Overview
overview
8Static
static
3CheatEvolution.zip
windows10-2004-x64
7CheatEvolu...on.exe
windows10-2004-x64
8CheatEvolu...32.exe
windows10-2004-x64
3CheatEvolu...64.exe
windows10-2004-x64
1CheatEvolu...er.exe
windows10-2004-x64
8CheatEvolu...ta.dll
windows10-2004-x64
1CheatEvolu...ct.lua
windows10-2004-x64
3CheatEvolu...ace.js
windows10-2004-x64
3CheatEvolu...gs.lua
windows10-2004-x64
3CheatEvolu...ce.dll
windows10-2004-x64
1CheatEvolu...32.dll
windows10-2004-x64
5CheatEvolu...64.dll
windows10-2004-x64
5CheatEvolu...nfo.js
windows10-2004-x64
3CheatEvolu...ch.bat
windows10-2004-x64
1CheatEvolu...pt.bat
windows10-2004-x64
1CheatEvolu...32.dll
windows10-2004-x64
3CheatEvolu...64.dll
windows10-2004-x64
1CheatEvolu...gs.lua
windows10-2004-x64
3CheatEvolu...86.dll
windows10-2004-x64
3CheatEvolu...64.dll
windows10-2004-x64
1CheatEvolu...86.dll
windows10-2004-x64
3CheatEvolu...64.dll
windows10-2004-x64
1Analysis
- max time kernel
286s - max time network
230s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
20/06/2026, 16:26
Static task
static1
Behavioral task
behavioral1
Sample
CheatEvolution.zip
Resource
win10v2004-20260513-en
Behavioral task
behavioral2
Sample
CheatEvolution/CheatEvolution.exe
Resource
win10v2004-20260513-en
Behavioral task
behavioral3
Sample
CheatEvolution/DotNetDataCollector32.exe
Resource
win10v2004-20260513-en
Behavioral task
behavioral4
Sample
CheatEvolution/DotNetDataCollector64.exe
Resource
win10v2004-20260513-en
Behavioral task
behavioral5
Sample
CheatEvolution/Launcher.exe
Resource
win10v2004-20260513-en
Behavioral task
behavioral6
Sample
CheatEvolution/data/data.dll
Resource
win10v2004-20260513-en
Behavioral task
behavioral7
Sample
CheatEvolution/lua/DotNetInject.lua
Resource
win10v2004-20260513-en
Behavioral task
behavioral8
Sample
CheatEvolution/lua/DotNetInterface.js
Resource
win10v2004-20260513-en
Behavioral task
behavioral9
Sample
CheatEvolution/lua/additional_settings.lua
Resource
win10v2004-20260513-en
Behavioral task
behavioral10
Sample
CheatEvolution/lua/dlls/DotNetInterface.dll
Resource
win10v2004-20260513-en
Behavioral task
behavioral11
Sample
CheatEvolution/lua/dlls/MonoDataCollector32.dll
Resource
win10v2004-20260513-en
Behavioral task
behavioral12
Sample
CheatEvolution/lua/dlls/MonoDataCollector64.dll
Resource
win10v2004-20260513-en
Behavioral task
behavioral13
Sample
CheatEvolution/lua/dotnetinfo.js
Resource
win10v2004-20260513-en
Behavioral task
behavioral14
Sample
CheatEvolution/lua/dotnetsearch.bat
Resource
win10v2004-20260513-en
Behavioral task
behavioral15
Sample
CheatEvolution/lua/monoscript.bat
Resource
win10v2004-20260513-en
Behavioral task
behavioral16
Sample
CheatEvolution/lua53-32.dll
Resource
win10v2004-20260513-en
Behavioral task
behavioral17
Sample
CheatEvolution/lua53-64.dll
Resource
win10v2004-20260513-en
Behavioral task
behavioral18
Sample
CheatEvolution/settings.lua
Resource
win10v2004-20260513-en
Behavioral task
behavioral19
Sample
CheatEvolution/speedhack-i386.dll
Resource
win10v2004-20260513-en
Behavioral task
behavioral20
Sample
CheatEvolution/speedhack-x86_64.dll
Resource
win10v2004-20260513-en
Behavioral task
behavioral21
Sample
CheatEvolution/vehdebug-i386.dll
Resource
win10v2004-20260513-en
Behavioral task
behavioral22
Sample
CheatEvolution/vehdebug-x86_64.dll
Resource
win10v2004-20260513-en
General
- Target CheatEvolution/lua/additional_settings.lua
- Size 426B
- Sample260620-txzy1ahs5t
- SHA256 a0343d322f042622040d129c7b5d9f9b4cd10e0ee3b249f280b9da7c1f7c0222
- MD5 1f73e4d6e1a5c6eb97b31813ec21d0db
- SHA1 2b7be02d9a14c3141dcc1a147928cc617e198ebc
- SHA512 570f8228f08cda9514d548ef2b6602be677cf03886c2c33cb46e2bde1c74ead077dd6282742bf8bbfaa2b9ef51dec931270e268b4d2520ba273c1a1778da8871
- TLSH T166E02B90368391A51BF0D379CC8B7403F245A78301AE0028799E06917FB07DCA2F4E51
- MD5 SHA1 SHA512 TLSH
Malware Config
Signatures
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Modifies registry class 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings cmd.exe Key created \REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings OpenWith.exe - Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 552 OpenWith.exe
Processes
-
C:\Windows\system32\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\CheatEvolution\lua\additional_settings.lua1⤵
- Modifies registry class
PID:1056
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:552