Overview
overview
10Static
static
10Cheat_Bypa...ss.dll
windows7-x64
1Cheat_Bypa...ss.dll
windows10-2004-x64
1Cheat_Bypa...TA.exe
windows7-x64
10Cheat_Bypa...TA.exe
windows10-2004-x64
10Cheat_Bypa...64.exe
windows7-x64
1Cheat_Bypa...64.exe
windows10-2004-x64
1Cheat_Bypa...ss.dll
windows7-x64
1Cheat_Bypa...ss.dll
windows10-2004-x64
1Cheat_Bypa...TA.exe
windows7-x64
10Cheat_Bypa...TA.exe
windows10-2004-x64
10Cheat_Bypa...64.exe
windows7-x64
1Cheat_Bypa...64.exe
windows10-2004-x64
3PPRE/PPRE.exe
windows7-x64
7PPRE/PPRE.exe
windows10-2004-x64
7$PLUGINSDI...ls.dll
windows7-x64
3$PLUGINSDI...ls.dll
windows10-2004-x64
3$PLUGINSDI...em.dll
windows7-x64
3$PLUGINSDI...em.dll
windows10-2004-x64
3LICENSES.c...m.html
windows7-x64
1LICENSES.c...m.html
windows10-2004-x64
1Project.exe
windows7-x64
7Project.exe
windows10-2004-x64
7d3dcompiler_47.dll
windows10-2004-x64
1ffmpeg.dll
windows7-x64
1ffmpeg.dll
windows10-2004-x64
1libEGL.dll
windows7-x64
1libEGL.dll
windows10-2004-x64
1libGLESv2.dll
windows7-x64
1libGLESv2.dll
windows10-2004-x64
1locales/de.ps1
windows7-x64
1locales/de.ps1
windows10-2004-x64
1locales/nb.ps1
windows7-x64
1Analysis
-
max time kernel
122s -
max time network
134s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
04-03-2024 15:07
Behavioral task
behavioral1
Sample
Cheat_Bypass_1.6/Cheat_MTA/Bypass.dll
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
Cheat_Bypass_1.6/Cheat_MTA/Bypass.dll
Resource
win10v2004-20240226-en
Behavioral task
behavioral3
Sample
Cheat_Bypass_1.6/Cheat_MTA/Cheat_MTA.exe
Resource
win7-20240221-en
Behavioral task
behavioral4
Sample
Cheat_Bypass_1.6/Cheat_MTA/Cheat_MTA.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral5
Sample
Cheat_Bypass_1.6/Cheat_MTA/Executor/Xenos64.exe
Resource
win7-20240215-en
Behavioral task
behavioral6
Sample
Cheat_Bypass_1.6/Cheat_MTA/Executor/Xenos64.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral7
Sample
Cheat_Bypass_1.6/Cheat_MTA/Bypass.dll
Resource
win7-20240220-en
Behavioral task
behavioral8
Sample
Cheat_Bypass_1.6/Cheat_MTA/Bypass.dll
Resource
win10v2004-20240226-en
Behavioral task
behavioral9
Sample
Cheat_Bypass_1.6/Cheat_MTA/Cheat_MTA.exe
Resource
win7-20240221-en
Behavioral task
behavioral10
Sample
Cheat_Bypass_1.6/Cheat_MTA/Cheat_MTA.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral11
Sample
Cheat_Bypass_1.6/Cheat_MTA/Executor/Xenos64.exe
Resource
win7-20240221-en
Behavioral task
behavioral12
Sample
Cheat_Bypass_1.6/Cheat_MTA/Executor/Xenos64.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral13
Sample
PPRE/PPRE.exe
Resource
win7-20240221-en
Behavioral task
behavioral14
Sample
PPRE/PPRE.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral15
Sample
$PLUGINSDIR/StdUtils.dll
Resource
win7-20240221-en
Behavioral task
behavioral16
Sample
$PLUGINSDIR/StdUtils.dll
Resource
win10v2004-20240226-en
Behavioral task
behavioral17
Sample
$PLUGINSDIR/System.dll
Resource
win7-20240215-en
Behavioral task
behavioral18
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20240226-en
Behavioral task
behavioral19
Sample
LICENSES.chromium.html
Resource
win7-20240221-en
Behavioral task
behavioral20
Sample
LICENSES.chromium.html
Resource
win10v2004-20240226-en
Behavioral task
behavioral21
Sample
Project.exe
Resource
win7-20240221-en
Behavioral task
behavioral22
Sample
Project.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral23
Sample
d3dcompiler_47.dll
Resource
win10v2004-20240226-en
Behavioral task
behavioral24
Sample
ffmpeg.dll
Resource
win7-20240221-en
Behavioral task
behavioral25
Sample
ffmpeg.dll
Resource
win10v2004-20240226-en
Behavioral task
behavioral26
Sample
libEGL.dll
Resource
win7-20240221-en
Behavioral task
behavioral27
Sample
libEGL.dll
Resource
win10v2004-20240226-en
Behavioral task
behavioral28
Sample
libGLESv2.dll
Resource
win7-20240215-en
Behavioral task
behavioral29
Sample
libGLESv2.dll
Resource
win10v2004-20240226-en
Behavioral task
behavioral30
Sample
locales/de.ps1
Resource
win7-20240221-en
Behavioral task
behavioral31
Sample
locales/de.ps1
Resource
win10v2004-20240226-en
Behavioral task
behavioral32
Sample
locales/nb.ps1
Resource
win7-20240221-en
General
-
Target
locales/nb.ps1
-
Size
332KB
-
MD5
f15c568a9ed8b2ca497571453ce6bce2
-
SHA1
957ffec56ce14f33fa75f493936552751e966d16
-
SHA256
18512064afcc3fb5a0e1f36400e592ff34e8c6c9a7ed0bbe3432255c4759ad8c
-
SHA512
3bd27f9612b39836e5e7654e6f07c2fd5a31f2c338db36daa51e2c1462986cf4b651d555245ee2e97acd044e44a5beffb8cc9d56c1af11f52fedf9f7fbf7da97
-
SSDEEP
6144:I9HHvGNQkyLirVh6EQFewqOp7fyyVgLmy07E6SRw5PX4RXODcF:6npqrOEQFewqOp7fyy3ELG5PX4IDcF
Malware Config
Signatures
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
powershell.exepid process 1804 powershell.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
powershell.exedescription pid process Token: SeDebugPrivilege 1804 powershell.exe
Processes
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1804-4-0x000000001B2E0000-0x000000001B5C2000-memory.dmpFilesize
2.9MB
-
memory/1804-5-0x0000000002470000-0x0000000002478000-memory.dmpFilesize
32KB
-
memory/1804-6-0x000007FEF5680000-0x000007FEF601D000-memory.dmpFilesize
9.6MB
-
memory/1804-7-0x0000000002640000-0x00000000026C0000-memory.dmpFilesize
512KB
-
memory/1804-8-0x0000000002640000-0x00000000026C0000-memory.dmpFilesize
512KB
-
memory/1804-9-0x0000000002640000-0x00000000026C0000-memory.dmpFilesize
512KB
-
memory/1804-10-0x000007FEF5680000-0x000007FEF601D000-memory.dmpFilesize
9.6MB
-
memory/1804-11-0x0000000002640000-0x00000000026C0000-memory.dmpFilesize
512KB
-
memory/1804-12-0x000007FEF5680000-0x000007FEF601D000-memory.dmpFilesize
9.6MB
-
memory/1804-13-0x0000000002640000-0x00000000026C0000-memory.dmpFilesize
512KB