Overview
overview
8Static
static
3CheatEvolution.zip
windows10-2004-x64
7CheatEvolu...on.exe
windows10-2004-x64
8CheatEvolu...32.exe
windows10-2004-x64
3CheatEvolu...64.exe
windows10-2004-x64
1CheatEvolu...er.exe
windows10-2004-x64
8CheatEvolu...ta.dll
windows10-2004-x64
1CheatEvolu...ct.lua
windows10-2004-x64
3CheatEvolu...ace.js
windows10-2004-x64
3CheatEvolu...gs.lua
windows10-2004-x64
3CheatEvolu...ce.dll
windows10-2004-x64
1CheatEvolu...32.dll
windows10-2004-x64
5CheatEvolu...64.dll
windows10-2004-x64
5CheatEvolu...nfo.js
windows10-2004-x64
3CheatEvolu...ch.bat
windows10-2004-x64
1CheatEvolu...pt.bat
windows10-2004-x64
1CheatEvolu...32.dll
windows10-2004-x64
3CheatEvolu...64.dll
windows10-2004-x64
1CheatEvolu...gs.lua
windows10-2004-x64
3CheatEvolu...86.dll
windows10-2004-x64
3CheatEvolu...64.dll
windows10-2004-x64
1CheatEvolu...86.dll
windows10-2004-x64
3CheatEvolu...64.dll
windows10-2004-x64
1Analysis
- max time kernel
129s - max time network
130s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
20/06/2026, 16:26
Static task
static1
Behavioral task
behavioral1
Sample
CheatEvolution.zip
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral2
Sample
CheatEvolution/CheatEvolution.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral3
Sample
CheatEvolution/DotNetDataCollector32.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral4
Sample
CheatEvolution/DotNetDataCollector64.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral5
Sample
CheatEvolution/Launcher.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral6
Sample
CheatEvolution/data/data.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral7
Sample
CheatEvolution/lua/DotNetInject.lua
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral8
Sample
CheatEvolution/lua/DotNetInterface.js
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral9
Sample
CheatEvolution/lua/additional_settings.lua
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral10
Sample
CheatEvolution/lua/dlls/DotNetInterface.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral11
Sample
CheatEvolution/lua/dlls/MonoDataCollector32.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral12
Sample
CheatEvolution/lua/dlls/MonoDataCollector64.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral13
Sample
CheatEvolution/lua/dotnetinfo.js
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral14
Sample
CheatEvolution/lua/dotnetsearch.bat
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral15
Sample
CheatEvolution/lua/monoscript.bat
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral16
Sample
CheatEvolution/lua53-32.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral17
Sample
CheatEvolution/lua53-64.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral18
Sample
CheatEvolution/settings.lua
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral19
Sample
CheatEvolution/speedhack-i386.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral20
Sample
CheatEvolution/speedhack-x86_64.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral21
Sample
CheatEvolution/vehdebug-i386.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral22
Sample
CheatEvolution/vehdebug-x86_64.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
General
- Target CheatEvolution/CheatEvolution.exe
- Size 11.1MB
- Sample260620-txzy1ahs5t
- SHA256 5d5162db542340f73b7451c2d9138ec714da25483b05344392111c8b0316dbfc
- MD5 e385bf6abe0ddfadfb7e098da559a882
- SHA1 3681f2ec7bbfe2e2d6edab73ea3b108d0d45999d
- SHA512 1f439e28270b49f6c7421bec6dc0f70d14df8d41e43e54a79c037a626df6645b0a6d500c1598c1678cac0e44c0934ab67b02191895f87aed1f8f1cf5c5d0946d
- SSDEEP 196608:6Gn6Hg2U/VbIRN92THpdNV3nTgv9j8p6DQLpx6yfrrUXQLA2iYhPOuw7mV:6WUU/VsRIHQ9j8M6UALA2iwP07m
- TLSH T16EC62229B14C33ACC72A857078E7EC06ED61321E08F4959A7ECB3784779A50389FB756
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Downloads MZ/PE file 2 IoCs
flow pid Process 48 772 CheatEvolution.exe 59 772 CheatEvolution.exe - Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000\Control Panel\International\Geo\Nation CheatEvolution.exe - Drops file in System32 directory 42 IoCs
description ioc Process File opened for modification C:\Windows\System32\KERNEL32.DLL CheatEvolution.exe File opened for modification C:\Windows\SYSTEM32\version.dll CheatEvolution.exe File opened for modification C:\Windows\System32\imm32.dll CheatEvolution.exe File opened for modification C:\Windows\System32\psapi.dll CheatEvolution.exe File opened for modification C:\Windows\SYSTEM32\wsock32.dll CheatEvolution.exe File opened for modification C:\Windows\SYSTEM32\msimg32.dll CheatEvolution.exe File opened for modification C:\Windows\System32\MSCTF.dll CheatEvolution.exe File opened for modification C:\Windows\System32\RPCRT4.dll CheatEvolution.exe File opened for modification C:\Windows\System32\user32.dll CheatEvolution.exe File opened for modification C:\Windows\System32\GDI32.dll CheatEvolution.exe File opened for modification C:\Windows\System32\advapi32.dll CheatEvolution.exe File opened for modification C:\Windows\System32\sechost.dll CheatEvolution.exe File opened for modification C:\Windows\System32\shcore.dll CheatEvolution.exe File opened for modification C:\Windows\System32\KERNELBASE.dll CheatEvolution.exe File opened for modification C:\Windows\System32\msvcp_win.dll CheatEvolution.exe File opened for modification C:\Windows\SYSTEM32\opengl32.dll CheatEvolution.exe File opened for modification C:\Windows\System32\imagehlp.dll CheatEvolution.exe File opened for modification C:\Windows\system32\uxtheme.dll CheatEvolution.exe File opened for modification C:\Windows\system32\explorerframe.dll CheatEvolution.exe File opened for modification C:\Windows\System32\combase.dll CheatEvolution.exe File opened for modification C:\Windows\System32\win32u.dll CheatEvolution.exe File opened for modification C:\Windows\System32\clbcatq.dll CheatEvolution.exe File opened for modification C:\Windows\SYSTEM32\profapi.dll CheatEvolution.exe File opened for modification C:\Windows\SYSTEM32\PROPSYS.dll CheatEvolution.exe File opened for modification C:\Windows\SYSTEM32\ntdll.dll CheatEvolution.exe File opened for modification C:\Windows\System32\shlwapi.dll CheatEvolution.exe File opened for modification C:\Windows\SYSTEM32\winmm.dll CheatEvolution.exe File opened for modification C:\Windows\SYSTEM32\kernel.appcore.dll CheatEvolution.exe File opened for modification C:\Windows\SYSTEM32\windows.storage.dll CheatEvolution.exe File opened for modification C:\Windows\System32\shell32.dll CheatEvolution.exe File opened for modification C:\Windows\SYSTEM32\wininet.dll CheatEvolution.exe File opened for modification C:\Windows\System32\oleaut32.dll CheatEvolution.exe File opened for modification C:\Windows\System32\comdlg32.dll CheatEvolution.exe File opened for modification C:\Windows\System32\bcryptPrimitives.dll CheatEvolution.exe File opened for modification C:\Windows\system32\shfolder.dll CheatEvolution.exe File opened for modification C:\Windows\SYSTEM32\Wldp.dll CheatEvolution.exe File opened for modification C:\Windows\System32\msvcrt.dll CheatEvolution.exe File opened for modification C:\Windows\System32\ucrtbase.dll CheatEvolution.exe File opened for modification C:\Windows\System32\gdi32full.dll CheatEvolution.exe File opened for modification C:\Windows\System32\ole32.dll CheatEvolution.exe File opened for modification C:\Windows\System32\ws2_32.dll CheatEvolution.exe File opened for modification C:\Windows\SYSTEM32\GLU32.dll CheatEvolution.exe - Drops file in Windows directory 1 IoCs
description ioc Process File opened for modification C:\Windows\WinSxS\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.19041.1110_none_60b5254171f9507e\comctl32.dll CheatEvolution.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Launcher.exe - Suspicious behavior: EnumeratesProcesses 8 IoCs
pid Process 4644 CheatEvolution.exe 4644 CheatEvolution.exe 3104 Launcher.exe 3104 Launcher.exe 3104 Launcher.exe 3104 Launcher.exe 772 CheatEvolution.exe 772 CheatEvolution.exe - Suspicious use of AdjustPrivilegeToken 16 IoCs
description pid Process Token: SeDebugPrivilege 772 CheatEvolution.exe Token: SeTcbPrivilege 772 CheatEvolution.exe Token: SeTcbPrivilege 772 CheatEvolution.exe Token: SeLoadDriverPrivilege 772 CheatEvolution.exe Token: SeCreateGlobalPrivilege 772 CheatEvolution.exe Token: SeLockMemoryPrivilege 772 CheatEvolution.exe Token: 33 772 CheatEvolution.exe Token: SeSecurityPrivilege 772 CheatEvolution.exe Token: SeTakeOwnershipPrivilege 772 CheatEvolution.exe Token: SeManageVolumePrivilege 772 CheatEvolution.exe Token: SeBackupPrivilege 772 CheatEvolution.exe Token: SeCreatePagefilePrivilege 772 CheatEvolution.exe Token: SeShutdownPrivilege 772 CheatEvolution.exe Token: SeRestorePrivilege 772 CheatEvolution.exe Token: 33 772 CheatEvolution.exe Token: SeIncBasePriorityPrivilege 772 CheatEvolution.exe - Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 4644 CheatEvolution.exe 772 CheatEvolution.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 772 CheatEvolution.exe 772 CheatEvolution.exe - Suspicious use of WriteProcessMemory 2 IoCs
description pid Process procid_target PID 4644 wrote to memory of 3104 4644 CheatEvolution.exe 89 PID 3104 wrote to memory of 772 3104 Launcher.exe 90
Processes
-
C:\Users\Admin\AppData\Local\Temp\CheatEvolution\CheatEvolution.exe"C:\Users\Admin\AppData\Local\Temp\CheatEvolution\CheatEvolution.exe"1⤵
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:4644 -
C:\Users\Admin\AppData\Local\Temp\CheatEvolution\Launcher.exe"C:\Users\Admin\AppData\Local\Temp\CheatEvolution\Launcher.exe"2⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3104 -
C:\Users\Admin\AppData\Local\Temp\CheatEvolution\CheatEvolution.exe"C:\Users\Admin\AppData\Local\Temp\CheatEvolution\CheatEvolution.exe" -start3⤵
- Downloads MZ/PE file
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:772
-
-