e813b7ca003c8c13c0f1e9feb2e62190df2fb08b3ac3f5ecd30f3abc961232ce

Analysis

max time kernel
141s
max time network
121s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
22/12/2023, 15:25

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Cheat.exe
Size 29.6MB
Sample231222-stmc3abfa4
SHA256 e813b7ca003c8c13c0f1e9feb2e62190df2fb08b3ac3f5ecd30f3abc961232ce
MD5 21f48fe74e4d8fe827f217bee2be54a7
SHA1 476b1e86627c52edb9a133c1945598d1abaef2dd
SHA512 d89c42d5a2b7a91b8b964405d685e8ce674c7474c9e7dfe1009aae4527ffcf8526c593d5aa0479df7b65bd253ba7f884912873dea605ccc650becdb3ae20c16c
SSDEEP 786432:s+XVHW5Vlae8/M8WeQag3Z5ksG95EGNL1B4FMm:s8U5WRE8PQag3ZJM2GN8
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2752	Cheat.tmp

Loads dropped DLL 1 IoCs

pid	Process
1972	Cheat.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2752	Cheat.tmp

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1972 wrote to memory of 2752	1972	Cheat.exe	28
PID 1972 wrote to memory of 2752	1972	Cheat.exe	28
PID 1972 wrote to memory of 2752	1972	Cheat.exe	28
PID 1972 wrote to memory of 2752	1972	Cheat.exe	28
PID 1972 wrote to memory of 2752	1972	Cheat.exe	28
PID 1972 wrote to memory of 2752	1972	Cheat.exe	28
PID 1972 wrote to memory of 2752	1972	Cheat.exe	28

C:\Users\Admin\AppData\Local\Temp\Cheat.exe
"C:\Users\Admin\AppData\Local\Temp\Cheat.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1972
- C:\Users\Admin\AppData\Local\Temp\is-VD6QC.tmp\Cheat.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-VD6QC.tmp\Cheat.tmp" /SL5="$4002A,30157316,832512,C:\Users\Admin\AppData\Local\Temp\Cheat.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: GetForegroundWindowSpam
  PID:2752

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

Cheat.tmp

Path C:\Users\Admin\AppData\Local\Temp\is-VD6QC.tmp\Cheat.tmp
Size 654KB
SHA256 009e4326ef6ab4364ef43696cc5e2ee7418a293f7fe31ea938a0b97b6c19019e
MD5 06de1fd8f10e87aef723dcf811b05483
SHA1 fce97c5870b72e5fac8d3fb114bb86d0ab9c6c70
SHA512 01850280e6e41e9ea3f2de00f50cef6c07c4db7856458da64003c90b5bf29bdf705d55d68c4a0e9679c8d5789ed237daa7ab226d39a127c053271d587f68db29
SSDEEP 6144:2iD1zyyYhdM9PAwYCAz9ClAjFvVyiKEtoewaDC+8YzBLOP3CJ8uKwo4QiThe7csh:2idYU9hYxMAjdIiBtoewaDdV2IWB
MD5 SHA1 SHA512 SSDEEP

Submit Download

Cheat.tmp

Path \Users\Admin\AppData\Local\Temp\is-VD6QC.tmp\Cheat.tmp
Size 910KB
SHA256 cbc3df64db8c9e5a8bdae4465bdea2b10f721afa82019d26f1bdeae39e5b7bc6
MD5 566b8c6362431044b94a0faf2a05be9b
SHA1 0fb3222ebaf2a7297de6cf593e8a3705632d00ba
SHA512 a817bd2498bafc3fafd50c3f25b51d29656ec6b03f7f018eb2912c73dd05a221a2c3c9b2926f79f32644339298f5f8bfb5f8085a9dd283cb3b312da08e9a584e
SSDEEP 12288:2idYU9hYxMAjdIiBtoewaDdV2IWbjwNeXQo/:2WYU9aMAjdRtjwaDdVFKwNeXx/
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1972-1-0x0000000000400000-0x00000000004D8000-memory.dmp

Download

memory/1972-10-0x0000000000400000-0x00000000004D8000-memory.dmp

Download

memory/2752-8-0x0000000000240000-0x0000000000241000-memory.dmp

Download

memory/2752-11-0x0000000000400000-0x000000000071C000-memory.dmp

Download

memory/2752-14-0x0000000000240000-0x0000000000241000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads