Analysis
- max time kernel
149s - max time network
155s - platform
windows11-21h2_x64 - resource
win11-20260513-en - resource tags
- submitted
03/06/2026, 12:14
General
- Target e99cce80-7901-4497-b4e6-da8b107a6fd2.exe
- Size 3.2MB
- Sample260603-pejf3set8z
- SHA256 6d0e14d66da69c163f824f8fa7d87de3eea41cdbd48c0973de296cf6d2d0fed3
Malware Config
Signatures
- Downloads MZ/PE file 1 IoCs
- Executes dropped EXE 8 IoCs
- Loads dropped DLL 4 IoCs
- Modifies file permissions 1 TTPs 2 IoCs
- Stops running service(s) 4 TTPs
- Checks for any installed AV software in registry 1 TTPs 12 IoCs
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
- Drops file in Program Files directory 64 IoCs
- Launches sc.exe 2 IoCs
Sc.exe is a Windows utlilty to control services on the system.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 7 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Inno Setup is an open-source installation builder for Windows applications. 5 IoCs
Inno Setup installer
- Modifies registry class 16 IoCs
- Runs net.exe
- Suspicious behavior: EnumeratesProcesses 12 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of FindShellTrayWindow 2 IoCs
- Suspicious use of SetWindowsHookEx 1 IoCs
- Suspicious use of WriteProcessMemory 16 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\e99cce80-7901-4497-b4e6-da8b107a6fd2.exe"C:\Users\Admin\AppData\Local\Temp\e99cce80-7901-4497-b4e6-da8b107a6fd2.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-2B641.tmp\e99cce80-7901-4497-b4e6-da8b107a6fd2.tmp"C:\Users\Admin\AppData\Local\Temp\is-2B641.tmp\e99cce80-7901-4497-b4e6-da8b107a6fd2.tmp" /SL5="$600D8,2408085,845312,C:\Users\Admin\AppData\Local\Temp\e99cce80-7901-4497-b4e6-da8b107a6fd2.exe"2⤵
- Downloads MZ/PE file
- Executes dropped EXE
- Loads dropped DLL
- Checks for any installed AV software in registry
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-OKD9R.tmp\CheatEngine74.exe"C:\Users\Admin\AppData\Local\Temp\is-OKD9R.tmp\CheatEngine74.exe" /VERYSILENT /ZBDIST3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-PNRAA.tmp\CheatEngine74.tmp"C:\Users\Admin\AppData\Local\Temp\is-PNRAA.tmp\CheatEngine74.tmp" /SL5="$14026E,23492458,780800,C:\Users\Admin\AppData\Local\Temp\is-OKD9R.tmp\CheatEngine74.exe" /VERYSILENT /ZBDIST4⤵
- Executes dropped EXE
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Windows\SYSTEM32\net.exe"net" stop BadlionAntic5⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop BadlionAntic6⤵
-
-
-
C:\Windows\SYSTEM32\net.exe"net" stop BadlionAnticheat5⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop BadlionAnticheat6⤵
-
-
-
C:\Windows\SYSTEM32\sc.exe"sc" delete BadlionAntic5⤵
- Launches sc.exe
-
-
C:\Windows\SYSTEM32\sc.exe"sc" delete BadlionAnticheat5⤵
- Launches sc.exe
-
-
C:\Users\Admin\AppData\Local\Temp\is-744EA.tmp\_isetup\_setup64.tmphelper 105 0x4305⤵
- Executes dropped EXE
-
-
C:\Windows\system32\icacls.exe"icacls" "C:\Program Files\Cheat Engine 7.4" /grant *S-1-15-2-1:(OI)(CI)(RX)5⤵
- Modifies file permissions
-
-
C:\Program Files\Cheat Engine 7.4\Kernelmoduleunloader.exe"C:\Program Files\Cheat Engine 7.4\Kernelmoduleunloader.exe" /SETUP5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Program Files\Cheat Engine 7.4\windowsrepair.exe"C:\Program Files\Cheat Engine 7.4\windowsrepair.exe" /s5⤵
- Executes dropped EXE
-
-
C:\Windows\system32\icacls.exe"icacls" "C:\Program Files\Cheat Engine 7.4" /grant *S-1-15-2-1:(OI)(CI)(RX)5⤵
- Modifies file permissions
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\is-OKD9R.tmp\prod0_extract\RazerLightInstaller.exe"C:\Users\Admin\AppData\Local\Temp\is-OKD9R.tmp\prod0_extract\RazerLightInstaller.exe" /psh=GnjW1dejx8pBCWNHLqWwAK9MlPgQOxmUfyFfxvFagOjWa6EMasJ5gSozKxUCIv2KDJ7yIdjjrce3RKYETMU3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\is-OKD9R.tmp\prod1_extract\cookie_mmm_irs_ppi_008_585.exe"C:\Users\Admin\AppData\Local\Temp\is-OKD9R.tmp\prod1_extract\cookie_mmm_irs_ppi_008_585.exe" /silent /ws /psh:agiSfNdDBzstWlZryfJaLKH1qzekzB2hf0hNXQ56BXHhsW9zJJXQy23QniWC6Jg2Zs7Us0hjvKZmHNYLvC /cookie:mmm_irs_ppi_008_585_c3⤵
- Executes dropped EXE
- Loads dropped DLL
- Writes to the Master Boot Record (MBR)
- System Location Discovery: System Language Discovery
- Modifies registry class
-
-
Network
MITRE ATT&CK Enterprise v16
Persistence
Create or Modify System Process
1Windows Service
1Pre-OS Boot
1Bootkit
1Defense Evasion
File and Directory Permissions Modification
1Impair Defenses
1Pre-OS Boot
1Bootkit
1Replay Monitor
Loading Replay Monitor...
Downloads
Cheat Engine.exe
Kernelmoduleunloader.exe
allochook-i386.dll
allochook-x86_64.dll
addtonewgroup.lua
autosave.lua
bigendian.lua
ceshare.lua
ceshare_account.lua
ceshare_comments.lua
ceshare_fulltablelist.lua
ceshare_permissions.lua
ceshare_processlistextention.lua
ceshare_publish.lua
ceshare_querycheats.lua
ceshare_requests.lua
BrowseCheats.FRM
CommentsOrRequests.FRM
InitialSetup.FRM
Permissions.FRM
PublishCheat.FRM
UpdateOrNew.FRM
link.png
CEJVMTI.dll
CEJVMTI.dll
DotNetInterface.dll
MonoDataCollector32.dll
MonoDataCollector64.dll
Pipe.cpp
Pipe.h
CEJVMTI.cpp
scoreboard.png
ced3d10hook.dll
ced3d10hook64.dll
ced3d11hook.dll
ced3d11hook64.dll
ced3d9hook.dll
ced3d9hook64.dll
d3dhook.dll
d3dhook64.dll
is-74CF9.tmp
language.ini
libipt-32.dll
libipt-64.dll
luaclient-i386.dll
luaclient-x86_64.dll
overlay.fx
speedhack-i386.dll
speedhack-x86_64.dll
vehdebug-i386.dll
vehdebug-x86_64.dll
windowsrepair.exe
winhook-i386.dll
winhook-x86_64.dll
e99cce80-7901-4497-b4e6-da8b107a6fd2.tmp
_setup64.tmp
Avast_BRW.png
Avast_One.png
CheatEngine74.exe
Razer_Axon.png
botva2.dll
loader.gif
logo.png
prod0.zip
RazerLightInstaller.exe
prod1.zip
cookie_mmm_irs_ppi_008_585.exe
zbShieldUtils.dll
CheatEngine74.tmp
memory/1684-763-0x0000000000400000-0x00000000004CC000-memory.dmp
memory/1684-101-0x0000000000400000-0x00000000004CC000-memory.dmp
memory/2980-762-0x0000000000400000-0x0000000000682000-memory.dmp
memory/3400-77-0x0000000000400000-0x00000000006FE000-memory.dmp
memory/3400-83-0x0000000000400000-0x00000000006FE000-memory.dmp
memory/3400-47-0x0000000003E60000-0x0000000003E6F000-memory.dmp
memory/3400-60-0x0000000003E60000-0x0000000003E6F000-memory.dmp
memory/3400-59-0x0000000000400000-0x00000000006FE000-memory.dmp
memory/3400-66-0x0000000000400000-0x00000000006FE000-memory.dmp
memory/3400-33-0x0000000003E60000-0x0000000003E6F000-memory.dmp
memory/3400-71-0x0000000000400000-0x00000000006FE000-memory.dmp
memory/3400-19-0x0000000000400000-0x00000000006FE000-memory.dmp
memory/3400-20-0x00000000028F0000-0x00000000028F1000-memory.dmp
memory/3400-105-0x0000000000400000-0x00000000006FE000-memory.dmp
memory/3400-46-0x0000000000400000-0x00000000006FE000-memory.dmp
memory/3400-5-0x00000000028F0000-0x00000000028F1000-memory.dmp
memory/3400-86-0x0000000000400000-0x00000000006FE000-memory.dmp
memory/3400-89-0x0000000000400000-0x00000000006FE000-memory.dmp
memory/3400-92-0x0000000000400000-0x00000000006FE000-memory.dmp
memory/3400-97-0x0000000000400000-0x00000000006FE000-memory.dmp
memory/3788-792-0x00000000005B0000-0x00000000006D6000-memory.dmp
memory/3788-833-0x00000000062F0000-0x0000000006312000-memory.dmp
memory/4360-18-0x0000000000400000-0x00000000004DC000-memory.dmp
memory/4360-0-0x0000000000400000-0x00000000004DC000-memory.dmp