Overview
overview
8Static
static
3CheatEvolution.zip
windows10-2004-x64
7CheatEvolu...on.exe
windows10-2004-x64
8CheatEvolu...32.exe
windows10-2004-x64
3CheatEvolu...64.exe
windows10-2004-x64
1CheatEvolu...er.exe
windows10-2004-x64
8CheatEvolu...ta.dll
windows10-2004-x64
1CheatEvolu...ct.lua
windows10-2004-x64
3CheatEvolu...ace.js
windows10-2004-x64
3CheatEvolu...gs.lua
windows10-2004-x64
3CheatEvolu...ce.dll
windows10-2004-x64
1CheatEvolu...32.dll
windows10-2004-x64
5CheatEvolu...64.dll
windows10-2004-x64
5CheatEvolu...nfo.js
windows10-2004-x64
3CheatEvolu...ch.bat
windows10-2004-x64
1CheatEvolu...pt.bat
windows10-2004-x64
1CheatEvolu...32.dll
windows10-2004-x64
3CheatEvolu...64.dll
windows10-2004-x64
1CheatEvolu...gs.lua
windows10-2004-x64
3CheatEvolu...86.dll
windows10-2004-x64
3CheatEvolu...64.dll
windows10-2004-x64
1CheatEvolu...86.dll
windows10-2004-x64
3CheatEvolu...64.dll
windows10-2004-x64
1Analysis
- user interaction
yes - max time kernel
288s - max time network
233s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
20/06/2026, 16:26
Static task
static1
Behavioral task
behavioral1
Sample
CheatEvolution.zip
Resource
win10v2004-20260513-en
Behavioral task
behavioral2
Sample
CheatEvolution/CheatEvolution.exe
Resource
win10v2004-20260513-en
Behavioral task
behavioral3
Sample
CheatEvolution/DotNetDataCollector32.exe
Resource
win10v2004-20260513-en
Behavioral task
behavioral4
Sample
CheatEvolution/DotNetDataCollector64.exe
Resource
win10v2004-20260513-en
Behavioral task
behavioral5
Sample
CheatEvolution/Launcher.exe
Resource
win10v2004-20260513-en
Behavioral task
behavioral6
Sample
CheatEvolution/data/data.dll
Resource
win10v2004-20260513-en
Behavioral task
behavioral7
Sample
CheatEvolution/lua/DotNetInject.lua
Resource
win10v2004-20260513-en
Behavioral task
behavioral8
Sample
CheatEvolution/lua/DotNetInterface.js
Resource
win10v2004-20260513-en
Behavioral task
behavioral9
Sample
CheatEvolution/lua/additional_settings.lua
Resource
win10v2004-20260513-en
Behavioral task
behavioral10
Sample
CheatEvolution/lua/dlls/DotNetInterface.dll
Resource
win10v2004-20260513-en
Behavioral task
behavioral11
Sample
CheatEvolution/lua/dlls/MonoDataCollector32.dll
Resource
win10v2004-20260513-en
Behavioral task
behavioral12
Sample
CheatEvolution/lua/dlls/MonoDataCollector64.dll
Resource
win10v2004-20260513-en
Behavioral task
behavioral13
Sample
CheatEvolution/lua/dotnetinfo.js
Resource
win10v2004-20260513-en
Behavioral task
behavioral14
Sample
CheatEvolution/lua/dotnetsearch.bat
Resource
win10v2004-20260513-en
Behavioral task
behavioral15
Sample
CheatEvolution/lua/monoscript.bat
Resource
win10v2004-20260513-en
Behavioral task
behavioral16
Sample
CheatEvolution/lua53-32.dll
Resource
win10v2004-20260513-en
Behavioral task
behavioral17
Sample
CheatEvolution/lua53-64.dll
Resource
win10v2004-20260513-en
Behavioral task
behavioral18
Sample
CheatEvolution/settings.lua
Resource
win10v2004-20260513-en
Behavioral task
behavioral19
Sample
CheatEvolution/speedhack-i386.dll
Resource
win10v2004-20260513-en
Behavioral task
behavioral20
Sample
CheatEvolution/speedhack-x86_64.dll
Resource
win10v2004-20260513-en
Behavioral task
behavioral21
Sample
CheatEvolution/vehdebug-i386.dll
Resource
win10v2004-20260513-en
Behavioral task
behavioral22
Sample
CheatEvolution/vehdebug-x86_64.dll
Resource
win10v2004-20260513-en
General
- Target CheatEvolution/lua/DotNetInject.lua
- Size 6KB
- Sample260620-txzy1ahs5t
- SHA256 a3c0a76e8654384dc6896fc73664fdf7f2ed94e95433f34f9668e3e04cb7354e
- MD5 6fecbdcaac54e6f9cf6b5ff07e0d47c5
- SHA1 bb22202c3ecd421ae843822ec4715a72c9891f6c
- SHA512 baea3a88281decad200641df2df5903ee326d59df54349629ac3ed75154322dafe61f8cbebdc21af2f5ac4c639a557ef34cd8a236562779c2b10d3f8b9da96a5
- SSDEEP 192:zuiTTPEYya1gq5jfFEYQt3xB97Yq1fvhEh:ztTzyapAy
- TLSH T11BE1BB023FC3B5DD1E50E3DF4C28E0C6F380E943AE36991475D8877B2AA84695A6D72D
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Modifies registry class 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\Local Settings cmd.exe Key created \REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\Local Settings OpenWith.exe - Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 5940 OpenWith.exe
Processes
-
C:\Windows\system32\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\CheatEvolution\lua\DotNetInject.lua1⤵
- Modifies registry class
PID:4432
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:5940