Analysis
-
max time kernel
111s -
max time network
94s -
platform
windows10-2004_x64 -
resource
win10v2004-20240221-en -
resource tags
-
submitted
21-02-2024 20:46
General
-
Target
CheatEngine75.exe
-
Size
28.5MB
-
MD5
8cef61e2080c38400698bc3265fd7f95
-
SHA1
a174b7dd8bd1eacfa6a9accd878c16bdc8aa1936
-
SHA256
cb73a9806e39e7c694cd79bbdb0fd3c836ec82810f6ded1852aa1ac9c7b3012c
-
SHA512
81781fdb49a3b949725ff508a96eef01599ff90c2fd42f104dda311cfb37dfb90d4aa38d0d4694634c3a469fbdac4c7421a5aee99067536848bbc50bda4658cb
-
SSDEEP
786432:0TCxuEnwFho+zM77UDZiZCd08jFZJAI5E70TZFH:02EXFhV0KAcNjxAItj
Malware Config
Signatures
-
Checks for any installed AV software in registry 1 TTPs 9 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 1 IoCs
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Script User-Agent 1 IoCs
Uses user-agent string associated with script host/environment.
-
Suspicious behavior: EnumeratesProcesses 14 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\CheatEngine75.exe"C:\Users\Admin\AppData\Local\Temp\CheatEngine75.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-3JUJ1.tmp\CheatEngine75.tmp"C:\Users\Admin\AppData\Local\Temp\is-3JUJ1.tmp\CheatEngine75.tmp" /SL5="$9022E,29019897,780800,C:\Users\Admin\AppData\Local\Temp\CheatEngine75.exe"2⤵
- Checks for any installed AV software in registry
- Executes dropped EXE
- Loads dropped DLL
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.9MB
MD587f9a8a5bb3fa1c60ec9bc4039817f20
SHA117c77749db527155c46bea4eeb6dea8b185f50c9
SHA256db31191966bc7f4e29fa40667c1eb73b6928096080b07bc1fe1c991081195b69
SHA512638021964475f0c1f5eefe0a6c8a62bf048ad87bcd7dc5729a896c08d91eb88ab80f908a1f4129a7680140ececab0a6f93f95f1379c578acb412305556d59ddf
-
Filesize
246KB
MD51df360d73bf8108041d31d9875888436
SHA1c866e8855d62f56a411641ece0552e54cbd0f2fb
SHA256c1b1d7b4806955fe39a8bc6ce5574ab6ac5b93ad640cecfebe0961360c496d43
SHA5123991b89927d89effca30cc584d5907998c217cf00ca441f2525ef8627ffff2032d104536f8b6ab79b83f4e32a7aab993f45d3930d5943cbfb5e449c5832abe14
-
Filesize
2.0MB
MD5b83f5833e96c2eb13f14dcca805d51a1
SHA19976b0a6ef3dabeab064b188d77d870dcdaf086d
SHA25600e667b838a4125c8cf847936168bb77bb54580bc05669330cb32c0377c4a401
SHA5128641b351e28b3c61ed6762adbca165f4a5f2ee26a023fd74dd2102a6258c0f22e91b78f4a3e9fba6094b68096001de21f10d6495f497580847103c428d30f7bb
-
Filesize
4KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
2.9MB
-
Filesize
4KB
-
Filesize
816KB
-
Filesize
816KB
-
Filesize
816KB
