Analysis
-
max time kernel
31s -
max time network
36s -
platform
windows10-1703_x64 -
resource
win10-20230220-en -
resource tags
-
submitted
24-04-2023 23:34
General
-
Target
cheat-engine.exe
-
Size
11.5MB
-
MD5
a1bf011028db014edabdd7783c1ae34a
-
SHA1
0818be9df711ceb94ccc721f89e8b6fba72d8109
-
SHA256
9f498954b628b7cd9989a4ee2339601cfcbb58c8a32bfa2d0c8bc2adbd1d90ae
-
SHA512
60421be866298e335b9f590bc04a9d52a71c49b7c6cf3e5a1a1e22a3ec406c009a78fcb3b35718c76a85a5177fb04785f96026ded43bc4a045c69808a0ba8dbd
-
SSDEEP
196608:yZ9bHrsNbpUGJJ177vcsCQypVRUBSCwBpvvDMs4VMY0I+RSIxBauMTTArar:yZ9bLsgGV3TCdpV6BPCpDMfXEEuNar
Malware Config
Signatures
-
Checks BIOS information in registry 2 TTPs 1 IoCs
BIOS information is often read in order to detect sandboxing environments.
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 2 IoCs
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
UPX packed file 16 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Checks whether UAC is enabled 1 TTPs 1 IoCs
-
Drops file in Program Files directory 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks processor information in registry 2 TTPs 4 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Enumerates system info in registry 2 TTPs 3 IoCs
-
Suspicious behavior: EnumeratesProcesses 8 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of SetWindowsHookEx 3 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\cheat-engine.exe"C:\Users\Admin\AppData\Local\Temp\cheat-engine.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-MQJ85.tmp\cheat-engine.tmp"C:\Users\Admin\AppData\Local\Temp\is-MQJ85.tmp\cheat-engine.tmp" /SL5="$70050,11742384,56832,C:\Users\Admin\AppData\Local\Temp\cheat-engine.exe"2⤵
- Checks BIOS information in registry
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
- Drops file in Program Files directory
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
706KB
MD5e8a6c959f39a4c5cc3f4b966c9f25500
SHA1bba531475ae82c8025fb12146ead5e51bbae9fe6
SHA2566bbee346e660e1f719e26b84805876f5218543e7827681f8988619bc5d360acc
SHA512e9d0602e9c7de85ce818cbeb3272a552481a1abc61f92afc9f2d94e76c4de1e1e893157bb23b3849f53a37ac39854a9fe399f7758e08454f4a166ec418bd40a2
-
Filesize
706KB
MD5e8a6c959f39a4c5cc3f4b966c9f25500
SHA1bba531475ae82c8025fb12146ead5e51bbae9fe6
SHA2566bbee346e660e1f719e26b84805876f5218543e7827681f8988619bc5d360acc
SHA512e9d0602e9c7de85ce818cbeb3272a552481a1abc61f92afc9f2d94e76c4de1e1e893157bb23b3849f53a37ac39854a9fe399f7758e08454f4a166ec418bd40a2
-
Filesize
156B
MD51ea9e5b417811379e874ad4870d5c51a
SHA1a4bd01f828454f3619a815dbe5423b181ec4051c
SHA256f076773a6e3ae0f1cee3c69232779a1aaaf05202db472040c0c8ea4a70af173a
SHA512965c10d2aa5312602153338da873e8866d2782e0cf633befe5a552b770e08abf47a4d2e007cdef7010c212ebcb9fefea5610c41c7ed1553440eaeab7ddd72daa
-
Filesize
6KB
MD59b27e2a266fe15a3aabfe635c29e8923
SHA1403afe68c7ee99698c0e8873ce1cd424b503c4c8
SHA256166aa42bc5216c5791388847ae114ec0671a0d97b9952d14f29419b8be3fb23f
SHA5124b07c11db91ce5750d81959c7b2c278ed41bb64c1d1aa29da87344c5177b8eb82d7d710b426f401b069fd05062395655d985ca031489544cdf9b72fe533afa61
-
Filesize
506B
MD55335f1c12201b5f7cf5f8b4f5692e3d1
SHA113807a10369f7ff9ab3f9aba18135bccb98bec2d
SHA256974cd89e64bdaa85bf36ed2a50af266d245d781a8139f5b45d7c55a0b0841dda
SHA5120d4e54d2ffe96ccf548097f7812e3608537b4dae9687816983fddfb73223c196159cc6a39fcdc000784c79b2ced878efbc7a5b5f6e057973bf25b128124510df
-
Filesize
10KB
MD557ca1a2085d82f0574e3ef740b9a5ead
SHA12974f4bf37231205a256f2648189a461e74869c0
SHA256476a7b1085cc64de1c0eb74a6776fa8385d57eb18774f199df83fc4d7bbcc24e
SHA5122d50b9095d06ffd15eeeccf0eb438026ca8d09ba57141fed87a60edd2384e2139320fb5539144a2f16de885c49b0919a93690974f32b73654debca01d9d7d55c
-
Filesize
885KB
MD5406e12232c990226d6973582884b1f33
SHA1bb325dfe5a350c15bc2f600e757dc033d676c78f
SHA2563054a57b25f5162168fcfdc7cc939b1c8ac42ebd1aede2a69994b0f357a977f6
SHA512d1c3d7a7f2a4d796678171da1fc79a66d7abe5f18e87c96503c6ed62a1ac75e2473a503c75c7067c2160af55b41f37848a0509128b3fcdca14e075cdc99d8b3b
-
Filesize
885KB
MD5406e12232c990226d6973582884b1f33
SHA1bb325dfe5a350c15bc2f600e757dc033d676c78f
SHA2563054a57b25f5162168fcfdc7cc939b1c8ac42ebd1aede2a69994b0f357a977f6
SHA512d1c3d7a7f2a4d796678171da1fc79a66d7abe5f18e87c96503c6ed62a1ac75e2473a503c75c7067c2160af55b41f37848a0509128b3fcdca14e075cdc99d8b3b
-
Filesize
80KB
-
Filesize
80KB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
772KB
-
Filesize
1.6MB
-
Filesize
4KB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
4KB
-
Filesize
1.6MB
-
Filesize
900KB
-
Filesize
756KB
-
Filesize
900KB
-
Filesize
1.6MB
-
Filesize
4KB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
4KB
-
Filesize
756KB
