Overview

overview

7

Static

static

3

quarantine...er.exe

windows10-2004-x64

7

quarantine...er.exe

windows11-ltsc_2024-x64

7

Analysis

  • max time kernel
    150s
  • max time network
    113s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    19/08/2026, 19:08

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    quarantine-spoofer.exe
  • Size 71.0MB
  • Sample260819-xtqspstyaw
  • SHA256 1fd1190087aefb1ccb53c6b136f8612e4c8037fef74e486d2de12b42d30fedcf
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10

Malware Config

Signatures

  • Loads dropped DLL 50 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\quarantine-spoofer.exe
    "C:\Users\Admin\AppData\Local\Temp\quarantine-spoofer.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of SetWindowsHookEx
    PID:5052

Network

        MITRE ATT&CK Matrix

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        Microsoft.Win32.Primitives.dll
        • Path C:\Users\Admin\AppData\Local\Temp\.net\quarantine-spoofer\t4rINmLBRpMf\Microsoft.Win32.Primitives.dll
        • Size 25KB
        • SHA256 bf331d23dc7e740ec28121a57bb09ee29acc1240cb34b151ed9202e00f9d76af
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Microsoft.Win32.Registry.dll
        • Path C:\Users\Admin\AppData\Local\Temp\.net\quarantine-spoofer\t4rINmLBRpMf\Microsoft.Win32.Registry.dll
        • Size 85KB
        • SHA256 be5d31d5428c3fdeafc5708cea76237401a746e39be8a0ce4e914cba376ec457
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Microsoft.Win32.SystemEvents.dll
        • Path C:\Users\Admin\AppData\Local\Temp\.net\quarantine-spoofer\t4rINmLBRpMf\Microsoft.Win32.SystemEvents.dll
        • Size 85KB
        • SHA256 b84b745f291b6783534e6478ba7890b7467fd3de394f3364f04507a0e60dc17e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        System.Collections.Concurrent.dll
        • Path C:\Users\Admin\AppData\Local\Temp\.net\quarantine-spoofer\t4rINmLBRpMf\System.Collections.Concurrent.dll
        • Size 241KB
        • SHA256 3b73a02a0d05d3ca14d66568c193e74b64d0c7b055248afbc9ffb89fe46d6472
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        System.Collections.NonGeneric.dll
        • Path C:\Users\Admin\AppData\Local\Temp\.net\quarantine-spoofer\t4rINmLBRpMf\System.Collections.NonGeneric.dll
        • Size 98KB
        • SHA256 9d324eb05f5a970a4c00ed3a3b54a8de8525f7c4c891b9be48c56ae5e655b0e3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        System.Collections.Specialized.dll
        • Path C:\Users\Admin\AppData\Local\Temp\.net\quarantine-spoofer\t4rINmLBRpMf\System.Collections.Specialized.dll
        • Size 93KB
        • SHA256 35486206115ad8787585928a1bdddfe5c0a0418ea61396432cf67649b4896baa
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        System.Collections.dll
        • Path C:\Users\Admin\AppData\Local\Temp\.net\quarantine-spoofer\t4rINmLBRpMf\System.Collections.dll
        • Size 258KB
        • SHA256 99f781186bf13a6e0c3dbb627f27aea398b37f8d14d4082e9e1b0c872e7720c9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        System.ComponentModel.EventBasedAsync.dll
        • Path C:\Users\Admin\AppData\Local\Temp\.net\quarantine-spoofer\t4rINmLBRpMf\System.ComponentModel.EventBasedAsync.dll
        • Size 37KB
        • SHA256 02bbd51cd2dc5a9fa5ffa1cf21c1329657900475ff82595d764e10d1252eab64
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        System.ComponentModel.Primitives.dll
        • Path C:\Users\Admin\AppData\Local\Temp\.net\quarantine-spoofer\t4rINmLBRpMf\System.ComponentModel.Primitives.dll
        • Size 73KB
        • SHA256 1b00f2d90f6830c6f4dd7bfade4edf41ab7a42f716223704ebb0b4b746e3625e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        System.ComponentModel.TypeConverter.dll
        • Path C:\Users\Admin\AppData\Local\Temp\.net\quarantine-spoofer\t4rINmLBRpMf\System.ComponentModel.TypeConverter.dll
        • Size 730KB
        • SHA256 128d9ae5e9ab4b9bd50c7ad3bed4c44cbc967f505f986c28d36f3156a1ae002e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        System.ComponentModel.dll
        • Path C:\Users\Admin\AppData\Local\Temp\.net\quarantine-spoofer\t4rINmLBRpMf\System.ComponentModel.dll
        • Size 18KB
        • SHA256 0988137de65adaaf26fd29aac531a659324c1353a031583ea1d5ddf4a95d9145
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        System.Console.dll
        • Path C:\Users\Admin\AppData\Local\Temp\.net\quarantine-spoofer\t4rINmLBRpMf\System.Console.dll
        • Size 153KB
        • SHA256 509848bb0f4551253694749fc2a94b99e3d7414fb72110f31de3356859a1e800
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        System.Diagnostics.DiagnosticSource.dll
        • Path C:\Users\Admin\AppData\Local\Temp\.net\quarantine-spoofer\t4rINmLBRpMf\System.Diagnostics.DiagnosticSource.dll
        • Size 371KB
        • SHA256 4fa86a656e47f751cb47c06f27879ffeeb028922b67b50c3db518999d51ee455
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        System.Diagnostics.FileVersionInfo.dll
        • Path C:\Users\Admin\AppData\Local\Temp\.net\quarantine-spoofer\t4rINmLBRpMf\System.Diagnostics.FileVersionInfo.dll
        • Size 34KB
        • SHA256 02b7303d1b3d7b4619856dd9b76aa67742266b0db9270d44e3b1cc99ff704f2a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        System.Diagnostics.Process.dll
        • Path C:\Users\Admin\AppData\Local\Temp\.net\quarantine-spoofer\t4rINmLBRpMf\System.Diagnostics.Process.dll
        • Size 283KB
        • SHA256 1bcb92989f22b2d8efee51538f7f369d7cc61fcf17ea1bdda158cde557420853
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        System.Diagnostics.TraceSource.dll
        • Path C:\Users\Admin\AppData\Local\Temp\.net\quarantine-spoofer\t4rINmLBRpMf\System.Diagnostics.TraceSource.dll
        • Size 130KB
        • SHA256 a9c94fbce8f682f2e8391c33b49cfa5b2208c9210cde95c748887bd7c6e6c2c8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        System.Drawing.Common.dll
        • Path C:\Users\Admin\AppData\Local\Temp\.net\quarantine-spoofer\t4rINmLBRpMf\System.Drawing.Common.dll
        • Size 1018KB
        • SHA256 2b2957201e842e9bf126d4b6f0d9fa7c6056829bb8e3283f706b6af959073ed5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        System.Drawing.Primitives.dll
        • Path C:\Users\Admin\AppData\Local\Temp\.net\quarantine-spoofer\t4rINmLBRpMf\System.Drawing.Primitives.dll
        • Size 127KB
        • SHA256 a8fc5b44ca6ea84c7b5ffdab3c19d4f1e5096635bf03e45da573a93923cd588b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        System.Linq.dll
        • Path C:\Users\Admin\AppData\Local\Temp\.net\quarantine-spoofer\t4rINmLBRpMf\System.Linq.dll
        • Size 525KB
        • SHA256 770df7c55f731f822811000b901eae379518299ae68f550a6690ab88d2dfc34f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        System.Memory.dll
        • Path C:\Users\Admin\AppData\Local\Temp\.net\quarantine-spoofer\t4rINmLBRpMf\System.Memory.dll
        • Size 169KB
        • SHA256 2ee8e3efc4a7499d903da9829e88bba241f12a1c0a35e697f205f1de76aca762
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        System.Net.Http.dll
        • Path C:\Users\Admin\AppData\Local\Temp\.net\quarantine-spoofer\t4rINmLBRpMf\System.Net.Http.dll
        • Size 1.7MB
        • SHA256 6e38c3f2c0f23355f271925119fa32d66d6c2ca88f60806526f499f7d83d9bf7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        System.Net.NameResolution.dll
        • Path C:\Users\Admin\AppData\Local\Temp\.net\quarantine-spoofer\t4rINmLBRpMf\System.Net.NameResolution.dll
        • Size 98KB
        • SHA256 f9bdc89737e7d313ed38ba42aeaef855338a8cf8d21db672c98ce07150489c22
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        System.Net.Primitives.dll
        • Path C:\Users\Admin\AppData\Local\Temp\.net\quarantine-spoofer\t4rINmLBRpMf\System.Net.Primitives.dll
        • Size 209KB
        • SHA256 410ddcfb533a40aacb115bcdb9f5d7f529e40f730520b5332f9995de68a28b1f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        System.Net.Security.dll
        • Path C:\Users\Admin\AppData\Local\Temp\.net\quarantine-spoofer\t4rINmLBRpMf\System.Net.Security.dll
        • Size 669KB
        • SHA256 a55d63fbe73e2495bd10c750e2d13ada850aec825a40c1e0394d97194e4baef1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        System.Net.Sockets.dll
        • Path C:\Users\Admin\AppData\Local\Temp\.net\quarantine-spoofer\t4rINmLBRpMf\System.Net.Sockets.dll
        • Size 494KB
        • SHA256 f8911b4a573c050951660d483dd3f8a45887b74356f98a4444c483f61e8f5276
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        System.Net.WebHeaderCollection.dll
        • Path C:\Users\Admin\AppData\Local\Temp\.net\quarantine-spoofer\t4rINmLBRpMf\System.Net.WebHeaderCollection.dll
        • Size 59KB
        • SHA256 60ceefb00af005cb2ae6c78932129af284a57e95ce90968e9daeccfad6958dad
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        System.ObjectModel.dll
        • Path C:\Users\Admin\AppData\Local\Temp\.net\quarantine-spoofer\t4rINmLBRpMf\System.ObjectModel.dll
        • Size 89KB
        • SHA256 8f0971c99af21f0ac666de224f62e0f99b328d7d4150d4dbe3b97142064b9943
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        System.Private.CoreLib.dll
        • Path C:\Users\Admin\AppData\Local\Temp\.net\quarantine-spoofer\t4rINmLBRpMf\System.Private.CoreLib.dll
        • Size 10.1MB
        • SHA256 3ce6f27555e6ce2dc1d314012a5798a1a62b4527813c085548f7d937f83da74a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        System.Private.DataContractSerialization.dll
        • Path C:\Users\Admin\AppData\Local\Temp\.net\quarantine-spoofer\t4rINmLBRpMf\System.Private.DataContractSerialization.dll
        • Size 2.0MB
        • SHA256 ecb3a427e4e730c378920e993ab14b2e41339bbce73b94f094e2141e87fb484c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        System.Private.Uri.dll
        • Path C:\Users\Admin\AppData\Local\Temp\.net\quarantine-spoofer\t4rINmLBRpMf\System.Private.Uri.dll
        • Size 246KB
        • SHA256 21bdb07069d76722c7168a8950d10d36211278b9b1c5bb794fb8504ed883b231
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        System.Private.Xml.dll
        • Path C:\Users\Admin\AppData\Local\Temp\.net\quarantine-spoofer\t4rINmLBRpMf\System.Private.Xml.dll
        • Size 8.1MB
        • SHA256 72cea6c4b2949448438e6f354967d85358c38381e94bc7208d585bd6cabcb077
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        System.Resources.Extensions.dll
        • Path C:\Users\Admin\AppData\Local\Temp\.net\quarantine-spoofer\t4rINmLBRpMf\System.Resources.Extensions.dll
        • Size 118KB
        • SHA256 d1cac5ed12f37fc9a4dd5119e10b4c07a4cf52a1091f0e4b98f6df8e70947d66
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        System.Runtime.CompilerServices.Unsafe.dll
        • Path C:\Users\Admin\AppData\Local\Temp\.net\quarantine-spoofer\t4rINmLBRpMf\System.Runtime.CompilerServices.Unsafe.dll
        • Size 22KB
        • SHA256 8b25554163a2e55014a3af5cdcf65028499596d4a02f3df1bd76020ba41f9a8e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        System.Runtime.InteropServices.dll
        • Path C:\Users\Admin\AppData\Local\Temp\.net\quarantine-spoofer\t4rINmLBRpMf\System.Runtime.InteropServices.dll
        • Size 50KB
        • SHA256 cab4e96d3ddf225acfb610a53ef299fb9e7deb74ab374e3976d799c77dfa8770
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        System.Runtime.Numerics.dll
        • Path C:\Users\Admin\AppData\Local\Temp\.net\quarantine-spoofer\t4rINmLBRpMf\System.Runtime.Numerics.dll
        • Size 216KB
        • SHA256 1d55226f4d06b5990d9beb68ecaa6da71271cbc5350cb01994eae5253f8595f8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        System.Runtime.Serialization.Primitives.dll
        • Path C:\Users\Admin\AppData\Local\Temp\.net\quarantine-spoofer\t4rINmLBRpMf\System.Runtime.Serialization.Primitives.dll
        • Size 28KB
        • SHA256 887dbbe094028444a716de644aed163b18b3f944ce723b23601047a2f1ce4243
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        System.Security.Claims.dll
        • Path C:\Users\Admin\AppData\Local\Temp\.net\quarantine-spoofer\t4rINmLBRpMf\System.Security.Claims.dll
        • Size 92KB
        • SHA256 f7dd8196dbbb1c8fb65a4aaef8ffd7e78eec95eec583f300b43f288543905e73
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        System.Security.Cryptography.Algorithms.dll
        • Path C:\Users\Admin\AppData\Local\Temp\.net\quarantine-spoofer\t4rINmLBRpMf\System.Security.Cryptography.Algorithms.dll
        • Size 789KB
        • SHA256 03fda7c0f12533ae0f9cc4f35d2249240e097fbc69481f424ebb62332de167d5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        System.Security.Cryptography.Encoding.dll
        • Path C:\Users\Admin\AppData\Local\Temp\.net\quarantine-spoofer\t4rINmLBRpMf\System.Security.Cryptography.Encoding.dll
        • Size 91KB
        • SHA256 17eb5e22783d98f6afa99944f895ccdea80ed5543ec38f1cd6ab7e8d2401fbaf
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        System.Security.Cryptography.Primitives.dll
        • Path C:\Users\Admin\AppData\Local\Temp\.net\quarantine-spoofer\t4rINmLBRpMf\System.Security.Cryptography.Primitives.dll
        • Size 131KB
        • SHA256 5be377e524e34bbd766462c3eb879f33e5ee964456bb128b0f7772b387a7ebfa
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        System.Security.Cryptography.X509Certificates.dll
        • Path C:\Users\Admin\AppData\Local\Temp\.net\quarantine-spoofer\t4rINmLBRpMf\System.Security.Cryptography.X509Certificates.dll
        • Size 555KB
        • SHA256 dbf74ec3aaa3f5a12f8efa2fc690934697ecc362486cb71e350a369ea28cd6c3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        System.Security.Principal.Windows.dll
        • Path C:\Users\Admin\AppData\Local\Temp\.net\quarantine-spoofer\t4rINmLBRpMf\System.Security.Principal.Windows.dll
        • Size 148KB
        • SHA256 4a895ea1e7437452ebf95803fe92a3748cff32a361e54d5cb42f0a7da8d9a0d7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        System.Text.Encodings.Web.dll
        • Path C:\Users\Admin\AppData\Local\Temp\.net\quarantine-spoofer\t4rINmLBRpMf\System.Text.Encodings.Web.dll
        • Size 128KB
        • SHA256 2510cab747ac9001de4232d040a69dfa54c847665b2ae48009393d3e3b248f7a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        System.Text.Json.dll
        • Path C:\Users\Admin\AppData\Local\Temp\.net\quarantine-spoofer\t4rINmLBRpMf\System.Text.Json.dll
        • Size 1.4MB
        • SHA256 cb8099974cdf5cc1ce96ff0df8975aa0d625a56ab0996575b4441fdd155230e0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        System.Text.RegularExpressions.dll
        • Path C:\Users\Admin\AppData\Local\Temp\.net\quarantine-spoofer\t4rINmLBRpMf\System.Text.RegularExpressions.dll
        • Size 517KB
        • SHA256 612ed9ab7b619f7e5e4d37568e6ec1847ba286d2ea5b95a246f67c7af78d3f08
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        System.Threading.dll
        • Path C:\Users\Admin\AppData\Local\Temp\.net\quarantine-spoofer\t4rINmLBRpMf\System.Threading.dll
        • Size 78KB
        • SHA256 dc2ac768bb9b05766b009b6efaef4479d5db5c768ee1d3de3eda136e420ff94c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        System.Windows.Forms.Primitives.dll
        • Path C:\Users\Admin\AppData\Local\Temp\.net\quarantine-spoofer\t4rINmLBRpMf\System.Windows.Forms.Primitives.dll
        • Size 773KB
        • SHA256 010553920050f185955eb351ca61a90e2045b80dc34cec5fe87d9d64520bc7fd
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        System.Windows.Forms.dll
        • Path C:\Users\Admin\AppData\Local\Temp\.net\quarantine-spoofer\t4rINmLBRpMf\System.Windows.Forms.dll
        • Size 12.7MB
        • SHA256 2168f4794bcf938f7ecf7b9b062dd676e3af5d19ad446e1ca3af966e08d5a446
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        quarantine-spoofer.dll
        • Path C:\Users\Admin\AppData\Local\Temp\.net\quarantine-spoofer\t4rINmLBRpMf\quarantine-spoofer.dll
        • Size 1.9MB
        • SHA256 ea19193638e21aa03647a470fb52f73aa71d6301823b227ffdb64e3d44756f92
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download