3727825d6e44ba07f9e271dae186d443da8e632040508c5a44125b9ff5d142c1

Analysis

user interaction
yes
max time kernel
148s
max time network
134s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
08/08/2026, 14:31

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
spoofer.exe
Size 18.0MB
Sample260808-rv687adh84
SHA256 3727825d6e44ba07f9e271dae186d443da8e632040508c5a44125b9ff5d142c1
MD5 34b99edda7d3334bcb9031c38c407ac9
SHA1 7a88c97244f974725e8eedda2ca0c8da82b832a2
SHA512 1f7eccac3e264ba50d867fc6a8a92aac12e905d6dd2a93a0e11c8cbed61e1581d0c5f6c11208152f41e72e4ae0fd61c5b85535a7f3b6983d7f0c21771d9afc10
SSDEEP 393216:LocFswV/b3W2+dYxShNJmzF2xBgeGf8FrGqXNbts0d:LocFswR6djfYx2ses8FGqXNbp
TLSH
T1631733C7AAC85BE4C643486DA55703C7F2C1555ACAAF8F14378F6C027562C9E060BFBA
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

defense_evasion execution

Malware Config

Signatures

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2308	cmd.exe
3868	cmd.exe
5908	cmd.exe

Delays execution with timeout.exe 1 IoCs

defense_evasion

pid	Process
956	timeout.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1212	spoofer.exe
1212	spoofer.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1212 wrote to memory of 2308	1212	spoofer.exe	89
PID 2308 wrote to memory of 2500	2308	cmd.exe	90
PID 2308 wrote to memory of 4156	2308	cmd.exe	91
PID 2308 wrote to memory of 3828	2308	cmd.exe	92
PID 1212 wrote to memory of 3868	1212	spoofer.exe	94
PID 3868 wrote to memory of 5908	3868	cmd.exe	95
PID 5908 wrote to memory of 956	5908	cmd.exe	99

C:\Users\Admin\AppData\Local\Temp\spoofer.exe
"C:\Users\Admin\AppData\Local\Temp\spoofer.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1212
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c certutil -hashfile "C:\Users\Admin\AppData\Local\Temp\spoofer.exe" MD5 | find /i /v "md5" | find /i /v "certutil"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2308
- - C:\Windows\system32\certutil.exe
    certutil -hashfile "C:\Users\Admin\AppData\Local\Temp\spoofer.exe" MD5
    3⤵
    PID:2500
- - C:\Windows\system32\find.exe
    find /i /v "md5"
    3⤵
    PID:4156
- - C:\Windows\system32\find.exe
    find /i /v "certutil"
    3⤵
    PID:3828
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c start cmd /C "color b && title Error && echo Failure when receiving data from the peer && timeout /t 5"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3868
- - C:\Windows\system32\cmd.exe
    cmd /C "color b && title Error && echo Failure when receiving data from the peer && timeout /t 5"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:5908
  - - C:\Windows\system32\timeout.exe
      timeout /t 5
      4⤵
      Delays execution with timeout.exe
      PID:956

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1212-0-0x00007FF6D3343000-0x00007FF6D3F66000-memory.dmp

Download

memory/1212-2-0x00007FFBC0AE0000-0x00007FFBC0AE2000-memory.dmp

Download

memory/1212-6-0x00007FFBBE170000-0x00007FFBBE172000-memory.dmp

Download

memory/1212-7-0x00007FFBBE180000-0x00007FFBBE182000-memory.dmp

Download

memory/1212-5-0x00007FFBBFA10000-0x00007FFBBFA12000-memory.dmp

Download

memory/1212-4-0x00007FFBBFA00000-0x00007FFBBFA02000-memory.dmp

Download

memory/1212-3-0x00007FFBC0AF0000-0x00007FFBC0AF2000-memory.dmp

Download

memory/1212-1-0x00007FFBC0AD0000-0x00007FFBC0AD2000-memory.dmp

Download

memory/1212-12-0x00007FF6D3090000-0x00007FF6D5165000-memory.dmp

Download

memory/1212-13-0x00007FF6D3343000-0x00007FF6D3F66000-memory.dmp

Download

memory/1212-14-0x00007FF6D3090000-0x00007FF6D5165000-memory.dmp

Download

memory/1212-15-0x00007FF6D3090000-0x00007FF6D5165000-memory.dmp

Download