26fa463acbb1e6bb3d65e4bc8d9cb0f929df9765accb93162dbef97fd161033e

Analysis

max time kernel
149s
max time network
147s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
28/08/2026, 13:04

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
spoofer (2).exe
Size 9.0MB
Sample260828-qbejdsak21
SHA256 26fa463acbb1e6bb3d65e4bc8d9cb0f929df9765accb93162dbef97fd161033e
MD5 b39748b2e4eafbeb7c4008ee36817c2e
SHA1 58f7f8628a7e0205e08caf1b064fcbb738e6df2e
SHA512 de462a61709767ae901613ed27863b4778e53e19fab1c35564e42edb8243805ddc8737b7d6c3fc317628ec8f8076ee597e4f64cc8ae0eda1aa9eb5754af48f34
SSDEEP 196608:hztWTaaz0xuBwB9drbdXQaN+MofR4RmhM97X8HswqEcCTFJE7E:5naQx/hrbdXQfM6R4RmhMaHswqEPR
TLSH
T1A8A63359EBF511FAE47F113D49A8920BF3A17C130BA1C9DF17A40B2B1E772A4483D626
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Signatures

Loads dropped DLL 10 IoCs

pid	Process
2192	spoofer (2).exe
2192	spoofer (2).exe
2192	spoofer (2).exe
2192	spoofer (2).exe
2192	spoofer (2).exe
2192	spoofer (2).exe
2192	spoofer (2).exe
2192	spoofer (2).exe
2192	spoofer (2).exe
2192	spoofer (2).exe

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 1256 set thread context of 2136	1256	spoofer (2).exe	90
PID 2192 set thread context of 1044	2192	spoofer (2).exe	92

Suspicious use of WriteProcessMemory 15 IoCs

description	pid	Process	procid_target
PID 1256 wrote to memory of 2136	1256	spoofer (2).exe	90
PID 1256 wrote to memory of 2136	1256	spoofer (2).exe	90
PID 1256 wrote to memory of 2136	1256	spoofer (2).exe	90
PID 1256 wrote to memory of 2136	1256	spoofer (2).exe	90
PID 1256 wrote to memory of 2136	1256	spoofer (2).exe	90
PID 1256 wrote to memory of 2136	1256	spoofer (2).exe	90
PID 1256 wrote to memory of 2136	1256	spoofer (2).exe	90
PID 1256 wrote to memory of 2192	1256	spoofer (2).exe	91
PID 2192 wrote to memory of 1044	2192	spoofer (2).exe	92
PID 2192 wrote to memory of 1044	2192	spoofer (2).exe	92
PID 2192 wrote to memory of 1044	2192	spoofer (2).exe	92
PID 2192 wrote to memory of 1044	2192	spoofer (2).exe	92
PID 2192 wrote to memory of 1044	2192	spoofer (2).exe	92
PID 2192 wrote to memory of 1044	2192	spoofer (2).exe	92
PID 2192 wrote to memory of 1044	2192	spoofer (2).exe	92

C:\Users\Admin\AppData\Local\Temp\spoofer (2).exe
"C:\Users\Admin\AppData\Local\Temp\spoofer (2).exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1256
- C:\Users\Admin\AppData\Local\Temp\spoofer (2).exe
  "C:\Users\Admin\AppData\Local\Temp\spoofer (2).exe"
  2⤵
  PID:2136
- C:\Users\Admin\AppData\Local\Temp\spoofer (2).exe
  "C:\Users\Admin\AppData\Local\Temp\spoofer (2).exe"
  2⤵
  - Loads dropped DLL
  - Suspicious use of SetThreadContext
  - Suspicious use of WriteProcessMemory
  PID:2192
- - C:\Users\Admin\AppData\Local\Temp\spoofer (2).exe
    "C:\Users\Admin\AppData\Local\Temp\spoofer (2).exe"
    3⤵
    PID:1044

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

VCRUNTIME140.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI12562\VCRUNTIME140.dll
Size 117KB
SHA256 052ad6a20d375957e82aa6a3c441ea548d89be0981516ca7eb306e063d5027f4
MD5 32da96115c9d783a0769312c0482a62d
SHA1 2ea840a5faa87a2fe8d7e5cb4367f2418077d66b
SHA512 616c78b4a24761d4640ae2377b873f7779322ef7bc26f8de7da0d880b227c577ed6f5ed794fc733468477b2fcdb7916def250e5dc63e79257616f99768419087
SSDEEP 1536:Z9TXF5YXWbj8qr51XlN+dULTCe1IGhKWyxLiyaXYaNxoecbdhUoaLjTz164zEd:ZEnsvReGsWyxLizXFkecbd1aPTzW
TLSH
T10DC38C8572A002FBD16AC274C1A36A17FB75B94487B0A7CF03B58A650F53BE09E3D356
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_bz2.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI12562\_bz2.pyd
Size 85KB
SHA256 33641a8ad0403473d678c7435197d49550fc5185ba7979fb16ab80256b1f9072
MD5 98aa4ec9b691267912bcb3336fc7cafc
SHA1 8955d7e923c4bf05d84a03666ec8cdb4fab2f616
SHA512 62084c7077ed896b92055e5a278651d6eeca65622321e389e551e8a331b51c9fe2a5eb1b903eaed41117a7a8efce514b9d62acf2b62985d1535812ab59011387
SSDEEP 1536:w1sxz74jpCk2wWdyOeR3RYZvksL8DdRbEvtwIA3V4y7NsR9KfIkWO:GsxzsIdtYOeRuZcsYZlitwIA3VU
TLSH
T162838D82E3A462B7F59F91B4D7810753F730FF560710A3AFB25482863F12B91AE58366
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_ctypes.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI12562\_ctypes.pyd
Size 139KB
SHA256 79967d8614f735cc62b81649641fd8d0414ca66d3d6656fa7788334bbdbbd35b
MD5 409e2c98beb0554395f65fc8b55951c7
SHA1 f7e25afa8bd80fa8ed709aed8ced4374c0f1ed93
SHA512 8babb6fe295975868c1aa57c63dcab6f2cd151ba7074848dc7da27de2ea46a886496754b7c7e09b043ec5dc2813d30cbdbaa136f0f26302a1b7246a5da7962a7
SSDEEP 3072:5Dpx2Lp7KR+FrkdOJWWcovIXBzTKRFyxpMIAGPwuTkY:tpxCtKUr8WDvIXBnU8xppkY
TLSH
T1DDD38E4B736840A6DA678138C6739E47EBB1F4521A1087CF4264C99B1F633A2AF3F715
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_hashlib.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI12562\_hashlib.pyd
Size 67KB
SHA256 58c5c9ff93f989e2a233b8c5e06420ea73dd6c013e1f08d996fb0f2828eba0aa
MD5 c435a8d2988b2b248664a45ac26b8b14
SHA1 224adc85a39374e72de0383810aa747a7bc89705
SHA512 480a76ad73ce1942751af83fca8913e3a36961876b15341035162a121b71aa0a86e992d3b6ca54a8a7ae7d43efc24fe8a824819f833c539a2abd30c41257d62c
SSDEEP 1536:2qCcJ6CJ2GEioPMc5Wv52ztK4oIADIJy7NsR9BfIkH:xCcEyG1X5Wv52zBoIADI4
TLSH
T1F3636C46A6984092D62382B5C9E34E43FA74F6512B1197CFA239C1CD2F233C3677B75A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_lzma.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI12562\_lzma.pyd
Size 157KB
SHA256 a01f1927adaa60adcfbe3b0314205a528cb9dd5a93b7e61cb284eddee9b0b347
MD5 d5e9416137026497171e131dff6e569f
SHA1 16de80a710940e38537d1d2aea22bc33d5948591
SHA512 e7cb2a3c68e7f5129a4712b38b81fc84fc57881bd1d087c755ba16ee6d892be7ec0708a30465d2a28fe9b587226f233e02a2f512f861ad58012b5b80fe7c1927
SSDEEP 3072:QJ66gwnM5uNIJfuPdX+ENYQrHznfx9mNopUpdgwIAI1ho:QURwnNIk1XrBrTpYOQgL
TLSH
T11AF35C86B794F0E6F3628C38D6624F57E6F578190320929A01CC976D2B1FB759A2F313
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_zstd.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI12562\_zstd.pyd
Size 491KB
SHA256 e5924e2985186797668dd3b2e1efeb9313459258a4564dbf5499935c7ebd44e7
MD5 a75e9eb46c217f915fb8db1deed6dbb3
SHA1 b7e1bb9e18856a93b405c8adff3a198695b37d50
SHA512 c160a4681d9e5ecbeaa9416e294883fae9a212e28a8fdee5b86181f7e1cb35b9f1352e2af7894ae1023fb839e75d4fcaa4c5bc61024bd7cf0e261e21edb02cfb
SSDEEP 6144:dZ87M+EgY9pB2l1eUVcnmw3Vh4S+zKhThruVxzeeO07WEz9LKE+UIHHHRToSH2l4:vNcumw3vT8eeOyWEz8xHnRTrWl93R9D
TLSH
T17AB48D43F29943EDE13BC4B8CF565A13FBB1780B1214965B9395CB993F07B309A6A309
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

base_library.zip

Path C:\Users\Admin\AppData\Local\Temp\_MEI12562\base_library.zip
Size 1.3MB
SHA256 4b2ba87cd26477939e75eaa3e3045b5e1a77d72c092d13096ba56b476d7252fa
MD5 ffaf01f785ea0cd8a12bed7c911cc1ed
SHA1 441c7fd5bc6aabdfc93fe55e94be6f1fec89032d
SHA512 6f8425a25662452b6d5bdcdb936ca049829451efb6097f40979277c4062dc97f32bf5ca21340494e5ab4f54df2201834cba8c94a9ddea90aa14e83caca709a16
SSDEEP 24576:c3repd9+QeOdP2m2dfALduUFsXslbURpW+:c38d9+/wuUFqRj
TLSH
T171552AA1B9917867FEC9F37A35775A0CA715C0109B20D303B4A98DAC6FDF260AE158DC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libcrypto-3.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI12562\libcrypto-3.dll
Size 5.0MB
SHA256 eaf6d613b95b61a39558d84c50e72630a66c99914292df88e7b54ebd60c5bd34
MD5 7e8a8461fcd43c82841a99a2054711f1
SHA1 a931808c56e3a117795491965cb3f679cdc05886
SHA512 023c34e26b7dc7240d4571f8f808bdd0b749bd6e924948c3db9c5bb4f7acf24557d3a94bfe6ff82697f9747b35c13a73b94482dff3568e1dadb8fe08b598bc61
SSDEEP 98304:on+c+4Vp8XhjqO58Pw1CPwDvt3uFlDCQ9p:mPTVpghjqO5841CPwDvt3uFlDCQ/
TLSH
T147367B6AA7A80189E4BAC13CC9534617D2B1F81A57B097CF18A156BD0F37FDA2B3D740
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libffi-8.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI12562\libffi-8.dll
Size 38KB
SHA256 eff52743773eb550fcc6ce3efc37c85724502233b6b002a35496d828bd7b280a
MD5 0f8e4992ca92baaf54cc0b43aaccce21
SHA1 c7300975df267b1d6adcbac0ac93fd7b1ab49bd2
SHA512 6e1b223462dc124279bfca74fd2c66fe18b368ffbca540c84e82e0f5bcbea0e10cc243975574fa95ace437b9d8b03a446ed5ee0c9b1b094147cefaf704dfe978
SSDEEP 768:NiQfxQemQJNrPN+moyijAc5YiSyvkIPxWEqG:dfxIQvPkmoyijP7SytPxF
TLSH
T10B037C0B458418A4E657D53D97A64A2AC335B9240B60F2CB03D4C2BA3F6B7D6FB7C358
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

python314.DLL

Path C:\Users\Admin\AppData\Local\Temp\_MEI12562\python314.DLL
Size 6.5MB
SHA256 a07f7d09c3121492bb066535c6d0811df5fbc2090cbca7031a97bb47ce1480c9
MD5 e823b990ba85afa143b799c291058dce
SHA1 3e53a71a5c72c3011bee19a792a6552a0d702671
SHA512 fc9b0a6795993e1c4519622726647c33c415a9aa9983daa52d1f9f371c58fb74067599052f5b9c25f5acc08ed15021221dc524543a4de87b5705bba145a1b622
SSDEEP 98304:6PEfNNEwwP1Fyh4NIyDB7Qfo7wavAHDMiEuGC:tfXEwM1Eh4ayDpji1
TLSH
T180669E26737401A5D9BB8035CA074647DBB1BC00AB30D34B59A47ADA3F733635BAEB85
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ucrtbase.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI12562\ucrtbase.dll
Size 1.1MB
SHA256 c04daeba7e7c4b711d33993ab4c51a2e087f98f4211aea0dcb3a216656ba0ab7
MD5 3b337c2d41069b0a1e43e30f891c3813
SHA1 ebee2827b5cb153cbbb51c9718da1549fa80fc5c
SHA512 fdb3012a71221447b35757ed2bdca6ed1f8833b2f81d03aabebd2cd7780a33a9c3d816535d03c5c3edd5aaf11d91156842b380e2a63135e3c7f87193ad211499
SSDEEP 24576:CJG2BrB3ZQAq0AT2jS9HKHdK6AccMs1wmxvSZX0ypFi:0VGrT6SAk3ei
TLSH
T1EC359D64B76C02A9C97BE13DC927554AFA73380147709ACB03E74AB93E2B7E552B7310
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1044-68-0x0000000140000000-0x0000000140050000-memory.dmp

Download

memory/1256-0-0x0000000140000000-0x0000000140945000-memory.dmp

Download

memory/1256-85-0x0000000140000000-0x0000000140945000-memory.dmp

Download

memory/2136-51-0x0000000140000000-0x0000000140050000-memory.dmp

Download

memory/2136-50-0x0000000140000000-0x0000000140050000-memory.dmp

Download

memory/2192-60-0x0000000140000000-0x0000000140945000-memory.dmp

Download

memory/2192-84-0x0000000140000000-0x0000000140945000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads