Analysis
- max time kernel
149s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260618-en - resource tags
- submitted
20/06/2026, 04:37
General
- Target Spoofer.exe
- Size 12.1MB
- Sample260620-e8zp2set8z
- SHA256 f2c8ae5bd9c07fc3f66cb76b66ae7a2519fd4a300ce6baed2f3e4d23fdc049a8
Malware Config
Signatures
- Loads dropped DLL 23 IoCs
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Using powershell.exe command.
- Hide Artifacts: Ignore Process Interrupts 1 TTPs 1 IoCs
Command interpreters often include specific commands/flags that ignore errors and other hangups.
- Suspicious behavior: EnumeratesProcesses 5 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of WriteProcessMemory 11 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Spoofer.exe"C:\Users\Admin\AppData\Local\Temp\Spoofer.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Spoofer.exe"C:\Users\Admin\AppData\Local\Temp\Spoofer.exe"2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "(Get-Process Python -ErrorAction SilentlyContinue | Where-Object {$_.MainWindowTitle -like \"*Spoofer*\"}).Id | ForEach-Object { if ($_ -ne 5196) { Stop-Process -Id $_ -Force } }"3⤵
- Hide Artifacts: Ignore Process Interrupts
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c chcp 65001 >nul 2>&13⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\chcp.comchcp 650014⤵
-
-
-
C:\Windows\SYSTEM32\cmd.execmd /c title "Spoofer - Modded by bao8jl"3⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "mode con: cols=110 lines=30"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\mode.commode con: cols=110 lines=304⤵
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -NoProfile -Command " Add-Type -AssemblyName System.Windows.Forms $screen = [System.Windows.Forms.Screen]::PrimaryScreen $screen_w = $screen.WorkingArea.Width $screen_h = $screen.WorkingArea.Height Add-Type @\" using System; using System.Runtime.InteropServices; public class Win32 { [DllImport(\"user32.dll\")] public static extern bool GetWindowRect(IntPtr hWnd, out RECT lpRect); [DllImport(\"kernel32.dll\")] public static extern IntPtr GetConsoleWindow(); [DllImport(\"user32.dll\")] public static extern bool SetWindowPos(IntPtr hWnd, IntPtr hWndInsertAfter, int X, int Y, int cx, int cy, uint uFlags); [StructLayout(LayoutKind.Sequential)] public struct RECT { public int Left, Top, Right, Bottom; } } \"@ $console = [Win32]::GetConsoleWindow() $rect = New-Object Win32+RECT [Win32]::GetWindowRect($console, [ref]$rect) | Out-Null $win_w = $rect.Right - $rect.Left $win_h = $rect.Bottom - $rect.Top $x = [int](($screen_w - $win_w) / 2) + 0 $y = [int](($screen_h - $win_h) / 2) [Win32]::SetWindowPos($console, [IntPtr]::Zero, $x, $y, 0, 0, 0x0040 -bor 0x0001) | Out-Null "3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\3ujclok1\3ujclok1.cmdline"4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES1BDB.tmp" "c:\Users\Admin\AppData\Local\Temp\3ujclok1\CSC2267465C338C4E83B0BAC8F291EA4C8.TMP"5⤵
-
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cls3⤵
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
StartupProfileData-NonInteractive
3ujclok1.dll
RES1BDB.tmp
81d243bd2c585b0f4821__mypyc.cp314-win_amd64.pyd
VCRUNTIME140.dll
VCRUNTIME140_1.dll
_bz2.pyd
_ctypes.pyd
_hashlib.pyd
_lzma.pyd
_queue.pyd
_socket.pyd
_ssl.pyd
_uuid.pyd
_wmi.pyd
_zstd.pyd
base_library.zip
cd.cp314-win_amd64.pyd
libcrypto-3.dll
libffi-8.dll
libssl-3.dll
python314.dll
pywintypes314.dll
select.pyd
Lorem ipsum.txt
unicodedata.pyd
win32api.pyd
win32security.pyd
3ujclok1.0.cs
3ujclok1.cmdline
CSC2267465C338C4E83B0BAC8F291EA4C8.TMP
memory/3380-114-0x00000184984B0000-0x00000184984B8000-memory.dmp
memory/5496-93-0x00007FFBD66F0000-0x00007FFBD7094000-memory.dmp
memory/5496-98-0x00007FFBD66F0000-0x00007FFBD7094000-memory.dmp
memory/5496-97-0x00007FFBD66F0000-0x00007FFBD7094000-memory.dmp
memory/5496-86-0x00007FFBD687F000-0x00007FFBD6880000-memory.dmp
memory/5496-95-0x00007FFBD66F0000-0x00007FFBD7094000-memory.dmp
memory/5496-94-0x00007FFBD66F0000-0x00007FFBD7094000-memory.dmp
memory/5496-89-0x0000024642C90000-0x0000024642CB2000-memory.dmp
memory/5496-92-0x00007FFBD66F0000-0x00007FFBD7094000-memory.dmp
memory/5496-91-0x00007FFBD66F0000-0x00007FFBD7094000-memory.dmp
memory/5496-90-0x00007FFBD66F0000-0x00007FFBD7094000-memory.dmp