/...c.node

ubuntu-24.04-amd64

resources/...c.node

ubuntu-24.04-amd64

Analysis

max time kernel
9s
max time network
21s
platform
windows7_x64
resource
win7-20241010-en
resource tags

arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
submitted
28/03/2025, 18:36

Sharing

Copy URL

Twitter E-mail

Static task

static1

1 signatures

Behavioral task

behavioral1

Sample

spoofer.exe

Resource

win7-20241010-en

discovery

windows7-x64

6 signatures

150 seconds

Behavioral task

behavioral2

Sample

spoofer.exe

Resource

win10v2004-20250314-en

collection credential_access defense_evasion discovery execution impact persistence privilege_escalation ransomware spyware stealer

windows10-2004-x64

37 signatures

150 seconds

Behavioral task

behavioral3

Sample

$PLUGINSDIR/StdUtils.dll

Resource

win7-20240903-en

discovery

windows7-x64

3 signatures

150 seconds

Behavioral task

behavioral4

Sample

$PLUGINSDIR/StdUtils.dll

Resource

win10v2004-20250314-en

discovery

windows10-2004-x64

3 signatures

150 seconds

Behavioral task

behavioral5

Sample

$PLUGINSDIR/System.dll

Resource

win7-20240903-en

discovery

windows7-x64

3 signatures

150 seconds

Behavioral task

behavioral6

Sample

$PLUGINSDIR/System.dll

Resource

win10v2004-20250314-en

discovery

windows10-2004-x64

3 signatures

150 seconds

Behavioral task

behavioral7

Sample

LICENSES.chromium.html

Resource

win7-20240903-en

discovery

windows7-x64

5 signatures

150 seconds

Behavioral task

behavioral8

Sample

LICENSES.chromium.html

Resource

win10v2004-20250314-en

discovery

windows10-2004-x64

11 signatures

150 seconds

Behavioral task

behavioral9

Sample

d3dcompiler_47.dll

Resource

win10v2004-20250313-en

windows10-2004-x64

0 signatures

150 seconds

Behavioral task

behavioral10

Sample

ffmpeg.dll

Resource

win7-20250207-en

windows7-x64

0 signatures

150 seconds

Behavioral task

behavioral11

Sample

ffmpeg.dll

Resource

win10v2004-20250314-en

windows10-2004-x64

0 signatures

150 seconds

Behavioral task

behavioral12

Sample

libEGL.dll

Resource

win7-20240903-en

windows7-x64

0 signatures

150 seconds

Behavioral task

behavioral13

Sample

libEGL.dll

Resource

win10v2004-20250314-en

windows10-2004-x64

0 signatures

150 seconds

Behavioral task

behavioral14

Sample

libGLESv2.dll

Resource

win7-20241010-en

windows7-x64

1 signatures

150 seconds

Behavioral task

behavioral15

Sample

libGLESv2.dll

Resource

win10v2004-20250314-en

windows10-2004-x64

0 signatures

150 seconds

Behavioral task

behavioral16

Sample

resources/app.asar.unpacked/node_modules/deasync/bin/linux-ia32-node-0.10/deasync.node

Resource

ubuntu2004-amd64-20240611-en

ubuntu-20.04-amd64

0 signatures

150 seconds

Behavioral task

behavioral17

Sample

resources/app.asar.unpacked/node_modules/deasync/bin/linux-ia32-node-0.11/deasync.node

Resource

ubuntu2204-amd64-20250307-en

ubuntu-22.04-amd64

0 signatures

150 seconds

Behavioral task

behavioral18

Sample

resources/app.asar.unpacked/node_modules/deasync/bin/linux-ia32-node-0.12/deasync.node

Resource

ubuntu2404-amd64-20250307-en

ubuntu-24.04-amd64

0 signatures

150 seconds

Behavioral task

behavioral19

Sample

resources/app.asar.unpacked/node_modules/deasync/bin/linux-ia32-node-10/deasync.node

Resource

ubuntu2404-amd64-20250307-en

ubuntu-24.04-amd64

0 signatures

150 seconds

Behavioral task

behavioral20

Sample

resources/app.asar.unpacked/node_modules/deasync/bin/linux-ia32-node-4/deasync.node

Resource

ubuntu2204-amd64-20250307-en

ubuntu-22.04-amd64

0 signatures

150 seconds

Behavioral task

behavioral21

Sample

resources/app.asar.unpacked/node_modules/deasync/bin/linux-ia32-node-5/deasync.node

Resource

ubuntu2404-amd64-20250307-en

ubuntu-24.04-amd64

0 signatures

150 seconds

Behavioral task

behavioral22

Sample

resources/app.asar.unpacked/node_modules/deasync/bin/linux-ia32-node-6/deasync.node

Resource

ubuntu2404-amd64-20250307-en

ubuntu-24.04-amd64

0 signatures

150 seconds

Behavioral task

behavioral23

Sample

resources/app.asar.unpacked/node_modules/deasync/bin/linux-ia32-node-7/deasync.node

Resource

ubuntu2004-amd64-20241127-en

ubuntu-20.04-amd64

0 signatures

150 seconds

Behavioral task

behavioral24

Sample

resources/app.asar.unpacked/node_modules/deasync/bin/linux-ia32-node-8/deasync.node

Resource

ubuntu2404-amd64-20250307-en

ubuntu-24.04-amd64

0 signatures

150 seconds

Behavioral task

behavioral25

Sample

resources/app.asar.unpacked/node_modules/deasync/bin/linux-ia32-node-9/deasync.node

Resource

ubuntu2404-amd64-20250307-en

ubuntu-24.04-amd64

0 signatures

150 seconds

Behavioral task

behavioral26

Sample

resources/app.asar.unpacked/node_modules/deasync/bin/linux-x64-node-0.10/deasync.node

Resource

ubuntu2204-amd64-20250307-en

ubuntu-22.04-amd64

0 signatures

150 seconds

Behavioral task

behavioral27

Sample

resources/app.asar.unpacked/node_modules/deasync/bin/linux-x64-node-0.11/deasync.node

Resource

ubuntu2004-amd64-20240611-en

ubuntu-20.04-amd64

0 signatures

150 seconds

Behavioral task

behavioral28

Sample

resources/app.asar.unpacked/node_modules/deasync/bin/linux-x64-node-0.12/deasync.node

Resource

ubuntu2404-amd64-20250307-en

ubuntu-24.04-amd64

0 signatures

150 seconds

Behavioral task

behavioral29

Sample

resources/app.asar.unpacked/node_modules/deasync/bin/linux-x64-node-10/deasync.node

Resource

ubuntu2004-amd64-20240729-en

ubuntu-20.04-amd64

0 signatures

150 seconds

Behavioral task

behavioral30

Sample

resources/app.asar.unpacked/node_modules/deasync/bin/linux-x64-node-11/deasync.node

Resource

ubuntu2404-amd64-20250307-en

ubuntu-24.04-amd64

0 signatures

150 seconds

Behavioral task

behavioral31

Sample

resources/app.asar.unpacked/node_modules/deasync/bin/linux-x64-node-12/deasync.node

Resource

ubuntu2404-amd64-20250307-en

ubuntu-24.04-amd64

0 signatures

150 seconds

Behavioral task

behavioral32

Sample

resources/app.asar.unpacked/node_modules/deasync/bin/linux-x64-node-13/deasync.node

Resource

ubuntu2404-amd64-20250307-en

ubuntu-24.04-amd64

0 signatures

150 seconds

Report Analysis Logs

General

Target

libGLESv2.dll
Size

7.3MB
MD5

6170726e3fac951bc339ad3ec7bc3fff
SHA1

fff178059369c4894466e9f458847f40941729e5
SHA256

ee7bdb05f40ca11bb24bc0530775533ea0b3333507682ff64587be9b4aca7da3
SHA512

27aa306196bf0c1dbad4986e2b05d3bb30d5416a7788fa91a5f67012f9aa476e7b5319ebd1a93589f49ffe15617723cbe79f23ca4edd58bc73342ffec9f00550
SSDEEP

98304:LDRTxwF+JsIp05zu0uDqqvE9xLHvKMZ3R6hf:LDJlJsYQAqj/oF

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2216 wrote to memory of 2276	2216	rundll32.exe	29
PID 2216 wrote to memory of 2276	2216	rundll32.exe	29
PID 2216 wrote to memory of 2276	2216	rundll32.exe	29

Processes

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\libGLESv2.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2216
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2216 -s 92
  2⤵
  PID:2276

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads