Overview
overview
10Static
static
10Cheat_Bypa...ss.dll
windows7-x64
1Cheat_Bypa...ss.dll
windows10-2004-x64
1Cheat_Bypa...TA.exe
windows7-x64
10Cheat_Bypa...TA.exe
windows10-2004-x64
10Cheat_Bypa...64.exe
windows7-x64
1Cheat_Bypa...64.exe
windows10-2004-x64
1Cheat_Bypa...ss.dll
windows7-x64
1Cheat_Bypa...ss.dll
windows10-2004-x64
1Cheat_Bypa...TA.exe
windows7-x64
10Cheat_Bypa...TA.exe
windows10-2004-x64
10Cheat_Bypa...64.exe
windows7-x64
1Cheat_Bypa...64.exe
windows10-2004-x64
3PPRE/PPRE.exe
windows7-x64
7PPRE/PPRE.exe
windows10-2004-x64
7$PLUGINSDI...ls.dll
windows7-x64
3$PLUGINSDI...ls.dll
windows10-2004-x64
3$PLUGINSDI...em.dll
windows7-x64
3$PLUGINSDI...em.dll
windows10-2004-x64
3LICENSES.c...m.html
windows7-x64
1LICENSES.c...m.html
windows10-2004-x64
1Project.exe
windows7-x64
7Project.exe
windows10-2004-x64
7d3dcompiler_47.dll
windows10-2004-x64
1ffmpeg.dll
windows7-x64
1ffmpeg.dll
windows10-2004-x64
1libEGL.dll
windows7-x64
1libEGL.dll
windows10-2004-x64
1libGLESv2.dll
windows7-x64
1libGLESv2.dll
windows10-2004-x64
1locales/de.ps1
windows7-x64
1locales/de.ps1
windows10-2004-x64
1locales/nb.ps1
windows7-x64
1Analysis
-
max time kernel
120s -
max time network
124s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
04-03-2024 15:07
Behavioral task
behavioral1
Sample
Cheat_Bypass_1.6/Cheat_MTA/Bypass.dll
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
Cheat_Bypass_1.6/Cheat_MTA/Bypass.dll
Resource
win10v2004-20240226-en
Behavioral task
behavioral3
Sample
Cheat_Bypass_1.6/Cheat_MTA/Cheat_MTA.exe
Resource
win7-20240221-en
Behavioral task
behavioral4
Sample
Cheat_Bypass_1.6/Cheat_MTA/Cheat_MTA.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral5
Sample
Cheat_Bypass_1.6/Cheat_MTA/Executor/Xenos64.exe
Resource
win7-20240215-en
Behavioral task
behavioral6
Sample
Cheat_Bypass_1.6/Cheat_MTA/Executor/Xenos64.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral7
Sample
Cheat_Bypass_1.6/Cheat_MTA/Bypass.dll
Resource
win7-20240220-en
Behavioral task
behavioral8
Sample
Cheat_Bypass_1.6/Cheat_MTA/Bypass.dll
Resource
win10v2004-20240226-en
Behavioral task
behavioral9
Sample
Cheat_Bypass_1.6/Cheat_MTA/Cheat_MTA.exe
Resource
win7-20240221-en
Behavioral task
behavioral10
Sample
Cheat_Bypass_1.6/Cheat_MTA/Cheat_MTA.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral11
Sample
Cheat_Bypass_1.6/Cheat_MTA/Executor/Xenos64.exe
Resource
win7-20240221-en
Behavioral task
behavioral12
Sample
Cheat_Bypass_1.6/Cheat_MTA/Executor/Xenos64.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral13
Sample
PPRE/PPRE.exe
Resource
win7-20240221-en
Behavioral task
behavioral14
Sample
PPRE/PPRE.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral15
Sample
$PLUGINSDIR/StdUtils.dll
Resource
win7-20240221-en
Behavioral task
behavioral16
Sample
$PLUGINSDIR/StdUtils.dll
Resource
win10v2004-20240226-en
Behavioral task
behavioral17
Sample
$PLUGINSDIR/System.dll
Resource
win7-20240215-en
Behavioral task
behavioral18
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20240226-en
Behavioral task
behavioral19
Sample
LICENSES.chromium.html
Resource
win7-20240221-en
Behavioral task
behavioral20
Sample
LICENSES.chromium.html
Resource
win10v2004-20240226-en
Behavioral task
behavioral21
Sample
Project.exe
Resource
win7-20240221-en
Behavioral task
behavioral22
Sample
Project.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral23
Sample
d3dcompiler_47.dll
Resource
win10v2004-20240226-en
Behavioral task
behavioral24
Sample
ffmpeg.dll
Resource
win7-20240221-en
Behavioral task
behavioral25
Sample
ffmpeg.dll
Resource
win10v2004-20240226-en
Behavioral task
behavioral26
Sample
libEGL.dll
Resource
win7-20240221-en
Behavioral task
behavioral27
Sample
libEGL.dll
Resource
win10v2004-20240226-en
Behavioral task
behavioral28
Sample
libGLESv2.dll
Resource
win7-20240215-en
Behavioral task
behavioral29
Sample
libGLESv2.dll
Resource
win10v2004-20240226-en
Behavioral task
behavioral30
Sample
locales/de.ps1
Resource
win7-20240221-en
Behavioral task
behavioral31
Sample
locales/de.ps1
Resource
win10v2004-20240226-en
Behavioral task
behavioral32
Sample
locales/nb.ps1
Resource
win7-20240221-en
General
-
Target
Cheat_Bypass_1.6/Cheat_MTA/Executor/Xenos64.exe
-
Size
1.3MB
-
MD5
6f0dd4150efddfc20b70401479964211
-
SHA1
e97c802a8013b13fb91a831b779ade7c3ca6870b
-
SHA256
0e6d59fcdf8f143e23b076cc8380d6d23324839ae4f91793133b600e7eb76eb9
-
SHA512
d8e823876507cd10b8c176e502c99bb80d52742eaa7c0e319b2a5c1f605de962505bf09950418a461fde427db34a59dbb67cbb4a6045f44d243c77945aebd0fb
-
SSDEEP
24576:uLGfO4noYBPtVY3HPou37urInN48pGrnofSVgPCS3tMrMyj3F9hIF1SqY5cbaF:uLGfKY5tVY3gur9N4p0SVE3tMx3FE1Sr
Malware Config
Signatures
-
Modifies registry class 15 IoCs
Processes:
Xenos64.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\XenosProfile64\ = "Xenos 64-bit injection profile" Xenos64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\XenosProfile64\shell\ = "Run" Xenos64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\XenosProfile64\shell\Edit\command Xenos64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\XenosProfile64\shell\Edit\command\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Cheat_Bypass_1.6\\Cheat_MTA\\Executor\\Xenos64.exe --load %1" Xenos64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\XenosProfile64 Xenos64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\XenosProfile64\shell\Run Xenos64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\XenosProfile64\DefaultIcon Xenos64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.xpr64\Content Type = "Application/xml" Xenos64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\XenosProfile64\shell\Run\command Xenos64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.xpr64\ = "XenosProfile64" Xenos64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\XenosProfile64\shell Xenos64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\XenosProfile64\shell\Edit Xenos64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\XenosProfile64\shell\Run\command\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Cheat_Bypass_1.6\\Cheat_MTA\\Executor\\Xenos64.exe --run %1" Xenos64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\XenosProfile64\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Cheat_Bypass_1.6\\Cheat_MTA\\Executor\\Xenos64.exe,-135" Xenos64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.xpr64 Xenos64.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
Xenos64.exepid process 2180 Xenos64.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
Xenos64.exedescription pid process Token: SeDebugPrivilege 2180 Xenos64.exe Token: SeLoadDriverPrivilege 2180 Xenos64.exe
Processes
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/2180-10-0x0000000000030000-0x0000000000130000-memory.dmpFilesize
1024KB