e2e15826b69778e381f25ac8f2b109a377b23f7cf79b5f482e81f4d28c30f95e

Analysis

max time kernel
142s
max time network
129s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
18-04-2023 14:36

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

CheatEngine75.exe
Size

3.1MB
MD5

609fea742d34dc1d53f0eeb4873b1a0a
SHA1

3232c52da3cb8f47a870162a35cdd75fcae60aea
SHA256

e2e15826b69778e381f25ac8f2b109a377b23f7cf79b5f482e81f4d28c30f95e
SHA512

27da89901268d153fd7158162fc8f2f3b99ec9a4aa24c281f93b500466552af776b00f0a33182386a62934c3e553561cbc23d3f5ebb0ea0366c04e046e1bcc90
SSDEEP

98304:wSiW4opH4opH4op4U9tNz9RGa/xlbLP/h4:ZDBDBD1t3Hbb+

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
436	CheatEngine75.tmp

Loads dropped DLL 3 IoCs

pid	Process
436	CheatEngine75.tmp
436	CheatEngine75.tmp
436	CheatEngine75.tmp

Script User-Agent 1 IoCs

Uses user-agent string associated with script host/environment.

description	flow	ioc
HTTP User-Agent header	18	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1760 wrote to memory of 436	1760	CheatEngine75.exe	84
PID 1760 wrote to memory of 436	1760	CheatEngine75.exe	84
PID 1760 wrote to memory of 436	1760	CheatEngine75.exe	84

C:\Users\Admin\AppData\Local\Temp\CheatEngine75.exe
"C:\Users\Admin\AppData\Local\Temp\CheatEngine75.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1760
- C:\Users\Admin\AppData\Local\Temp\is-L3C03.tmp\CheatEngine75.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-L3C03.tmp\CheatEngine75.tmp" /SL5="$1F0022,2335682,780800,C:\Users\Admin\AppData\Local\Temp\CheatEngine75.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:436

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\is-1V83M.tmp\botva2.dll

Filesize
37KB

MD5
67965a5957a61867d661f05ae1f4773e

SHA1
f14c0a4f154dc685bb7c65b2d804a02a0fb2360d

SHA256
450b9b0ba25bf068afbc2b23d252585a19e282939bf38326384ea9112dfd0105

SHA512
c6942818b9026dc5db2d62999d32cf99fe7289f79a28b8345af17acf9d13b2229a5e917a48ff1f6d59715bdbcb00c1625e0302abcfe10ca7e0475762e0a3f41b

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-1V83M.tmp\botva2.dll

Filesize
37KB

MD5
67965a5957a61867d661f05ae1f4773e

SHA1
f14c0a4f154dc685bb7c65b2d804a02a0fb2360d

SHA256
450b9b0ba25bf068afbc2b23d252585a19e282939bf38326384ea9112dfd0105

SHA512
c6942818b9026dc5db2d62999d32cf99fe7289f79a28b8345af17acf9d13b2229a5e917a48ff1f6d59715bdbcb00c1625e0302abcfe10ca7e0475762e0a3f41b

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-1V83M.tmp\logo.png

Filesize
258KB

MD5
6b7cb2a5a8b301c788c3792802696fe8

SHA1
da93950273b0c256dab64bb3bb755ac7c14f17f3

SHA256
3eed2e41bc6ca0ae9a5d5ee6d57ca727e5cba6ac8e8c5234ac661f9080cedadf

SHA512
4183dbb8fd7de5fd5526a79b62e77fc30b8d1ec34ebaa3793b4f28beb36124084533e08b595f77305522bc847edfed1f9388c0d2ece66e6ac8acb7049b48ee86

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-1V83M.tmp\zbShieldUtils.dll

Filesize
2.0MB

MD5
fad0877741da31ab87913ef1f1f2eb1a

SHA1
21abb83b8dfc92a6d7ee0a096a30000e05f84672

SHA256
73ff938887449779e7a9d51100d7be2195198a5e2c4c7de5f93ceac7e98e3e02

SHA512
f626b760628e16b9aa8b55e463c497658dd813cf5b48a3c26a85d681da1c3a33256cae012acc1257b1f47ea37894c3a306f348eb6bd4bbdf94c9d808646193ec

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-L3C03.tmp\CheatEngine75.tmp

Filesize
2.9MB

MD5
1cdbf6da4defe32c9cb5908968a02fab

SHA1
d1a5eb2928d718d7a1517187f523c701c141b659

SHA256
87c1bb2236a874c97369b2cca0d55559fa917707cebddf7a5eabc691f8302487

SHA512
215697cae7ec2ba27fbc0b9208cb8676e27d21e55e0184fc68cbd1c1bd57863daf29348ea677e97af84628800ba15e6db884df872c3adc673a3cd7faed2888b9

Download Submit
memory/436-138-0x0000000000E20000-0x0000000000E21000-memory.dmp

Filesize
4KB

Download
memory/436-153-0x0000000006330000-0x000000000633F000-memory.dmp

Filesize
60KB

Download
memory/436-160-0x0000000000400000-0x00000000006EE000-memory.dmp

Filesize
2.9MB

Download
memory/436-161-0x0000000006330000-0x000000000633F000-memory.dmp

Filesize
60KB

Download
memory/436-162-0x0000000000E20000-0x0000000000E21000-memory.dmp

Filesize
4KB

Download
memory/1760-133-0x0000000000400000-0x00000000004CC000-memory.dmp

Filesize
816KB

Download
memory/1760-159-0x0000000000400000-0x00000000004CC000-memory.dmp

Filesize
816KB

Download