Overview

overview

10

Static

static

6

HexCheats Loader.exe

windows10-ltsc_2021-x64

7

$PLUGINSDI...er.dll

windows10-ltsc_2021-x64

3

$PLUGINSDI...ls.dll

windows10-ltsc_2021-x64

3

$PLUGINSDI...em.dll

windows10-ltsc_2021-x64

3

$PLUGINSDI...ll.dll

windows10-ltsc_2021-x64

3

LICENSES.c...m.html

windows10-ltsc_2021-x64

3

Loader.exe

windows10-ltsc_2021-x64

10

d3dcompiler_47.dll

windows10-ltsc_2021-x64

1

ffmpeg.dll

windows10-ltsc_2021-x64

1

libEGL.dll

windows10-ltsc_2021-x64

1

libGLESv2.dll

windows10-ltsc_2021-x64

1

resources/app.js

windows10-ltsc_2021-x64

3

resources/elevate.exe

windows10-ltsc_2021-x64

3

Python313/...256.py

windows10-ltsc_2021-x64

3

Python313/...2b.dll

windows10-ltsc_2021-x64

1

Python313/...D2.dll

windows10-ltsc_2021-x64

1

Python313/...12.dll

windows10-ltsc_2021-x64

1

Python313/...13.pyc

windows10-ltsc_2021-x64

3

Python313/...13.pyc

windows10-ltsc_2021-x64

3

Python313/...13.pyc

windows10-ltsc_2021-x64

3

Python313/...13.pyc

windows10-ltsc_2021-x64

3

Python313/...13.pyc

windows10-ltsc_2021-x64

3

Python313/...13.pyc

windows10-ltsc_2021-x64

3

Python313/...13.pyc

windows10-ltsc_2021-x64

3

Python313/...13.pyc

windows10-ltsc_2021-x64

3

Python313/...13.pyc

windows10-ltsc_2021-x64

3

vk_swiftshader.dll

windows10-ltsc_2021-x64

1

vulkan-1.dll

windows10-ltsc_2021-x64

1

$PLUGINSDI...ec.dll

windows10-ltsc_2021-x64

3

$PLUGINSDI...ss.dll

windows10-ltsc_2021-x64

3

$PLUGINSDI...7z.dll

windows10-ltsc_2021-x64

3

$R0/Uninst...er.exe

windows10-ltsc_2021-x64

7

Sharing

Copy URL Twitter E-mail

General

  • Target
    HexCheats Loader.exe
  • Size 145.0MB
  • Sample260812-lbsc2atcla
  • SHA256 9d8a226dfb023e22ca75053a1930cc2bb1c51ff498d1080fac52d11f61a5114a
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
credential_accessdefense_evasiondiscoveryevasionexecutionpdfpersistencespywarestealertrojan

Malware Config

Targets

    • Target
      HexCheats Loader.exe
    • Size 145.0MB
    • SHA256 9d8a226dfb023e22ca75053a1930cc2bb1c51ff498d1080fac52d11f61a5114a
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    7/10
    discoveryexecution

    • Executes dropped EXE

    • Loads dropped DLL

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery
    behavioral1
    • Target
      $PLUGINSDIR/SpiderBanner.dll
    • Size 9KB
    • SHA256 996a259e53ca18b89ec36d038c40148957c978c0fd600a268497d4c92f882a93
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    3/10
    discovery
    behavioral2
    • Target
      $PLUGINSDIR/StdUtils.dll
    • Size 100KB
    • SHA256 b72e9013a6204e9f01076dc38dabbf30870d44dfc66962adbf73619d4331601e
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    3/10
    discovery
    behavioral3
    • Target
      $PLUGINSDIR/System.dll
    • Size 12KB
    • SHA256 3eb38ae99653a7dbc724132ee240f6e5c4af4bfe7c01d31d23faf373f9f2eaca
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    3/10
    discovery
    behavioral4
    • Target
      $PLUGINSDIR/WinShell.dll
    • Size 3KB
    • SHA256 9be85b986ea66a6997dde658abe82b3147ed2a1a3dcb784bb5176f41d22815a6
    • MD5 SHA1 SHA512 TLSH
    Score
    3/10
    discovery
    behavioral5
    • Target
      LICENSES.chromium.html
    • Size 6.5MB
    • SHA256 9f3f2b4d9bbd3113486839eca85de119fab766450cdca08a4574b80748885708
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    3/10
    discovery
    behavioral6
    • Target
      Loader.exe
    • Size 150.3MB
    • SHA256 fd19eff82da74b06ea4f25e76e5ab527480cf0e80881c22af3745543589b0fd8
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    10/10
    credential_accessdefense_evasiondiscoveryexecutionpersistencespywarestealertrojan

    • UAC bypass

      defense_evasiontrojan

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Unsecured Credentials: Credentials In Files

      Steal credentials from unsecured files.

      credential_accessstealer

    • Accesses cryptocurrency files/wallets, possible credential harvesting

      spyware

    • Checks whether UAC is enabled

      defense_evasiontrojan

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

      discovery
    behavioral7
    • Target
      d3dcompiler_47.dll
    • Size 4.7MB
    • SHA256 5653bc7b0e2701561464ef36602ff6171c96bffe96e4c3597359cd7addcba88a
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    1/10
    behavioral8
    • Target
      ffmpeg.dll
    • Size 2.6MB
    • SHA256 aad7e7ac9d74ac18892801950c9728e9c4eacd3b676cbb5d6f63382da2ce0559
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    1/10
    behavioral9
    • Target
      libEGL.dll
    • Size 473KB
    • SHA256 85f238fb7ace3cbdf7c29c72b01307c440f13491b07a509cbc5b9f257a637164
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    1/10
    behavioral10
    • Target
      libGLESv2.dll
    • Size 7.2MB
    • SHA256 25d49934fc220b169cadeb21fc99dc2a8fb1dd5a4f244265799392f0f5f2f8f8
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    1/10
    behavioral11
    • Target
      resources/app.asar
    • Size 120KB
    • SHA256 560d51b6997ab2e02d84acdd914142b72406e78ee530a7a964d6d1a96b6205db
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    3/10
    execution
    behavioral12
    • Target
      resources/elevate.exe
    • Size 105KB
    • SHA256 9b1fbf0c11c520ae714af8aa9af12cfd48503eedecd7398d8992ee94d1b4dc37
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    3/10
    discovery
    behavioral13
    • Target
      Python313/Lib/site-packages/Crypto/Hash/TurboSHAKE256.py
    • Size 779B
    • SHA256 ad79e152a2c83ee90ac61ff7245df570673fbe28720d9de8e07e2fddbf0e51db
    • MD5 SHA1 SHA512 TLSH
    Score
    3/10
    execution
    behavioral14
    • Target
      Python313/Lib/site-packages/Crypto/Hash/_BLAKE2b.pyd
    • Size 14KB
    • SHA256 4fbe188c20fb578d4b66349d50aa6ffe4ab86844fb6427c57738f36780d1e2e2
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    1/10
    behavioral15
    • Target
      Python313/Lib/site-packages/Crypto/Hash/_MD2.pyd
    • Size 14KB
    • SHA256 d54375dc0652358a6e4e744f1a0eaeead87accd391a20d6ff324fe14e988a122
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    1/10
    behavioral16
    • Target
      Python313/Lib/site-packages/Crypto/Hash/_SHA512.pyd
    • Size 26KB
    • SHA256 1729a0dc6b80cb7a3c07372b98b10d3c6c613ea645240878e1fde6a992fa06f1
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    1/10
    behavioral17
    • Target
      Python313/Lib/site-packages/Crypto/Hash/__pycache__/KMAC256.cpython-313.pyc
    • Size 1KB
    • SHA256 8092f43133271ab021166f63a2c8526e1c734ebe32b5258d584b9fa629597d08
    • MD5 SHA1 SHA512 TLSH
    Score
    3/10
    execution
    behavioral18
    • Target
      Python313/Lib/site-packages/Crypto/Hash/__pycache__/SHA.cpython-313.pyc
    • Size 260B
    • SHA256 5306d0c91c229d4be5d0d428e3dcd0a6a6d6ec2357b6d5df0cade1809e63b929
    • MD5 SHA1 SHA512 TLSH
    Score
    3/10
    execution
    behavioral19
    • Target
      Python313/Lib/site-packages/Crypto/Random/__pycache__/__init__.cpython-313.pyc
    • Size 1KB
    • SHA256 c4287e47cf993e595145b601b4d0242c96a8f1b2032c86610a0c089ffd4bc7ac
    • MD5 SHA1 SHA512 TLSH
    Score
    3/10
    execution
    behavioral20
    • Target
      Python313/Lib/site-packages/future/moves/__pycache__/copyreg.cpython-313.pyc
    • Size 433B
    • SHA256 7cb97d5082920f49a16bc9a677ea3a9a380306387c81fb07d3059e713f5f635d
    • MD5 SHA1 SHA512 TLSH
    Score
    3/10
    execution
    behavioral21
    • Target
      Python313/Lib/site-packages/future/moves/__pycache__/itertools.cpython-313.pyc
    • Size 379B
    • SHA256 4757dc274ffc5cd3d2d0bbed544f342c4e979f2fbc2c31f3a87ca7533fc17518
    • MD5 SHA1 SHA512 TLSH
    Score
    3/10
    execution
    behavioral22
    • Target
      Python313/Lib/site-packages/future/moves/__pycache__/multiprocessing.cpython-313.pyc
    • Size 401B
    • SHA256 8a9c1e4d307c34855bcbbb480debf575530a34008377c46c9e9b4a10616074c3
    • MD5 SHA1 SHA512 TLSH
    Score
    3/10
    execution
    behavioral23
    • Target
      Python313/Lib/site-packages/future/moves/__pycache__/pickle.cpython-313.pyc
    • Size 425B
    • SHA256 adda8a248a9ca954dddadb0a50b32dc2cc06cfe33baf4e084fe17b188dd70818
    • MD5 SHA1 SHA512 TLSH
    Score
    3/10
    execution
    behavioral24
    • Target
      Python313/Lib/site-packages/future/moves/__pycache__/queue.cpython-313.pyc
    • Size 337B
    • SHA256 ecce920080538ec1fa6df9989992d3d8a8d947524540f07f373f8d00ace35b03
    • MD5 SHA1 SHA512 TLSH
    Score
    3/10
    execution
    behavioral25
    • Target
      Python313/Lib/site-packages/future/moves/__pycache__/reprlib.cpython-313.pyc
    • Size 340B
    • SHA256 2dcd96f1408db42dad8e520036095ee3aec4cd2fa4fe4cfaeb7b7edfb8fb8807
    • MD5 SHA1 SHA512 TLSH
    Score
    3/10
    execution
    behavioral26
    • Target
      vk_swiftshader.dll
    • Size 4.9MB
    • SHA256 a32c3fbbf74699a10e7642bf4901191f29c88c5aec93ae7ba28c79ab28462a69
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    1/10
    behavioral27
    • Target
      vulkan-1.dll
    • Size 894KB
    • SHA256 1f8b647f161f20d45d554e349b3e5ef0b7b5da8c7bdbc1ff631d37dc9c819503
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    1/10
    behavioral28
    • Target
      $PLUGINSDIR/nsExec.dll
    • Size 6KB
    • SHA256 5d9ceb1ce5f35aea5f9e5a0c0edeeec04dfefe0c77890c80c70e98209b58b962
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    3/10
    discovery
    behavioral29
    • Target
      $PLUGINSDIR/nsProcess.dll
    • Size 4KB
    • SHA256 30c6c3dd3cc7fcea6e6081ce821adc7b2888542dae30bf00e881c0a105eb4d11
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    3/10
    discovery
    behavioral30
    • Target
      $PLUGINSDIR/nsis7z.dll
    • Size 424KB
    • SHA256 b393f05e8ff919ef071181050e1873c9a776e1a0ae8329aefff7007d0cadf592
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    3/10
    discovery
    behavioral31
    • Target
      $R0/Uninstall Loader.exe
    • Size 175KB
    • SHA256 032039ed8688b73fda5c87e73bff9e12820b506a246e1ca143a5c35c2b5918ba
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    7/10
    discovery

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

2
T1059

JavaScript

1
T1059.007

Windows Command Shell

1
T1059.003

Scheduled Task/Job

1
T1053

Scheduled Task

1
T1053.005

Persistence

Scheduled Task/Job

1
T1053

Scheduled Task

1
T1053.005

Privilege Escalation

Abuse Elevation Control Mechanism

1
T1548

Bypass User Account Control

1
T1548.002

Scheduled Task/Job

1
T1053

Scheduled Task

1
T1053.005

Defense Evasion

Abuse Elevation Control Mechanism

1
T1548

Bypass User Account Control

1
T1548.002

Impair Defenses

1
T1562

Disable or Modify Tools

1
T1562.001

Modify Registry

2
T1112

Credential Access

Credentials from Password Stores

1
T1555

Credentials from Web Browsers

1
T1555.003

Unsecured Credentials

3
T1552

Credentials In Files

3
T1552.001

Discovery

Browser Information Discovery

1
T1217

Query Registry

5
T1012

System Information Discovery

5
T1082

System Location Discovery

1
T1614

System Language Discovery

1
T1614.001

System Network Configuration Discovery

1
T1016

Internet Connection Discovery

1
T1016.001

System Time Discovery

1
T1124

Lateral Movement

Collection

Data from Local System

2
T1005

Command and Control

Exfiltration

Impact

Tasks

static1

pdfevasion
Score
6/10

behavioral1

discoveryexecution
Score
7/10

behavioral2

discovery
Score
3/10

behavioral3

discovery
Score
3/10

behavioral4

discovery
Score
3/10

behavioral5

discovery
Score
3/10

behavioral6

discovery
Score
3/10

behavioral7

credential_accessdefense_evasiondiscoveryexecutionpersistencespywarestealertrojan
Score
10/10

behavioral8

Score
1/10

behavioral9

Score
1/10

behavioral10

Score
1/10

behavioral11

Score
1/10

behavioral12

execution
Score
3/10

behavioral13

discovery
Score
3/10

behavioral14

execution
Score
3/10

behavioral15

Score
1/10

behavioral16

Score
1/10

behavioral17

Score
1/10

behavioral18

execution
Score
3/10

behavioral19

execution
Score
3/10

behavioral20

execution
Score
3/10

behavioral21

execution
Score
3/10

behavioral22

execution
Score
3/10

behavioral23

execution
Score
3/10

behavioral24

execution
Score
3/10

behavioral25

execution
Score
3/10

behavioral26

execution
Score
3/10

behavioral27

Score
1/10

behavioral28

Score
1/10

behavioral29

discovery
Score
3/10

behavioral30

discovery
Score
3/10

behavioral31

discovery
Score
3/10

behavioral32

discovery
Score
7/10