General
-
Target
CheatEngine75.exe
-
Size
28.6MB
-
Sample
230621-xxpd2scc5y
-
MD5
a4b99286d19825f642183f3e78782513
-
SHA1
3a13275632f09a763200b7d453c164d2887f5795
-
SHA256
3bc3a26ab7f5f0b02c5175ba04514a5344804f6c886fdd3ea1f1f9d317ee7a40
-
SHA512
e51ba67f7c462ae1b755a879b7d3ec70e302159fc3d08fd6b843075e5c5d3ab1a49a9bcf59773cac6c041152e77dd11c75374f0b8a15cab92e85d0771d85c6b9
-
SSDEEP
786432:uCxuEnwFho+zM77UDZiZCd08jFZJAI5E70TZFHiO:nEXFhV0KAcNjxAItjiO
Static task
static1
Behavioral task
behavioral1
Sample
CheatEngine75.exe
Resource
win7-20230621-en
Behavioral task
behavioral2
Sample
CheatEngine75.exe
Resource
win10v2004-20230621-en
Malware Config
Targets
-
-
Target
CheatEngine75.exe
-
Size
28.6MB
-
MD5
a4b99286d19825f642183f3e78782513
-
SHA1
3a13275632f09a763200b7d453c164d2887f5795
-
SHA256
3bc3a26ab7f5f0b02c5175ba04514a5344804f6c886fdd3ea1f1f9d317ee7a40
-
SHA512
e51ba67f7c462ae1b755a879b7d3ec70e302159fc3d08fd6b843075e5c5d3ab1a49a9bcf59773cac6c041152e77dd11c75374f0b8a15cab92e85d0771d85c6b9
-
SSDEEP
786432:uCxuEnwFho+zM77UDZiZCd08jFZJAI5E70TZFHiO:nEXFhV0KAcNjxAItjiO
-
CoreEntity .NET Packer
A .NET packer called CoreEntity where it has embedded the payload as a BitMap object which is later decrypted.
-
Creates new service(s)
-
Downloads MZ/PE file
-
Drops file in Drivers directory
-
Sets file execution options in registry
-
Stops running service(s)
-
Checks BIOS information in registry
BIOS information is often read in order to detect sandboxing environments.
-
Modifies file permissions
-
Adds Run key to start application
-
Checks for any installed AV software in registry
-
Writes to the Master Boot Record (MBR)
Bootkits write to the MBR to gain persistence at a level below the operating system.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Drops file in System32 directory
-
MITRE ATT&CK Matrix ATT&CK v6
Persistence
New Service
1Registry Run Keys / Startup Folder
3Modify Existing Service
1Bootkit
1Defense Evasion
Modify Registry
4Impair Defenses
1File Permissions Modification
1Install Root Certificate
1