Overview
overview
10Static
static
7ONECHEAT.exe
windows10-2004-x64
ONECHEAT.exe
windows7-x64
10ONECHEAT.exe
windows10-1703-x64
10ONECHEAT.exe
windows10-2004-x64
10ONECHEAT.exe
windows11-21h2-x64
⌚/38.exe
windows10-2004-x64
⌚/38.exe
windows7-x64
⌚/38.exe
windows10-1703-x64
⌚/38.exe
windows10-2004-x64
⌚/38.exe
windows11-21h2-x64
⌚/ABC.exe
windows10-2004-x64
⌚/ABC.exe
windows7-x64
⌚/ABC.exe
windows10-1703-x64
⌚/ABC.exe
windows10-2004-x64
⌚/ABC.exe
windows11-21h2-x64
⌚/mrn_p...ed.exe
windows10-1703-x64
⌚/mrn_p...ed.exe
windows7-x64
⌚/mrn_p...ed.exe
windows10-1703-x64
⌚/mrn_p...ed.exe
windows10-2004-x64
⌚/mrn_p...ed.exe
windows11-21h2-x64
General
-
Target
ONECHEAT.exe
-
Size
8.0MB
-
Sample
240411-h8m8ssee84
-
MD5
e8db6be4e6b4fa2e0e903a4eff8f620a
-
SHA1
7fa63dc0b0560759658f9a2efab4659e917bd71b
-
SHA256
37362d9d89030be684513e8d07f7b54893192a14818110ed1915021deefadb99
-
SHA512
4114c1dc2979ab87624ea76f6b81704d86d3bae84dff4115d2663a3460068894d23c1cd8b4653086c7e71648e5723cba2cdd3ac53ab00a9ecbd2ba9823ca610e
-
SSDEEP
196608:FjkXAfTw9kpnYknqwUSlDCRGfBCIWwB26CI5aR:FjxJpYqby6V9i
Behavioral task
behavioral1
Sample
ONECHEAT.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral2
Sample
ONECHEAT.exe
Resource
win7-20240221-en
Behavioral task
behavioral3
Sample
ONECHEAT.exe
Resource
win10-20240404-en
Behavioral task
behavioral4
Sample
ONECHEAT.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral5
Sample
ONECHEAT.exe
Resource
win11-20240221-en
Behavioral task
behavioral6
Sample
⌚/38.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral7
Sample
⌚/38.exe
Resource
win7-20240221-en
Behavioral task
behavioral8
Sample
⌚/38.exe
Resource
win10-20240404-en
Behavioral task
behavioral9
Sample
⌚/38.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral10
Sample
⌚/38.exe
Resource
win11-20240221-en
Behavioral task
behavioral11
Sample
⌚/ABC.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral12
Sample
⌚/ABC.exe
Resource
win7-20240221-en
Behavioral task
behavioral13
Sample
⌚/ABC.exe
Resource
win10-20240404-en
Behavioral task
behavioral14
Sample
⌚/ABC.exe
Resource
win10v2004-20240319-en
Behavioral task
behavioral15
Sample
⌚/ABC.exe
Resource
win11-20240221-en
Behavioral task
behavioral16
Sample
⌚/mrn_protected.exe
Resource
win10-20240404-en
Behavioral task
behavioral17
Sample
⌚/mrn_protected.exe
Resource
win7-20240221-en
Behavioral task
behavioral18
Sample
⌚/mrn_protected.exe
Resource
win10-20240404-en
Behavioral task
behavioral19
Sample
⌚/mrn_protected.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral20
Sample
⌚/mrn_protected.exe
Resource
win11-20240221-en
Malware Config
Targets
-
-
Target
ONECHEAT.exe
-
Size
8.0MB
-
MD5
e8db6be4e6b4fa2e0e903a4eff8f620a
-
SHA1
7fa63dc0b0560759658f9a2efab4659e917bd71b
-
SHA256
37362d9d89030be684513e8d07f7b54893192a14818110ed1915021deefadb99
-
SHA512
4114c1dc2979ab87624ea76f6b81704d86d3bae84dff4115d2663a3460068894d23c1cd8b4653086c7e71648e5723cba2cdd3ac53ab00a9ecbd2ba9823ca610e
-
SSDEEP
196608:FjkXAfTw9kpnYknqwUSlDCRGfBCIWwB26CI5aR:FjxJpYqby6V9i
-
Detect ZGRat V1
-
Modifies security service
-
Suspicious use of NtCreateUserProcessOtherParentProcess
-
Identifies VirtualBox via ACPI registry values (likely anti-VM)
-
Creates new service(s)
-
Drops file in Drivers directory
-
Modifies Installed Components in the registry
-
Sets service image path in registry
-
Stops running service(s)
-
Checks BIOS information in registry
BIOS information is often read in order to detect sandboxing environments.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
Drops file in System32 directory
-
Suspicious use of NtSetInformationThreadHideFromDebugger
-
Suspicious use of SetThreadContext
-
-
-
Target
⌚/38.exe
-
Size
4.7MB
-
MD5
ca43f43bd60696a071914f7d56dfb170
-
SHA1
0395c64a4cfc0c5b5e4f0213a2947e8971db0646
-
SHA256
c589837b7c914750d50c96183a6133940d0770d0a690c81b7594dafad925b8a9
-
SHA512
5a476ade3e31ecdd01544111912bdf3cc43883c32703b72d698420c1ee7ec839c01cb7eadc7bfdc2f94ea7b4caac2e2a4e3f3ee088f1a1674a242d4db8d4a3be
-
SSDEEP
98304:ue5sDcJRr2LDOKwWDxVkZUm9i+lvBJ7fCwrra37elTmHzVczwqYrmhLyK:ue2I7r2LDbxVkZUmDlJFf/aZ7qN
Score1/10 -
-
-
Target
⌚/ABC.exe
-
Size
13KB
-
MD5
2808310786effc87a4359c778a73a7ee
-
SHA1
525f278678ad73a34c368f0afc4558ed0454f076
-
SHA256
33d9753ee9b3920352b743d72adfd62c969ab0619eb5673151f478ebdfa197a5
-
SHA512
02348e663f215ff6cf37cccea7ea4da3c53362aa75a1a0a88279b9a0acbf60deb30829b47ff7ce1ae97c43ca52b7e09ca90cbb621fee2da1a0ddcc65677c0d67
-
SSDEEP
384:RWaw77Ke8FeO+DK32XzUzxcRx8ptYcFwVc03K:2KFqIUxItYcFwVc6K
Score1/10 -
-
-
Target
⌚/mrn_protected.exe
-
Size
3.6MB
-
MD5
b14267d48b30dba8dcabd206a470aad7
-
SHA1
b5f157257559d86f6fb94c2b13fee51309e1f860
-
SHA256
2ac6ec590745348760ad8b486561e6a230d2fbba7444e2f6ad0c0ccc9355ce89
-
SHA512
7f1ded2d19f7b33acfa2e8dcaff19c5bd5533e23e950d03cd973c3697012b4a04403f4bf35201f405a1f63ae8a455f0bc65dc4b556afc5afa26e7ff0595eaab3
-
SSDEEP
98304:btBsTZjn6E/V4B9PNDTsJJEcKTXzy3RDWxmeuo6cBw:RyTZjnRdSDnoPKTXYRDj0w
Score1/10 -
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
2Create or Modify System Process
3Windows Service
3Privilege Escalation
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
2Create or Modify System Process
3Windows Service
3Defense Evasion
Hide Artifacts
1Hidden Files and Directories
1Impair Defenses
1Modify Registry
5Subvert Trust Controls
1Install Root Certificate
1Virtualization/Sandbox Evasion
1