092bcd3cf82639b3edc348e5c040fc6cb7c472928832aadf07b18dd61986675d

Analysis

max time kernel
79s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
05/02/2023, 10:07

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Memory.Cheat.exe
Size 7.8MB
Sample230205-l5mpmscd5s
SHA256 092bcd3cf82639b3edc348e5c040fc6cb7c472928832aadf07b18dd61986675d
MD5 629c1218d4df42e44c7e561aff28a152
SHA1 fada62293a56242c909621b757105a0b06f0d111
SHA512 b506389c672995e2bdc6bca6ad50d748d872d5a8c6a9dfc893f6f4940f42d09014f2b996522899b7e11d7dc37db119baf71c52303d17ee60a2d044f709974fe0
SSDEEP 196608:BGyjotdQmR5dA6l6uErSEEJwdFt1rv43cruGO1i2C:xKdQ2l6+9JYvIKuti2C
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

Malware Config

Signatures

Loads dropped DLL 9 IoCs

pid	Process
4356	Memory.Cheat.exe
4356	Memory.Cheat.exe
4356	Memory.Cheat.exe
4356	Memory.Cheat.exe
4356	Memory.Cheat.exe
4356	Memory.Cheat.exe
4356	Memory.Cheat.exe
4356	Memory.Cheat.exe
4356	Memory.Cheat.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4356	Memory.Cheat.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 3196 wrote to memory of 4356	3196	Memory.Cheat.exe	78
PID 3196 wrote to memory of 4356	3196	Memory.Cheat.exe	78
PID 4356 wrote to memory of 932	4356	Memory.Cheat.exe	79
PID 4356 wrote to memory of 932	4356	Memory.Cheat.exe	79

C:\Users\Admin\AppData\Local\Temp\Memory.Cheat.exe
"C:\Users\Admin\AppData\Local\Temp\Memory.Cheat.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3196
- C:\Users\Admin\AppData\Local\Temp\Memory.Cheat.exe
  "C:\Users\Admin\AppData\Local\Temp\Memory.Cheat.exe"
  2⤵
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4356
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "ver"
    3⤵
    PID:932

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

VCRUNTIME140.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI31962\VCRUNTIME140.dll
Size 106KB
SHA256 76fdb83fde238226b5bebaf3392ee562e2cb7ca8d3ef75983bf5f9d6c7119644
MD5 870fea4e961e2fbd00110d3783e529be
SHA1 a948e65c6f73d7da4ffde4e8533c098a00cc7311
SHA512 0b636a3cdefa343eb4cb228b391bb657b5b4c20df62889cd1be44c7bee94ffad6ec82dc4db79949edef576bff57867e0d084e0a597bf7bf5c8e4ed1268477e88
SSDEEP 1536:DcghbEGyzXJZDWnEzWG9q4lVOiVgXjO5/Auecbq8qZU34zW/K0zD:DV3iC0h9q4v6XjKAuecbq8qGISb/
MD5 SHA1 SHA512 SSDEEP

Submit Download

VCRUNTIME140.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI31962\VCRUNTIME140.dll
Size 106KB
SHA256 76fdb83fde238226b5bebaf3392ee562e2cb7ca8d3ef75983bf5f9d6c7119644
MD5 870fea4e961e2fbd00110d3783e529be
SHA1 a948e65c6f73d7da4ffde4e8533c098a00cc7311
SHA512 0b636a3cdefa343eb4cb228b391bb657b5b4c20df62889cd1be44c7bee94ffad6ec82dc4db79949edef576bff57867e0d084e0a597bf7bf5c8e4ed1268477e88
SSDEEP 1536:DcghbEGyzXJZDWnEzWG9q4lVOiVgXjO5/Auecbq8qZU34zW/K0zD:DV3iC0h9q4v6XjKAuecbq8qGISb/
MD5 SHA1 SHA512 SSDEEP

Submit Download

_bz2.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI31962\_bz2.pyd
Size 81KB
SHA256 8eecdcc250637652e6babc306ea6b8820e9e835ddd2434816d0e0fd0ca67fd14
MD5 10d42efac304861ad19821b4594fa959
SHA1 1a65f60bba991bc7e9322af1e19f193dae76d77a
SHA512 3f16dba627a133586e9d1c16d383b9461424d31892278ab984f7e6932a1cdc51445e1bec017a665bd66c0f2a9ba417387fecc5fdede36d67f8343b82a2ceb9ae
SSDEEP 1536:KouLz7p5TcaWlZkKWVa5cP6T8MsAUxZIgtVt7SyKrPxji2:JuLz9tVaDQMslxZIgtVtozxj/
MD5 SHA1 SHA512 SSDEEP

Submit Download

_bz2.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI31962\_bz2.pyd
Size 81KB
SHA256 8eecdcc250637652e6babc306ea6b8820e9e835ddd2434816d0e0fd0ca67fd14
MD5 10d42efac304861ad19821b4594fa959
SHA1 1a65f60bba991bc7e9322af1e19f193dae76d77a
SHA512 3f16dba627a133586e9d1c16d383b9461424d31892278ab984f7e6932a1cdc51445e1bec017a665bd66c0f2a9ba417387fecc5fdede36d67f8343b82a2ceb9ae
SSDEEP 1536:KouLz7p5TcaWlZkKWVa5cP6T8MsAUxZIgtVt7SyKrPxji2:JuLz9tVaDQMslxZIgtVtozxj/
MD5 SHA1 SHA512 SSDEEP

Submit Download

_ctypes.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI31962\_ctypes.pyd
Size 120KB
SHA256 af598ae52ddc6869f24d36a483b77988385a5bbbf4618b2e2630d89d10a107ee
MD5 df6be515e183a0e4dbe9cdda17836664
SHA1 a5e8796189631c1aaca6b1c40bc5a23eb20b85db
SHA512 b3f23530de7386cc4dcf6ad39141240e56d36322e3d4041e40d69d80dd529d1f8ef5f65b55cdca9641e378603b5252acfe5d50f39f0c6032fd4c307f73ef9253
SSDEEP 3072:aBxSn2prY3+52vWqw9RQfLIgRr5kNIgQPUZxhT:acuY3+uWHQfLIIkFT
MD5 SHA1 SHA512 SSDEEP

Submit Download

_ctypes.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI31962\_ctypes.pyd
Size 120KB
SHA256 af598ae52ddc6869f24d36a483b77988385a5bbbf4618b2e2630d89d10a107ee
MD5 df6be515e183a0e4dbe9cdda17836664
SHA1 a5e8796189631c1aaca6b1c40bc5a23eb20b85db
SHA512 b3f23530de7386cc4dcf6ad39141240e56d36322e3d4041e40d69d80dd529d1f8ef5f65b55cdca9641e378603b5252acfe5d50f39f0c6032fd4c307f73ef9253
SSDEEP 3072:aBxSn2prY3+52vWqw9RQfLIgRr5kNIgQPUZxhT:acuY3+uWHQfLIIkFT
MD5 SHA1 SHA512 SSDEEP

Submit Download

_lzma.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI31962\_lzma.pyd
Size 153KB
SHA256 33ae42f744d2688bb7d5519f32ff7b7489b96f4eea47f66d2009dba6a0023903
MD5 3230404a7191c6228a8772d3610e49e5
SHA1 4e8e36c89b4ff440ddff9a5b084b262c9b2394ec
SHA512 6ecce0c8e8b3d42275d486e8ff495e81e36adaaacaaa3db37844e204fcdaa6d89cb3d81c43d9e16d938cd8b6671b8800fe74a1e723a9187b0566a8f3c39d5d5b
SSDEEP 3072:jlirS97HrdVmEkGCm5heznf49mNo2OOvJ72ZIge1z7axC:jlirG0EkT7AYO2OQSE
MD5 SHA1 SHA512 SSDEEP

Submit Download

_lzma.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI31962\_lzma.pyd
Size 153KB
SHA256 33ae42f744d2688bb7d5519f32ff7b7489b96f4eea47f66d2009dba6a0023903
MD5 3230404a7191c6228a8772d3610e49e5
SHA1 4e8e36c89b4ff440ddff9a5b084b262c9b2394ec
SHA512 6ecce0c8e8b3d42275d486e8ff495e81e36adaaacaaa3db37844e204fcdaa6d89cb3d81c43d9e16d938cd8b6671b8800fe74a1e723a9187b0566a8f3c39d5d5b
SSDEEP 3072:jlirS97HrdVmEkGCm5heznf49mNo2OOvJ72ZIge1z7axC:jlirG0EkT7AYO2OQSE
MD5 SHA1 SHA512 SSDEEP

Submit Download

_queue.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI31962\_queue.pyd
Size 30KB
SHA256 39bd456267fe228a505ef4e9c8d28f948dd65123cb4d48b77da51910013fa582
MD5 045ef55136b1e580582199b3399267a2
SHA1 de54519c67a996d0a8b4164417058f4610a57376
SHA512 7b764fdc92bf10eb05bdd4116a549de67f0fa92f807d8b0eca9d718361c546dbec16ea68ef8ddec1c417530c6eb234c657e45f8c522852ab1bd7cb21976dad1c
SSDEEP 768:o+yFs6rXkmk5sNIg7UOYiSyvqdPxWEpnl:o+wNXkP5sNIg7UO7SySdPx7l
MD5 SHA1 SHA512 SSDEEP

Submit Download

_queue.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI31962\_queue.pyd
Size 30KB
SHA256 39bd456267fe228a505ef4e9c8d28f948dd65123cb4d48b77da51910013fa582
MD5 045ef55136b1e580582199b3399267a2
SHA1 de54519c67a996d0a8b4164417058f4610a57376
SHA512 7b764fdc92bf10eb05bdd4116a549de67f0fa92f807d8b0eca9d718361c546dbec16ea68ef8ddec1c417530c6eb234c657e45f8c522852ab1bd7cb21976dad1c
SSDEEP 768:o+yFs6rXkmk5sNIg7UOYiSyvqdPxWEpnl:o+wNXkP5sNIg7UO7SySdPx7l
MD5 SHA1 SHA512 SSDEEP

Submit Download

_socket.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI31962\_socket.pyd
Size 76KB
SHA256 360744663fce8dec252abbda1168f470244fdb6da5740bb7ab3171e19106e63c
MD5 0fc65ec300553d8070e6b44b9b23b8c0
SHA1 f8db6af578cf417cfcddb2ed798c571c1abd878f
SHA512 cba375a815db973b4e8babda951d1a4ca90a976e9806e9a62520a0729937d25de8e600e79a7a638d77df7f47001d8f884e88ee4497bd1e05c1dae6fa67fb3dd8
SSDEEP 1536:/2JlcAdpEVuji9/s+S+pmGQRivVia3iNIgQw97Sy2Pxe:/27ce+uji9/sT+pmGdvVp3iNIgQw9cxe
MD5 SHA1 SHA512 SSDEEP

Submit Download

_socket.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI31962\_socket.pyd
Size 76KB
SHA256 360744663fce8dec252abbda1168f470244fdb6da5740bb7ab3171e19106e63c
MD5 0fc65ec300553d8070e6b44b9b23b8c0
SHA1 f8db6af578cf417cfcddb2ed798c571c1abd878f
SHA512 cba375a815db973b4e8babda951d1a4ca90a976e9806e9a62520a0729937d25de8e600e79a7a638d77df7f47001d8f884e88ee4497bd1e05c1dae6fa67fb3dd8
SSDEEP 1536:/2JlcAdpEVuji9/s+S+pmGQRivVia3iNIgQw97Sy2Pxe:/27ce+uji9/sT+pmGdvVp3iNIgQw9cxe
MD5 SHA1 SHA512 SSDEEP

Submit Download

base_library.zip

Path C:\Users\Admin\AppData\Local\Temp\_MEI31962\base_library.zip
Size 1.7MB
SHA256 57a57014b1b66f6e4a4799769269ebb414c2faa43afbed1ac85056ef27811cce
MD5 782c690c8bec35e6a260fd857b68de10
SHA1 ac5efaf048c0a9af0757660ed59bce200a01166a
SHA512 f5465dfbc8c3dba8e135d847eb8fdf969aa29ea52b33f0b8511064a137dd55c53151aa73cba8380bf66c945bb1e2086d3eac4d44dae275642d2c1412199ad325
SSDEEP 24576:DQR5pATtFRm4lUKdcubgAnyPbldUiwhsMSdYfXP2s2PTn6dG6tPHHj:DQR5p+RmR1PT6A6N
MD5 SHA1 SHA512 SSDEEP

Submit Download

libffi-8.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI31962\libffi-8.dll
Size 37KB
SHA256 68fba9dd89bfad35f8fd657b9af22a8aebda31bffda35058a7f5ae376136e89b
MD5 d86a9d75380fab7640bb950aeb05e50e
SHA1 1c61aaf9022cd1f09a959f7b2a65fb1372d187d7
SHA512 18437e64061221be411a1587f634b4b8efa60e661dbc35fd96a6d0e7eff812752de0ada755c01f286efefc47fb5f2daf07953b4cfc4119121b6bee7756c88d0f
SSDEEP 768:4iQfxQemQJNrPN+mGyijAeYiSyvOPxWESW7t:YfxIQvPkmGyijj7SymPxlp
MD5 SHA1 SHA512 SSDEEP

Submit Download

libffi-8.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI31962\libffi-8.dll
Size 37KB
SHA256 68fba9dd89bfad35f8fd657b9af22a8aebda31bffda35058a7f5ae376136e89b
MD5 d86a9d75380fab7640bb950aeb05e50e
SHA1 1c61aaf9022cd1f09a959f7b2a65fb1372d187d7
SHA512 18437e64061221be411a1587f634b4b8efa60e661dbc35fd96a6d0e7eff812752de0ada755c01f286efefc47fb5f2daf07953b4cfc4119121b6bee7756c88d0f
SSDEEP 768:4iQfxQemQJNrPN+mGyijAeYiSyvOPxWESW7t:YfxIQvPkmGyijj7SymPxlp
MD5 SHA1 SHA512 SSDEEP

Submit Download

python311.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI31962\python311.dll
Size 5.5MB
SHA256 aa1e959dcff75a343b448a797d8a5a041eb03b27565a30f70fd081df7a285038
MD5 a72993488cecd88b3e19487d646f88f6
SHA1 5d359f4121e0be04a483f9ad1d8203ffc958f9a0
SHA512 c895176784b9ac89c9b996c02ec0d0a3f7cd6ebf653a277c20dec104da6a11db084c53dd47c7b6653a448d877ad8e5e79c27db4ea6365ebb8ca2a78aa9c61b38
SSDEEP 98304:qvpgHup+dhRXLPw3W47SrSUHfMWdPrjUOYmIF:qvpgHup+XJrYWYWdjUOYmU
MD5 SHA1 SHA512 SSDEEP

Submit Download

python311.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI31962\python311.dll
Size 5.5MB
SHA256 aa1e959dcff75a343b448a797d8a5a041eb03b27565a30f70fd081df7a285038
MD5 a72993488cecd88b3e19487d646f88f6
SHA1 5d359f4121e0be04a483f9ad1d8203ffc958f9a0
SHA512 c895176784b9ac89c9b996c02ec0d0a3f7cd6ebf653a277c20dec104da6a11db084c53dd47c7b6653a448d877ad8e5e79c27db4ea6365ebb8ca2a78aa9c61b38
SSDEEP 98304:qvpgHup+dhRXLPw3W47SrSUHfMWdPrjUOYmIF:qvpgHup+XJrYWYWdjUOYmU
MD5 SHA1 SHA512 SSDEEP

Submit Download

select.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI31962\select.pyd
Size 28KB
SHA256 813eede996fc08e1c9a6d45aaa4cbae1e82e781d69885680a358b4d818cfc0d4
MD5 116335ebc419dd5224dd9a4f2a765467
SHA1 482ef3d79bfd6b6b737f8d546cd9f1812bd1663d
SHA512 41dc7facab0757ed1e286ae8e41122e09738733ad110c2918f5e2120dfb0dbff0daefcad2bffd1715b15b44c861b1dd7fb0d514983db50ddc758f47c1b9b3bf3
SSDEEP 384:Ag1ecReJK4HquuI7A70RUZNIg7GXIYiSy1pCQm3MnfPxh8E9VF0NyyRt:AseUeJRHqgbGNIg7GYYiSyvwMfPxWEo
MD5 SHA1 SHA512 SSDEEP

Submit Download

select.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI31962\select.pyd
Size 28KB
SHA256 813eede996fc08e1c9a6d45aaa4cbae1e82e781d69885680a358b4d818cfc0d4
MD5 116335ebc419dd5224dd9a4f2a765467
SHA1 482ef3d79bfd6b6b737f8d546cd9f1812bd1663d
SHA512 41dc7facab0757ed1e286ae8e41122e09738733ad110c2918f5e2120dfb0dbff0daefcad2bffd1715b15b44c861b1dd7fb0d514983db50ddc758f47c1b9b3bf3
SSDEEP 384:Ag1ecReJK4HquuI7A70RUZNIg7GXIYiSy1pCQm3MnfPxh8E9VF0NyyRt:AseUeJRHqgbGNIg7GYYiSyvwMfPxWEo
MD5 SHA1 SHA512 SSDEEP

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads