Overview
overview
5Static
static
3Cheat Engine.zip
windows11-21h2-x64
1Cheat Engi...32.exe
windows11-21h2-x64
3Cheat Engi...64.exe
windows11-21h2-x64
1Cheat Engi...64.exe
windows11-21h2-x64
1Cheat Engi...et.exe
windows11-21h2-x64
3Cheat Engi...86.exe
windows11-21h2-x64
5Cheat Engi...X2.exe
windows11-21h2-x64
5Cheat Engi...64.exe
windows11-21h2-x64
5Cheat Engi...86.exe
windows11-21h2-x64
3Cheat Engi...64.exe
windows11-21h2-x64
1Cheat Engi...00.exe
windows11-21h2-x64
4Cheat Engi...ir.exe
windows11-21h2-x64
3Analysis
- max time kernel
149s - max time network
97s - platform
windows11-21h2_x64 - resource
win11-20260513-uk - resource tags
arch:x64arch:x86image:win11-20260513-uklocale:uk-uaos:windows11-21h2-x64systemwindows - submitted
02/07/2026, 14:35
Static task
static1
Behavioral task
behavioral1
Sample
Cheat Engine.zip
Resource
win11-20260513-uk
Behavioral task
behavioral2
Sample
Cheat Engine/DotNetDataCollector32.exe
Resource
win11-20260513-uk
Behavioral task
behavioral3
Sample
Cheat Engine/DotNetDataCollector64.exe
Resource
win11-20260513-uk
Behavioral task
behavioral4
Sample
Cheat Engine/Tutorial-x86_64.exe
Resource
win11-20260513-uk
Behavioral task
behavioral5
Sample
Cheat Engine/ceregreset.exe
Resource
win11-20260513-uk
Behavioral task
behavioral6
Sample
Cheat Engine/cheatengine-i386.exe
Resource
win11-20260513-uk
Behavioral task
behavioral7
Sample
Cheat Engine/cheatengine-x86_64-SSE4-AVX2.exe
Resource
win11-20260513-uk
Behavioral task
behavioral8
Sample
Cheat Engine/cheatengine-x86_64.exe
Resource
win11-20260513-uk
Behavioral task
behavioral9
Sample
Cheat Engine/gtutorial-i386.exe
Resource
win11-20260513-uk
Behavioral task
behavioral10
Sample
Cheat Engine/gtutorial-x86_64.exe
Resource
win11-20260513-uk
Behavioral task
behavioral11
Sample
Cheat Engine/unins000.exe
Resource
win11-20260513-uk
Behavioral task
behavioral12
Sample
Cheat Engine/windowsrepair.exe
Resource
win11-20260513-uk
General
- Target Cheat Engine/DotNetDataCollector32.exe
- Size 294KB
- Sample260702-rydfaads5m
- SHA256 7267791d712cf60a1d3697401d0ecaf77fb05c15f8da381f9b7d8975618db33b
- MD5 4f8e03ae8048535c9da17bbcc387d1be
- SHA1 296473f675d5b3c329a423a2a7021976c7ca6647
- SHA512 e13183d5200d4f680bc6ea57197f290e77333f49e49fbb0616560bca11fd4844f01dcdd723cdb5ce9b191c73080ac96c8ac96dd91ad707cb5c6cffc026af21ca
- SSDEEP 6144:Y0ca0/GA/8sKN/UtW6qmD+j38ZQKlZfZrAOspnNlnlwekf:Ma0/4sKN/UtW6qmD+rcupNlK
- TLSH T142549D517991C433E6A2043259A8EB7A593DBD310B9489EBD3884A3DDE303C16B35B7B
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DotNetDataCollector32.exe - Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 4960 DotNetDataCollector32.exe