Overview
overview
9Static
static
7release.zip
windows7-x64
1release.zip
windows10-2004-x64
1release.rar
windows7-x64
3release.rar
windows10-2004-x64
7release/ma...at.exe
windows7-x64
9release/ma...at.exe
windows10-2004-x64
9release/ma...er.exe
windows7-x64
9release/ma...er.exe
windows10-2004-x64
9release/map/map.exe
windows7-x64
9release/map/map.exe
windows10-2004-x64
9release/readme.txt
windows7-x64
1release/readme.txt
windows10-2004-x64
1Analysis
-
max time kernel
93s -
max time network
96s -
platform
windows10-2004_x64 -
resource
win10v2004-20240611-en -
resource tags
arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system -
submitted
16-06-2024 17:04
Behavioral task
behavioral1
Sample
release.zip
Resource
win7-20240611-en
Behavioral task
behavioral2
Sample
release.zip
Resource
win10v2004-20240226-en
Behavioral task
behavioral3
Sample
release.rar
Resource
win7-20240611-en
Behavioral task
behavioral4
Sample
release.rar
Resource
win10v2004-20240226-en
Behavioral task
behavioral5
Sample
release/main/cheat.exe
Resource
win7-20240611-en
Behavioral task
behavioral6
Sample
release/main/cheat.exe
Resource
win10v2004-20240611-en
Behavioral task
behavioral7
Sample
release/main/loader.exe
Resource
win7-20240508-en
Behavioral task
behavioral8
Sample
release/main/loader.exe
Resource
win10v2004-20240611-en
Behavioral task
behavioral9
Sample
release/map/map.exe
Resource
win7-20240611-en
Behavioral task
behavioral10
Sample
release/map/map.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral11
Sample
release/readme.txt
Resource
win7-20240221-en
Behavioral task
behavioral12
Sample
release/readme.txt
Resource
win10v2004-20240508-en
General
-
Target
release/main/cheat.exe
-
Size
3.9MB
-
MD5
200e4d1a5f37c511d30b7c778556b1a1
-
SHA1
809060eed706b528705b9e0082a9d0b8f1449aaf
-
SHA256
ab2b268de451ce6bbc5879b014180e47aecd874181d1e03c34159f78839ded67
-
SHA512
8fbf7d4b092c7a0d964fe4a1a0158811fdd1ed0a8ff49aa7de02c6dbcfbf70fa57959b2a922a731da598cd37e3fce008fa330a9daa892f32f61696a44cf1672f
-
SSDEEP
98304:F3t8oJL3g4KQWRa49EwOIJ/enT55/FPeO5hOCEI47zFk:H7hKQW84O4eV5FZjOCEIu5k
Malware Config
Signatures
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
Processes:
cheat.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ cheat.exe -
Sets service image path in registry 2 TTPs 1 IoCs
Processes:
cheat.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\frAQBc8Wsa1xVPfv\ImagePath = "\\??\\C:\\Users\\Admin\\AppData\\Local\\Temp\\frAQBc8Wsa1xVPfv" cheat.exe -
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
Processes:
cheat.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion cheat.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion cheat.exe -
Processes:
resource yara_rule behavioral6/memory/1196-0-0x00007FF65AAC0000-0x00007FF65B509000-memory.dmp themida behavioral6/memory/1196-2-0x00007FF65AAC0000-0x00007FF65B509000-memory.dmp themida behavioral6/memory/1196-3-0x00007FF65AAC0000-0x00007FF65B509000-memory.dmp themida behavioral6/memory/1196-4-0x00007FF65AAC0000-0x00007FF65B509000-memory.dmp themida behavioral6/memory/1196-6-0x00007FF65AAC0000-0x00007FF65B509000-memory.dmp themida behavioral6/memory/1196-7-0x00007FF65AAC0000-0x00007FF65B509000-memory.dmp themida behavioral6/memory/1196-5-0x00007FF65AAC0000-0x00007FF65B509000-memory.dmp themida behavioral6/memory/1196-8-0x00007FF65AAC0000-0x00007FF65B509000-memory.dmp themida behavioral6/memory/1196-13-0x00007FF65AAC0000-0x00007FF65B509000-memory.dmp themida behavioral6/memory/1196-15-0x00007FF65AAC0000-0x00007FF65B509000-memory.dmp themida -
Processes:
cheat.exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA cheat.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
Processes:
cheat.exepid process 1196 cheat.exe -
Suspicious behavior: LoadsDriver 1 IoCs
Processes:
cheat.exepid process 1196 cheat.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
cheat.exedescription pid process Token: SeLoadDriverPrivilege 1196 cheat.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\release\main\cheat.exe"C:\Users\Admin\AppData\Local\Temp\release\main\cheat.exe"1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Sets service image path in registry
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: LoadsDriver
- Suspicious use of AdjustPrivilegeToken
PID:1196