Analysis
-
max time kernel
141s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
-
submitted
25/12/2023, 20:29
General
-
Target
CheatEngine.exe
-
Size
14.1MB
-
MD5
ddd83e926867bb6702ac9fd6ec498787
-
SHA1
2c843bc98c6abea15136da0632ac6c45805e534f
-
SHA256
961cd20daca654599fb48030fe7c8ebb97e5423e44a194899bc93040ec0424c4
-
SHA512
6d2a6f3a158cebacd96badc136e3541137a0d558e8c0784daa36ac60b86c835cf16818c655700cfbaea72bb18b1a7e12645d7775bea335506a55000dc790f5ec
-
SSDEEP
393216:kMgXKdo4ykGJ7cVlz3mBw6BPCpstM8DZQXTwys6qoc:HgXKdDAYr70LaytMcF56q9
Malware Config
Signatures
-
Checks BIOS information in registry 2 TTPs 1 IoCs
BIOS information is often read in order to detect sandboxing environments.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
UPX packed file 21 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Program Files directory 1 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 2 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Enumerates system info in registry 2 TTPs 3 IoCs
-
Modifies Internet Explorer settings 1 TTPs 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 5 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of SetWindowsHookEx 3 IoCs
-
Suspicious use of WriteProcessMemory 7 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\CheatEngine.exe"C:\Users\Admin\AppData\Local\Temp\CheatEngine.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-IBB8A.tmp\CheatEngine.tmp"C:\Users\Admin\AppData\Local\Temp\is-IBB8A.tmp\CheatEngine.tmp" /SL5="$80022,14342329,121344,C:\Users\Admin\AppData\Local\Temp\CheatEngine.exe"2⤵
- Checks BIOS information in registry
- Drops file in Program Files directory
- Executes dropped EXE
- Loads dropped DLL
- Checks processor information in registry
- Enumerates system info in registry
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
225KB
MD526e50df9393c8e3dcc3363df9a160e38
SHA1a5af9a749fcf0c15d2f75adaa95a5628845f96e6
SHA2560aa66f7fa4809014add59380724a1ad6add3202fcba49dcaba1330d68d9df03f
SHA512db35e9dc4a9e6413501757ec6b6224e777dae9a670cefaca4e2b86aa1432c5f3659b9c6715447cdfb609ede96d465ec2a63a21c269cef6a3528c8496f1744fd6
-
Filesize
57KB
MD5bea2ca84938bd85c4fef71430da2be15
SHA13543daf08044558eca31f81ebf142be14d4f7362
SHA25615009f6a8f10d8b141c0b2708047f86b5a7f69939375f28dd7f32f10073e6cd2
SHA512072ad1f090d542252a9e9d6dbc53ce154d9c7db8e07d008939bee54cb8fdd4bf104ada22b6c7108dc25a1cc23ee0a2d3ed0508e0ab12ece6ffad985189239396
-
Filesize
156B
MD51ea9e5b417811379e874ad4870d5c51a
SHA1a4bd01f828454f3619a815dbe5423b181ec4051c
SHA256f076773a6e3ae0f1cee3c69232779a1aaaf05202db472040c0c8ea4a70af173a
SHA512965c10d2aa5312602153338da873e8866d2782e0cf633befe5a552b770e08abf47a4d2e007cdef7010c212ebcb9fefea5610c41c7ed1553440eaeab7ddd72daa
-
Filesize
6KB
MD59b27e2a266fe15a3aabfe635c29e8923
SHA1403afe68c7ee99698c0e8873ce1cd424b503c4c8
SHA256166aa42bc5216c5791388847ae114ec0671a0d97b9952d14f29419b8be3fb23f
SHA5124b07c11db91ce5750d81959c7b2c278ed41bb64c1d1aa29da87344c5177b8eb82d7d710b426f401b069fd05062395655d985ca031489544cdf9b72fe533afa61
-
Filesize
10KB
MD557ca1a2085d82f0574e3ef740b9a5ead
SHA12974f4bf37231205a256f2648189a461e74869c0
SHA256476a7b1085cc64de1c0eb74a6776fa8385d57eb18774f199df83fc4d7bbcc24e
SHA5122d50b9095d06ffd15eeeccf0eb438026ca8d09ba57141fed87a60edd2384e2139320fb5539144a2f16de885c49b0919a93690974f32b73654debca01d9d7d55c
-
Filesize
104KB
MD55879555dd186e857396e0d271beecf6c
SHA1f7cef842729e878bcb6d8fe7b65df1166a182a8f
SHA256f4d5dfd57b1050b06eea433fd0d7a818f74e3661ebc3446b66d63ceec41d6c53
SHA5123b2362069ea5dcae76b446f6b9413f917c7bcd7396a30360520c58f9798853d91f9e2815e3a02f5e685b94ab3523dadf601a89e4c106f6297c5b50aff83809a0
-
Filesize
55KB
MD5f979d2721ae09f60c86c790e29b1be9d
SHA160fbf9dc3ad7af4c0b9d123c7da3e43a4ea95ed5
SHA25634e73c0c2196bc394c2cbf00bb2f0a856b54cbf20df3f219f08e4eb369a88c17
SHA5125b2d29ad6548967eda285e38614a27a7a4b179589277313c3c28a00ca8bd22c057f20276f8f6112cc913356dc7972b12945e69ad9fd8ef99df68f4d21c3f0562
-
Filesize
160KB
-
Filesize
160KB
-
Filesize
160KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
908KB
-
Filesize
4KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
1.1MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
4KB
-
Filesize
1.1MB
-
Filesize
1.2MB
-
Filesize
4KB
-
Filesize
908KB
-
Filesize
2.0MB
-
Filesize
4KB
