Overview

overview

10

Static

static

10

MaiCheats Loader.exe

windows7-x64

7

MaiCheats Loader.exe

windows10-2004-x64

8

data/asset...oc.dll

windows7-x64

1

data/asset...oc.dll

windows10-2004-x64

1

data/asset...32.dll

windows7-x64

3

data/asset...32.dll

windows10-2004-x64

3

data/data/OpenAL.dll

windows7-x64

1

data/data/OpenAL.dll

windows10-2004-x64

1

data/data/...32.dll

windows7-x64

3

data/data/...32.dll

windows10-2004-x64

3

data/data/...64.dll

windows7-x64

1

data/data/...64.dll

windows10-2004-x64

1

data/data/...86.dll

windows7-x64

3

data/data/...86.dll

windows10-2004-x64

3

data/data/lwjgl.dll

windows7-x64

1

data/data/lwjgl.dll

windows10-2004-x64

1

data/data/lwjgl32.dll

windows7-x64

3

data/data/lwjgl32.dll

windows10-2004-x64

3

data/data/...gl.dll

windows7-x64

1

data/data/...gl.dll

windows10-2004-x64

1

data/data/...32.dll

windows7-x64

3

data/data/...32.dll

windows10-2004-x64

3

data/data/...tb.dll

windows7-x64

1

data/data/...tb.dll

windows10-2004-x64

1

data/data/...32.dll

windows7-x64

3

data/data/...32.dll

windows10-2004-x64

3

data/data/...fd.dll

windows7-x64

1

data/data/...fd.dll

windows10-2004-x64

1

data/data/...32.dll

windows7-x64

3

data/data/...32.dll

windows10-2004-x64

3

data/glfw.dll

windows7-x64

1

data/glfw.dll

windows10-2004-x64

1

Sharing

Copy URL Twitter E-mail

General

  • Target
    MaiCheats.rar
  • Size 30.7MB
  • Sample241119-vtedkayeje
  • SHA256 cfcd10600d1606d39f345271772578aca4c5c489aebfc4cc870aed1036437234
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
blankgrabbercollectioncredential_accessdefense_evasiondiscoveryexecutionpersistenceprivilege_escalationspywarestealerupx

Malware Config

Targets

    • Target
      MaiCheats Loader.exe
    • Size 356KB
    • SHA256 f1925677418f8b86150c9da038effcaf554d17e06c9559d19130fb715a283ae6
    • MD5 SHA1 SHA512 SSDEEP
    Score
    8/10
    discoveryupxcollectioncredential_accessdefense_evasionexecutionpersistenceprivilege_escalationspywarestealer

    • Command and Scripting Interpreter: PowerShell

      Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

      execution

    • Drops file in Drivers directory

    • Clipboard Data

      Adversaries may collect data stored in the clipboard from users copying information within or between applications.

      collection

    • Executes dropped EXE

    • Loads dropped DLL

    • Unsecured Credentials: Credentials In Files

      Steal credentials from unsecured files.

      credential_accessstealer

    • Accesses cryptocurrency files/wallets, possible credential harvesting

      spyware

    • Legitimate hosting services abused for malware hosting/C2

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Obfuscated Files or Information: Command Obfuscation

      Adversaries may obfuscate content during command execution to impede detection.

      defense_evasion

    • Enumerates processes with tasklist

      discovery

    • Hide Artifacts: Hidden Files and Directories

      defense_evasion

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx
    behavioral1behavioral2
    • Target
      data/assets/jemalloc.dll
    • Size 248KB
    • SHA256 b147a3cc1fce8a514a558a030fe647a4a91761769eedec1c1ca2be1cd712a9e8
    • MD5 SHA1 SHA512 SSDEEP
    Score
    1/10
    behavioral3behavioral4
    • Target
      data/assets/jemalloc32.dll
    • Size 191KB
    • SHA256 7270b1d189c68d3fb655411d0e7002bc9b131328b3cff726946e8fe16fe5b09a
    • MD5 SHA1 SHA512 SSDEEP
    Score
    3/10
    discovery
    behavioral5behavioral6
    • Target
      data/data/OpenAL.dll
    • Size 1.0MB
    • SHA256 1e128050e6ecd9da7a030f76b24d93a1dcb7de55b02d80cd2e2683818e895b5a
    • MD5 SHA1 SHA512 SSDEEP
    Score
    1/10
    behavioral7behavioral8
    • Target
      data/data/OpenAL32.dll
    • Size 982KB
    • SHA256 ac63e0bc581a1fd7ac0bd2553a10913e31ff8eedfe356816dfad186c427ca5ba
    • MD5 SHA1 SHA512 SSDEEP
    Score
    3/10
    discovery
    behavioral10behavioral9
    • Target
      data/data/SAPIWrapper_x64.dll
    • Size 83KB
    • SHA256 a8b701f1ed640bfc7e842f9bc07dd493fad3284f15bc1fa9dfc15371733d6326
    • MD5 SHA1 SHA512 SSDEEP
    Score
    1/10
    behavioral11behavioral12
    • Target
      data/data/SAPIWrapper_x86.dll
    • Size 70KB
    • SHA256 fa69dab9c06f3cdeb8bd7c1b017fb072ba4262682ea21a2e723f00a78f86dc29
    • MD5 SHA1 SHA512 SSDEEP
    Score
    3/10
    discovery
    behavioral13behavioral14
    • Target
      data/data/lwjgl.dll
    • Size 439KB
    • SHA256 207fcf6f27e60600772d202f52ba00edcd085048da30523d3ac03092dd30f873
    • MD5 SHA1 SHA512 SSDEEP
    Score
    1/10
    behavioral15behavioral16
    • Target
      data/data/lwjgl32.dll
    • Size 419KB
    • SHA256 8c9490c5267a615bf0d90a84066628791a453aa30abbe86a8424281b8cdbfc79
    • MD5 SHA1 SHA512 SSDEEP
    Score
    3/10
    discovery
    behavioral17behavioral18
    • Target
      data/data/lwjgl_opengl.dll
    • Size 333KB
    • SHA256 92aec0f2b142a56ad8f361919ee0e6b387c92269efc9645071db6561ae9b6324
    • MD5 SHA1 SHA512 SSDEEP
    Score
    1/10
    behavioral19behavioral20
    • Target
      data/data/lwjgl_opengl32.dll
    • Size 316KB
    • SHA256 8fc4d3f3c0e0a7114f0caec7f2e734fec7e7294ab33696f1557a01e86c0ff128
    • MD5 SHA1 SHA512 SSDEEP
    Score
    3/10
    discovery
    behavioral21behavioral22
    • Target
      data/data/lwjgl_stb.dll
    • Size 488KB
    • SHA256 64b424ce5142ce23b43e2e2bc5cc8543add7c0037a151b279e4e17aa7f7600a0
    • MD5 SHA1 SHA512 SSDEEP
    Score
    1/10
    behavioral23behavioral24
    • Target
      data/data/lwjgl_stb32.dll
    • Size 432KB
    • SHA256 1907bb0e022628fc624d7c3b002e9b79e056d789d6c7578f7f046ea414ac16d5
    • MD5 SHA1 SHA512 SSDEEP
    Score
    3/10
    discovery
    behavioral25behavioral26
    • Target
      data/data/lwjgl_tinyfd.dll
    • Size 209KB
    • SHA256 696a87865bf27f2cb9bc866e6d75e1a4ee3e8c469180cb9f8ebb90a2af876d10
    • MD5 SHA1 SHA512 SSDEEP
    Score
    1/10
    behavioral27behavioral28
    • Target
      data/data/lwjgl_tinyfd32.dll
    • Size 178KB
    • SHA256 432b6f80da7799b582178996575953da2eddfbff6bfef3202724eb4f85a10ffc
    • MD5 SHA1 SHA512 SSDEEP
    Score
    3/10
    discovery
    behavioral29behavioral30
    • Target
      data/glfw.dll
    • Size 347KB
    • SHA256 7cc30e89f7fd61ca8532b4ecb9e05598cf426d0a336bc382a128e28b824a8962
    • MD5 SHA1 SHA512 SSDEEP
    Score
    1/10
    behavioral31behavioral32

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1
T1059

PowerShell

1
T1059.001

Persistence

Event Triggered Execution

1
T1546

Netsh Helper DLL

1
T1546.007

Privilege Escalation

Event Triggered Execution

1
T1546

Netsh Helper DLL

1
T1546.007

Defense Evasion

Hide Artifacts

2
T1564

Hidden Files and Directories

2
T1564.001

Obfuscated Files or Information

1
T1027

Command Obfuscation

1
T1027.010

Credential Access

Unsecured Credentials

2
T1552

Credentials In Files

2
T1552.001

Discovery

Browser Information Discovery

1
T1217

Process Discovery

1
T1057

Remote System Discovery

1
T1018

System Information Discovery

3
T1082

System Location Discovery

1
T1614

System Language Discovery

1
T1614.001

System Network Configuration Discovery

2
T1016

Internet Connection Discovery

1
T1016.001

Wi-Fi Discovery

1
T1016.002

Lateral Movement

Collection

Clipboard Data

1
T1115

Data from Local System

1
T1005

Command and Control

Web Service

1
T1102

Exfiltration

Impact

Tasks

static1

blankgrabber
Score
10/10

behavioral1

discoveryupx
Score
7/10

behavioral2

collectioncredential_accessdefense_evasiondiscoveryexecutionpersistenceprivilege_escalationspywarestealerupx
Score
8/10

behavioral3

Score
1/10

behavioral4

Score
1/10

behavioral5

discovery
Score
3/10

behavioral6

discovery
Score
3/10

behavioral7

Score
1/10

behavioral8

Score
1/10

behavioral9

discovery
Score
3/10

behavioral10

discovery
Score
3/10

behavioral11

Score
1/10

behavioral12

Score
1/10

behavioral13

discovery
Score
3/10

behavioral14

discovery
Score
3/10

behavioral15

Score
1/10

behavioral16

Score
1/10

behavioral17

discovery
Score
3/10

behavioral18

discovery
Score
3/10

behavioral19

Score
1/10

behavioral20

Score
1/10

behavioral21

discovery
Score
3/10

behavioral22

discovery
Score
3/10

behavioral23

Score
1/10

behavioral24

Score
1/10

behavioral25

discovery
Score
3/10

behavioral26

discovery
Score
3/10

behavioral27

Score
1/10

behavioral28

Score
1/10

behavioral29

discovery
Score
3/10

behavioral30

discovery
Score
3/10

behavioral31

Score
1/10

behavioral32

Score
1/10