Overview
overview
10Static
static
10Cheat_Bypa...ss.dll
windows7-x64
1Cheat_Bypa...ss.dll
windows10-2004-x64
1Cheat_Bypa...TA.exe
windows7-x64
10Cheat_Bypa...TA.exe
windows10-2004-x64
10Cheat_Bypa...64.exe
windows7-x64
1Cheat_Bypa...64.exe
windows10-2004-x64
1Cheat_Bypa...ss.dll
windows7-x64
1Cheat_Bypa...ss.dll
windows10-2004-x64
1Cheat_Bypa...TA.exe
windows7-x64
10Cheat_Bypa...TA.exe
windows10-2004-x64
10Cheat_Bypa...64.exe
windows7-x64
1Cheat_Bypa...64.exe
windows10-2004-x64
3PPRE/PPRE.exe
windows7-x64
7PPRE/PPRE.exe
windows10-2004-x64
7$PLUGINSDI...ls.dll
windows7-x64
3$PLUGINSDI...ls.dll
windows10-2004-x64
3$PLUGINSDI...em.dll
windows7-x64
3$PLUGINSDI...em.dll
windows10-2004-x64
3LICENSES.c...m.html
windows7-x64
1LICENSES.c...m.html
windows10-2004-x64
1Project.exe
windows7-x64
7Project.exe
windows10-2004-x64
7d3dcompiler_47.dll
windows10-2004-x64
1ffmpeg.dll
windows7-x64
1ffmpeg.dll
windows10-2004-x64
1libEGL.dll
windows7-x64
1libEGL.dll
windows10-2004-x64
1libGLESv2.dll
windows7-x64
1libGLESv2.dll
windows10-2004-x64
1locales/de.ps1
windows7-x64
1locales/de.ps1
windows10-2004-x64
1locales/nb.ps1
windows7-x64
1Analysis
-
max time kernel
59s -
max time network
149s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
04-03-2024 15:07
Behavioral task
behavioral1
Sample
Cheat_Bypass_1.6/Cheat_MTA/Bypass.dll
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
Cheat_Bypass_1.6/Cheat_MTA/Bypass.dll
Resource
win10v2004-20240226-en
Behavioral task
behavioral3
Sample
Cheat_Bypass_1.6/Cheat_MTA/Cheat_MTA.exe
Resource
win7-20240221-en
Behavioral task
behavioral4
Sample
Cheat_Bypass_1.6/Cheat_MTA/Cheat_MTA.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral5
Sample
Cheat_Bypass_1.6/Cheat_MTA/Executor/Xenos64.exe
Resource
win7-20240215-en
Behavioral task
behavioral6
Sample
Cheat_Bypass_1.6/Cheat_MTA/Executor/Xenos64.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral7
Sample
Cheat_Bypass_1.6/Cheat_MTA/Bypass.dll
Resource
win7-20240220-en
Behavioral task
behavioral8
Sample
Cheat_Bypass_1.6/Cheat_MTA/Bypass.dll
Resource
win10v2004-20240226-en
Behavioral task
behavioral9
Sample
Cheat_Bypass_1.6/Cheat_MTA/Cheat_MTA.exe
Resource
win7-20240221-en
Behavioral task
behavioral10
Sample
Cheat_Bypass_1.6/Cheat_MTA/Cheat_MTA.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral11
Sample
Cheat_Bypass_1.6/Cheat_MTA/Executor/Xenos64.exe
Resource
win7-20240221-en
Behavioral task
behavioral12
Sample
Cheat_Bypass_1.6/Cheat_MTA/Executor/Xenos64.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral13
Sample
PPRE/PPRE.exe
Resource
win7-20240221-en
Behavioral task
behavioral14
Sample
PPRE/PPRE.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral15
Sample
$PLUGINSDIR/StdUtils.dll
Resource
win7-20240221-en
Behavioral task
behavioral16
Sample
$PLUGINSDIR/StdUtils.dll
Resource
win10v2004-20240226-en
Behavioral task
behavioral17
Sample
$PLUGINSDIR/System.dll
Resource
win7-20240215-en
Behavioral task
behavioral18
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20240226-en
Behavioral task
behavioral19
Sample
LICENSES.chromium.html
Resource
win7-20240221-en
Behavioral task
behavioral20
Sample
LICENSES.chromium.html
Resource
win10v2004-20240226-en
Behavioral task
behavioral21
Sample
Project.exe
Resource
win7-20240221-en
Behavioral task
behavioral22
Sample
Project.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral23
Sample
d3dcompiler_47.dll
Resource
win10v2004-20240226-en
Behavioral task
behavioral24
Sample
ffmpeg.dll
Resource
win7-20240221-en
Behavioral task
behavioral25
Sample
ffmpeg.dll
Resource
win10v2004-20240226-en
Behavioral task
behavioral26
Sample
libEGL.dll
Resource
win7-20240221-en
Behavioral task
behavioral27
Sample
libEGL.dll
Resource
win10v2004-20240226-en
Behavioral task
behavioral28
Sample
libGLESv2.dll
Resource
win7-20240215-en
Behavioral task
behavioral29
Sample
libGLESv2.dll
Resource
win10v2004-20240226-en
Behavioral task
behavioral30
Sample
locales/de.ps1
Resource
win7-20240221-en
Behavioral task
behavioral31
Sample
locales/de.ps1
Resource
win10v2004-20240226-en
Behavioral task
behavioral32
Sample
locales/nb.ps1
Resource
win7-20240221-en
General
-
Target
Project.exe
-
Size
147.0MB
-
MD5
5fff4c7f41fe8a04f7c6ffcb191bfd54
-
SHA1
e660df9a92442e6a91e0805b3310a94bde5fe414
-
SHA256
4aba8d9303ced281e6b884dbb045582d9bf24405ced912fb9aeb97335ffe483d
-
SHA512
7cd6010c78c81f5a9234f3a5849d4c7bc3896a537fd3c4030976f29cabf16aeb331a88c4186fd0bb2edc9b56fa6551065c247a0ca05084aaa72ddfab75d0ff14
-
SSDEEP
1572864:QroLm1cZ4K5MvHwpkeg9duXYFPEiFWITK886rc028B+yJwG5xmR:FCjwAI8xO
Malware Config
Signatures
-
Drops startup file 1 IoCs
Processes:
Project.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Updater.exe Project.exe -
Loads dropped DLL 2 IoCs
Processes:
Project.exepid process 1712 Project.exe 1712 Project.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
Project.exedescription pid process Token: SeShutdownPrivilege 1712 Project.exe Token: SeShutdownPrivilege 1712 Project.exe Token: SeShutdownPrivilege 1712 Project.exe Token: SeShutdownPrivilege 1712 Project.exe Token: SeShutdownPrivilege 1712 Project.exe Token: SeShutdownPrivilege 1712 Project.exe Token: SeShutdownPrivilege 1712 Project.exe Token: SeShutdownPrivilege 1712 Project.exe Token: SeShutdownPrivilege 1712 Project.exe Token: SeShutdownPrivilege 1712 Project.exe Token: SeShutdownPrivilege 1712 Project.exe Token: SeShutdownPrivilege 1712 Project.exe Token: SeShutdownPrivilege 1712 Project.exe Token: SeShutdownPrivilege 1712 Project.exe Token: SeShutdownPrivilege 1712 Project.exe Token: SeShutdownPrivilege 1712 Project.exe Token: SeShutdownPrivilege 1712 Project.exe Token: SeShutdownPrivilege 1712 Project.exe Token: SeShutdownPrivilege 1712 Project.exe Token: SeShutdownPrivilege 1712 Project.exe Token: SeShutdownPrivilege 1712 Project.exe Token: SeShutdownPrivilege 1712 Project.exe Token: SeShutdownPrivilege 1712 Project.exe Token: SeShutdownPrivilege 1712 Project.exe Token: SeShutdownPrivilege 1712 Project.exe Token: SeShutdownPrivilege 1712 Project.exe Token: SeShutdownPrivilege 1712 Project.exe Token: SeShutdownPrivilege 1712 Project.exe Token: SeShutdownPrivilege 1712 Project.exe Token: SeShutdownPrivilege 1712 Project.exe Token: SeShutdownPrivilege 1712 Project.exe Token: SeShutdownPrivilege 1712 Project.exe Token: SeShutdownPrivilege 1712 Project.exe Token: SeShutdownPrivilege 1712 Project.exe Token: SeShutdownPrivilege 1712 Project.exe Token: SeShutdownPrivilege 1712 Project.exe Token: SeShutdownPrivilege 1712 Project.exe Token: SeShutdownPrivilege 1712 Project.exe Token: SeShutdownPrivilege 1712 Project.exe Token: SeShutdownPrivilege 1712 Project.exe Token: SeShutdownPrivilege 1712 Project.exe Token: SeShutdownPrivilege 1712 Project.exe Token: SeShutdownPrivilege 1712 Project.exe Token: SeShutdownPrivilege 1712 Project.exe Token: SeShutdownPrivilege 1712 Project.exe Token: SeShutdownPrivilege 1712 Project.exe Token: SeShutdownPrivilege 1712 Project.exe Token: SeShutdownPrivilege 1712 Project.exe Token: SeShutdownPrivilege 1712 Project.exe Token: SeShutdownPrivilege 1712 Project.exe Token: SeShutdownPrivilege 1712 Project.exe Token: SeShutdownPrivilege 1712 Project.exe Token: SeShutdownPrivilege 1712 Project.exe Token: SeShutdownPrivilege 1712 Project.exe Token: SeShutdownPrivilege 1712 Project.exe Token: SeShutdownPrivilege 1712 Project.exe Token: SeShutdownPrivilege 1712 Project.exe Token: SeShutdownPrivilege 1712 Project.exe Token: SeShutdownPrivilege 1712 Project.exe Token: SeShutdownPrivilege 1712 Project.exe Token: SeShutdownPrivilege 1712 Project.exe Token: SeShutdownPrivilege 1712 Project.exe Token: SeShutdownPrivilege 1712 Project.exe Token: SeShutdownPrivilege 1712 Project.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
Project.exedescription pid process target process PID 1712 wrote to memory of 2644 1712 Project.exe Project.exe PID 1712 wrote to memory of 2644 1712 Project.exe Project.exe PID 1712 wrote to memory of 2644 1712 Project.exe Project.exe PID 1712 wrote to memory of 2644 1712 Project.exe Project.exe PID 1712 wrote to memory of 2644 1712 Project.exe Project.exe PID 1712 wrote to memory of 2644 1712 Project.exe Project.exe PID 1712 wrote to memory of 2644 1712 Project.exe Project.exe PID 1712 wrote to memory of 2644 1712 Project.exe Project.exe PID 1712 wrote to memory of 2644 1712 Project.exe Project.exe PID 1712 wrote to memory of 2644 1712 Project.exe Project.exe PID 1712 wrote to memory of 2644 1712 Project.exe Project.exe PID 1712 wrote to memory of 2644 1712 Project.exe Project.exe PID 1712 wrote to memory of 2644 1712 Project.exe Project.exe PID 1712 wrote to memory of 2644 1712 Project.exe Project.exe PID 1712 wrote to memory of 2644 1712 Project.exe Project.exe PID 1712 wrote to memory of 2644 1712 Project.exe Project.exe PID 1712 wrote to memory of 2644 1712 Project.exe Project.exe PID 1712 wrote to memory of 2644 1712 Project.exe Project.exe PID 1712 wrote to memory of 2644 1712 Project.exe Project.exe PID 1712 wrote to memory of 2644 1712 Project.exe Project.exe PID 1712 wrote to memory of 2644 1712 Project.exe Project.exe PID 1712 wrote to memory of 2644 1712 Project.exe Project.exe PID 1712 wrote to memory of 2644 1712 Project.exe Project.exe PID 1712 wrote to memory of 2644 1712 Project.exe Project.exe PID 1712 wrote to memory of 2644 1712 Project.exe Project.exe PID 1712 wrote to memory of 2644 1712 Project.exe Project.exe PID 1712 wrote to memory of 2644 1712 Project.exe Project.exe PID 1712 wrote to memory of 2644 1712 Project.exe Project.exe PID 1712 wrote to memory of 2644 1712 Project.exe Project.exe PID 1712 wrote to memory of 2644 1712 Project.exe Project.exe PID 1712 wrote to memory of 2644 1712 Project.exe Project.exe PID 1712 wrote to memory of 2644 1712 Project.exe Project.exe PID 1712 wrote to memory of 2644 1712 Project.exe Project.exe PID 1712 wrote to memory of 2644 1712 Project.exe Project.exe PID 1712 wrote to memory of 2644 1712 Project.exe Project.exe PID 1712 wrote to memory of 2644 1712 Project.exe Project.exe PID 1712 wrote to memory of 2644 1712 Project.exe Project.exe PID 1712 wrote to memory of 2644 1712 Project.exe Project.exe PID 1712 wrote to memory of 2644 1712 Project.exe Project.exe PID 1712 wrote to memory of 2112 1712 Project.exe Project.exe PID 1712 wrote to memory of 2112 1712 Project.exe Project.exe PID 1712 wrote to memory of 2112 1712 Project.exe Project.exe PID 1712 wrote to memory of 3060 1712 Project.exe Project.exe PID 1712 wrote to memory of 3060 1712 Project.exe Project.exe PID 1712 wrote to memory of 3060 1712 Project.exe Project.exe PID 1712 wrote to memory of 3060 1712 Project.exe Project.exe PID 1712 wrote to memory of 3060 1712 Project.exe Project.exe PID 1712 wrote to memory of 3060 1712 Project.exe Project.exe PID 1712 wrote to memory of 3060 1712 Project.exe Project.exe PID 1712 wrote to memory of 3060 1712 Project.exe Project.exe PID 1712 wrote to memory of 3060 1712 Project.exe Project.exe PID 1712 wrote to memory of 3060 1712 Project.exe Project.exe PID 1712 wrote to memory of 3060 1712 Project.exe Project.exe PID 1712 wrote to memory of 3060 1712 Project.exe Project.exe PID 1712 wrote to memory of 3060 1712 Project.exe Project.exe PID 1712 wrote to memory of 3060 1712 Project.exe Project.exe PID 1712 wrote to memory of 3060 1712 Project.exe Project.exe PID 1712 wrote to memory of 3060 1712 Project.exe Project.exe PID 1712 wrote to memory of 3060 1712 Project.exe Project.exe PID 1712 wrote to memory of 3060 1712 Project.exe Project.exe PID 1712 wrote to memory of 3060 1712 Project.exe Project.exe PID 1712 wrote to memory of 3060 1712 Project.exe Project.exe PID 1712 wrote to memory of 3060 1712 Project.exe Project.exe PID 1712 wrote to memory of 3060 1712 Project.exe Project.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Project.exe"C:\Users\Admin\AppData\Local\Temp\Project.exe"1⤵
- Drops startup file
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Project.exe"C:\Users\Admin\AppData\Local\Temp\Project.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\project" --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1048 --field-trial-handle=1132,i,13942639485619888158,2911610544392860811,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:22⤵
-
C:\Users\Admin\AppData\Local\Temp\Project.exe"C:\Users\Admin\AppData\Local\Temp\Project.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\project" --mojo-platform-channel-handle=1580 --field-trial-handle=1132,i,13942639485619888158,2911610544392860811,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:82⤵
-
C:\Users\Admin\AppData\Local\Temp\Project.exe"C:\Users\Admin\AppData\Local\Temp\Project.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\project" --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=angle --use-angle=swiftshader-webgl --mojo-platform-channel-handle=1560 --field-trial-handle=1132,i,13942639485619888158,2911610544392860811,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:22⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
\Users\Admin\AppData\Local\Temp\77bbf260-cd3c-4aca-bf80-8612e85cca9c.tmp.nodeFilesize
1.8MB
MD53072b68e3c226aff39e6782d025f25a8
SHA1cf559196d74fa490ac8ce192db222c9f5c5a006a
SHA2567fb52b781709b065c240b6b81394be6e72e53fe11d7c8e0f7b49dd417eb78a01
SHA51261ebc72c20195e99244d95af1ab44fa06201a1aee2b5da04490fdc4312e8324a40b0e15a7b42fab5179753d767c1d08ae1a7a56ac71a6e100e63f83db849ee61
-
\Users\Admin\AppData\Local\Temp\821d502b-68ac-42c2-bd97-4d65fa990145.tmp.nodeFilesize
134KB
MD5109624345394b9641a2dee876c3c354f
SHA131d960ef30dca42c7e97c1bb36dd50a1bf0c72d4
SHA2564450d61845c86710fa7f3f98c77469f2c4a7478c04184c20c0fed589a3e4b52e
SHA512382a77c62d8ec1150a055bae9b579279344d0a70d579ceaff137818bbbe77f392f98f334ce3bf33cb3c3547d57202426350fca0f713bd3912db5f17979a3d40c
-
memory/2644-10-0x0000000000060000-0x0000000000061000-memory.dmpFilesize
4KB
-
memory/2644-40-0x00000000774A0000-0x00000000774A1000-memory.dmpFilesize
4KB