General
- Target DBDCheat_.7z
- Size 8.3MB
- Sample260622-kw4fcsa19t
- SHA256 569a2f4726c60a7d2a857b5ed2de9f743c11aa4d765c4ae56b7eb193c1c177da
Malware Config
Targets
-
- Target DBDCheat_.7z
- Size 8.3MB
- SHA256 569a2f4726c60a7d2a857b5ed2de9f743c11aa4d765c4ae56b7eb193c1c177da
Score1/10 -
- Target DBDCheat.zip
- Size 8.3MB
- SHA256 aa9df6a4f51e8fdf85cb4ff76016f5689d5929c9ef6dd6f7a5162119afacb8d8
Score1/10 -
- Target DBDCheat/Launcher.exe
- Size 171KB
- SHA256 623c3cf78cc838f742863f0b644b2fbe81c07e11e4f0a20228a8d2936c830538
Score10/10-
UAC bypass
-
Badlisted process makes network request
Network request originating from process or tool commonly abused by malware.
-
Command and Scripting Interpreter: PowerShell
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
-
Command and Scripting Interpreter: PowerShell
Run Powershell and hide display window.
-
Adds Run key to start application
-
UPX packed file
Detects executables packed with UPX/modified UPX open source packer.
-
- Target DBDCheat/StoreAppHelper.deps.json
- Size 33KB
- SHA256 e43724bc47f1833ee708fd0698e4c7ff260ef10895120482025557143b168e76
Score3/10 -
- Target DBDCheat/StoreAppHelper.dll
- Size 33KB
- SHA256 8478a6638377e9f05ce39295b03cbc6767cbe222e83f9dc5dbf65c39cca09860
Score1/10 -
- Target DBDCheat/StoreAppHelper.runtimeconfig.json
- Size 285B
- SHA256 044c5caff98a01411aa8f0d8d61322710925f8e24516b207ae71f8b6b569eb2e
Score8/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target DBDCheat/System.ComponentModel.Primitives.dll
- Size 73KB
- SHA256 96789fbde342be57152e83b20e833bcc33f12cf30a7b5c9c0790990cf5886d48
Score1/10 -
- Target DBDCheat/System.Console.dll
- Size 153KB
- SHA256 ff3e09ec8ef8dc096bad8e1e9dcdcaf2367f63509179dcb3e5bc4c6de102b59b
Score1/10 -
- Target DBDCheat/System.Diagnostics.Process.dll
- Size 283KB
- SHA256 8ab493c640c85b298553d27db03244c4e76044c2a724fc896bd5085ce4046563
Score1/10 -
- Target DBDCheat/System.Memory.dll
- Size 169KB
- SHA256 71590855c91416c5c0eb0b3eae631ac0869de17242435ca82e0b4e85ec5d0200
Score1/10 -
- Target DBDCheat/System.Private.CoreLib.dll
- Size 10.1MB
- SHA256 c173a4a6030b6f0b32416623cf798eab45abf2d7dd38565aefa2fe78965452ca
Score1/10 -
- Target DBDCheat/System.Runtime.InteropServices.dll
- Size 50KB
- SHA256 cab4e96d3ddf225acfb610a53ef299fb9e7deb74ab374e3976d799c77dfa8770
Score1/10 -
- Target DBDCheat/System.Runtime.dll
- Size 41KB
- SHA256 82fa676a897296ac6265e63bb582d03bf7df54e59c83e6bcd08f6f99a3249ba9
Score1/10 -
- Target DBDCheat/System.Text.Encoding.Extensions.dll
- Size 15KB
- SHA256 30ac13bd317d364b3fe4ad42bc45ed418fbe4acac9aa8f376a8a5fcea964bd54
Score6/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target DBDCheat/System.Threading.Thread.dll
- Size 15KB
- SHA256 047dbd73dc9a8e7a4d7e516b323877d2a538fd525cab04d1d42fb5b2a7f474b3
Score1/10 -
- Target DBDCheat/System.Threading.dll
- Size 78KB
- SHA256 6e646460ac549ca63883e78e739590f4a400f8d2e00bd9e99b0f02102dbb812e
Score1/10
MITRE ATT&CK Enterprise v16
Persistence
Boot or Logon Autostart Execution
2Active Setup
1Registry Run Keys / Startup Folder
1Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Boot or Logon Autostart Execution
2Active Setup
1Registry Run Keys / Startup Folder
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
1Disable or Modify Tools
1Modify Registry
6Subvert Trust Controls
1Install Root Certificate
1