Hostile ^100% Download

a.exe

Game cheat with anti-analysis

Enumerates a game process and writes its remote memoryUnsigned WinExec payload talks over Winsock

SHA-25632ff2c8340d377c28f31f817f890ef0a462539df3fed62591e369d53968def08

URLhttps://tria.ge/api/v0/samples/260928-ats7hazz4n/sample

MaleculeK₅(GaAmLiLuTe)O₈(C₉Er₈Al₆As₅CaCo₂Dy₂S)H₁₀(Hf₆Os₂₁Cm₂₈Cr₆Db₈F₁₄Mg₄Po₂₁TiU₂)Md₆(Bi₁₀PaPtSi)

Evidence

References the Windows COM runtime DLL 0x3a0bc8–0x3a0db8

⋯7 more rows
0x3a0c386e20657863657074696f6e0000000000n exception.....
0x3a0c4852006f0062006c006f00780050006c00R.o.b.l.o.x.P.l.
0x3a0c5861007900650072004200650074006100a.y.e.r.B.e.t.a.
0x3a0c682e006500780065000000000000000000..e.x.e.........
⋯10 more rows
0x3a0d1864007800670069002e0064006c006c00d.x.g.i...d.l.l.
0x3a0d28000000000000000063006f006d006200........c.o.m.b.
0x3a0d386100730065002e0064006c006c000000a.s.e...d.l.l...
0x3a0d486e6f2073747562206361766500000000no stub cave....
⋯7 more rows

WinHTTP add-headers API string 0x76541e–0x76564e

⋯5 more rows
0x76546e6c703332536e617073686f7400000700lp32Snapshot....
0x76547e50726f63657373333246697273745700Process32FirstW.
0x76548e080050726f6365737333324e65787457..Process32NextW
0x76549e00000c0047657453746448616e646c65....GetStdHandle
⋯7 more rows
0x76551e4765745469636b436f756e7400003f00GetTickCount..?.
0x76552e577269746550726f636573734d656d6fWriteProcessMemo
0x76553e727900003d005365745072696f726974ry..=.SetPriorit
0x76554e79436c61737300000d00476574437572yClass....GetCur
⋯4 more rows
0x76559e54687265616400004d00536574546872Thread..M.SetThr
0x7655ae6561645072696f726974790004005769eadPriority...Wi
0x7655be6e487474704164645265717565737448nHttpAddRequestH
0x7655ce65616465727300001300476574537973eaders....GetSys
0x7655de74656d496e666f003c00566972747561temInfo.<.Virtua
⋯7 more rows

Paired debugger-check API strings 0x7656dc–0x76585c

⋯5 more rows
0x76572c33004f70656e50726f63657373004e003.OpenProcess.N.
0x76573c50726f63657373333246697273740000Process32First..
0x76574c4f0050726f6365737333324e65787400O.Process32Next.
0x76575c39005669727475616c50726f746563749.VirtualProtect
0x76576c45780000050049734465627567676572Ex....IsDebugger
0x76577c50726573656e74000000436865636b52Present...CheckR
0x76578c656d6f74654465627567676572507265emoteDebuggerPre
0x76579c73656e74000038005669727475616c50sent..8.VirtualP
0x7657ac726f7465637400000000526567436c6frotect....RegClo
⋯11 more rows

FlushInstructionCache code synchronization 0x7658a4–0x765994

⋯3 more rows
0x7658d4436f5461736b4d656d46726565003200CoTaskMemFree.2.
0x7658e45669727475616c416c6c6f6345780000VirtualAllocEx..
0x7658f40d005365744c6173744572726f720000..SetLastError..
0x7659040a00466c757368496e73747275637469..FlushInstructi
0x7659146f6e4361636865003600566972747561onCache.6.Virtua
0x7659246c4672656545780009004b3332476574lFreeEx...K32Get
⋯7 more rows

WinHTTP DLL name string reference 0x76606e–0x7662ae

⋯3 more rows
0x76609e6e666f2d6c312d312d302e646c6c0000nfo-l1-1-0.dll..
0x7660ae57494e485454502e646c6c006170692dWINHTTP.dll.api-
0x7660be6d732d77696e2d636f72652d70726f63ms-win-core-proc
⋯12 more rows
0x76618e2d636f72652d636f6e736f6c652d6c32-core-console-l2
0x76619e2d312d302e646c6c00005753325f3332-1-0.dll..WS2_32
0x7661ae2e646c6c00006170692d6d732d77696e.dll..api-ms-win
0x7661be2d6e74757365722d737973706172616d-ntuser-sysparam
⋯15 more rows