Overview
overview
5Static
static
3Cheat Engine.zip
windows11-21h2-x64
1Cheat Engi...32.exe
windows11-21h2-x64
3Cheat Engi...64.exe
windows11-21h2-x64
1Cheat Engi...64.exe
windows11-21h2-x64
1Cheat Engi...et.exe
windows11-21h2-x64
3Cheat Engi...86.exe
windows11-21h2-x64
5Cheat Engi...X2.exe
windows11-21h2-x64
5Cheat Engi...64.exe
windows11-21h2-x64
5Cheat Engi...86.exe
windows11-21h2-x64
3Cheat Engi...64.exe
windows11-21h2-x64
1Cheat Engi...00.exe
windows11-21h2-x64
4Cheat Engi...ir.exe
windows11-21h2-x64
3Analysis
- max time kernel
149s - max time network
138s - platform
windows11-21h2_x64 - resource
win11-20260513-uk - resource tags
arch:x64arch:x86image:win11-20260513-uklocale:uk-uaos:windows11-21h2-x64systemwindows - submitted
02/07/2026, 14:35
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
Cheat Engine.zip
Resource
win11-20260513-uk
windows11-21h2-x64
0 signatures
150 seconds
Behavioral task
behavioral2
Sample
Cheat Engine/DotNetDataCollector32.exe
Resource
win11-20260513-uk
windows11-21h2-x64
2 signatures
150 seconds
Behavioral task
behavioral3
Sample
Cheat Engine/DotNetDataCollector64.exe
Resource
win11-20260513-uk
windows11-21h2-x64
1 signatures
150 seconds
Behavioral task
behavioral4
Sample
Cheat Engine/Tutorial-x86_64.exe
Resource
win11-20260513-uk
windows11-21h2-x64
0 signatures
150 seconds
Behavioral task
behavioral5
Sample
Cheat Engine/ceregreset.exe
Resource
win11-20260513-uk
windows11-21h2-x64
1 signatures
150 seconds
Behavioral task
behavioral6
Sample
Cheat Engine/cheatengine-i386.exe
Resource
win11-20260513-uk
windows11-21h2-x64
8 signatures
150 seconds
Behavioral task
behavioral7
Sample
Cheat Engine/cheatengine-x86_64-SSE4-AVX2.exe
Resource
win11-20260513-uk
windows11-21h2-x64
6 signatures
150 seconds
Behavioral task
behavioral8
Sample
Cheat Engine/cheatengine-x86_64.exe
Resource
win11-20260513-uk
windows11-21h2-x64
6 signatures
150 seconds
Behavioral task
behavioral9
Sample
Cheat Engine/gtutorial-i386.exe
Resource
win11-20260513-uk
windows11-21h2-x64
1 signatures
150 seconds
Behavioral task
behavioral10
Sample
Cheat Engine/gtutorial-x86_64.exe
Resource
win11-20260513-uk
windows11-21h2-x64
0 signatures
150 seconds
Behavioral task
behavioral11
Sample
Cheat Engine/unins000.exe
Resource
win11-20260513-uk
windows11-21h2-x64
3 signatures
150 seconds
Behavioral task
behavioral12
Sample
Cheat Engine/windowsrepair.exe
Resource
win11-20260513-uk
windows11-21h2-x64
1 signatures
150 seconds
General
- Target Cheat Engine/cheatengine-i386.exe
- Size 14.2MB
- Sample260702-rydfaads5m
- SHA256 0a4b63eadbe824bcc5095a97ccdd8c580573ed72361514025abe1bf25f1387c9
- MD5 b103a0aae86e298b7823908a3b94a974
- SHA1 336a16af1813c656d0cfee7fed94f39db38e873e
- SHA512 4a36060dca7a630e300edd4a9e0664578d8af3c4c27d8164ccadd0b5db67c0ef3fe5b89dec927021f92cf5fa5f6e6fd1912dda8513ea4cf4ace5dabbfd3ffcdd
- SSDEEP 393216:tEZ6q4M2ntZhx32Fa1Ltdfan70OJr3/2qOUFPhEe8Z:tNZhEFR2sF5Eew
- TLSH T145E66D16B723C22BD4737BB44D9B4AD81E61B7142932549733EB2F8D6B75A813E26303
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
5/10
Malware Config
Signatures
- Drops file in System32 directory 64 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\DPAPI.DLL cheatengine-i386.exe File opened for modification C:\Windows\SysWOW64\advapi32.dll cheatengine-i386.exe File opened for modification C:\Windows\SysWOW64\comdlg32.dll cheatengine-i386.exe File opened for modification C:\Windows\SysWOW64\shcore.dll cheatengine-i386.exe File opened for modification C:\Windows\SysWOW64\explorerframe.dll cheatengine-i386.exe File opened for modification C:\Windows\SysWOW64\DEVOBJ.dll cheatengine-i386.exe File opened for modification C:\Windows\SysWOW64\oleaut32.dll cheatengine-i386.exe File opened for modification C:\Windows\SysWOW64\combase.dll cheatengine-i386.exe File opened for modification C:\Windows\SysWOW64\hhctrl.ocx cheatengine-i386.exe File opened for modification C:\Windows\SysWOW64\windows.storage.dll cheatengine-i386.exe File opened for modification C:\Windows\SysWOW64\mswsock.dll cheatengine-i386.exe File opened for modification C:\Windows\SysWOW64\imagehlp.dll cheatengine-i386.exe File opened for modification C:\Windows\SysWOW64\wsock32.dll cheatengine-i386.exe File opened for modification C:\Windows\SysWOW64\winmm.dll cheatengine-i386.exe File opened for modification C:\Windows\SysWOW64\DUser.dll cheatengine-i386.exe File opened for modification C:\Windows\SysWOW64\WINNSI.DLL cheatengine-i386.exe File opened for modification C:\Windows\SysWOW64\rasadhlp.dll cheatengine-i386.exe File opened for modification C:\Windows\SysWOW64\MSASN1.dll cheatengine-i386.exe File opened for modification C:\Windows\SysWOW64\KERNEL32.DLL cheatengine-i386.exe File opened for modification C:\Windows\SysWOW64\msimg32.dll cheatengine-i386.exe File opened for modification C:\Windows\SysWOW64\clbcatq.dll cheatengine-i386.exe File opened for modification C:\Windows\SysWOW64\atlthunk.dll cheatengine-i386.exe File opened for modification C:\Windows\SysWOW64\webio.dll cheatengine-i386.exe File opened for modification C:\Windows\SysWOW64\ncrypt.dll cheatengine-i386.exe File opened for modification C:\Windows\SysWOW64\ucrtbase.dll cheatengine-i386.exe File opened for modification C:\Windows\SysWOW64\win32u.dll cheatengine-i386.exe File opened for modification C:\Windows\SysWOW64\sechost.dll cheatengine-i386.exe File opened for modification C:\Windows\SysWOW64\shell32.dll cheatengine-i386.exe File opened for modification C:\Windows\SysWOW64\wintypes.dll cheatengine-i386.exe File opened for modification C:\Windows\SysWOW64\IPHLPAPI.DLL cheatengine-i386.exe File opened for modification C:\Windows\SysWOW64\bcrypt.dll cheatengine-i386.exe File opened for modification C:\Windows\SysWOW64\winhttp.dll cheatengine-i386.exe File opened for modification C:\Windows\SysWOW64\dwmapi.dll cheatengine-i386.exe File opened for modification C:\Windows\SysWOW64\MSCTF.dll cheatengine-i386.exe File opened for modification C:\Windows\SysWOW64\cfgmgr32.dll cheatengine-i386.exe File opened for modification C:\Windows\SysWOW64\CRYPT32.dll cheatengine-i386.exe File opened for modification C:\Windows\SysWOW64\ole32.dll cheatengine-i386.exe File opened for modification C:\Windows\SysWOW64\psapi.dll cheatengine-i386.exe File opened for modification C:\Windows\SysWOW64\ntdll.dll cheatengine-i386.exe File opened for modification C:\Windows\SysWOW64\imm32.dll cheatengine-i386.exe File opened for modification C:\Windows\SysWOW64\bcryptPrimitives.dll cheatengine-i386.exe File opened for modification C:\Windows\SysWOW64\Xinput1_4.dll cheatengine-i386.exe File opened for modification C:\Windows\SysWOW64\inputhost.dll cheatengine-i386.exe File opened for modification C:\Windows\SysWOW64\mskeyprotect.dll cheatengine-i386.exe File opened for modification C:\Windows\SysWOW64\RPCRT4.dll cheatengine-i386.exe File opened for modification C:\Windows\SysWOW64\msvcrt.dll cheatengine-i386.exe File opened for modification C:\Windows\SysWOW64\version.dll cheatengine-i386.exe File opened for modification C:\Windows\SysWOW64\opengl32.dll cheatengine-i386.exe File opened for modification C:\Windows\SysWOW64\TextShaping.dll cheatengine-i386.exe File opened for modification C:\Windows\SysWOW64\user32.dll cheatengine-i386.exe File opened for modification C:\Windows\SysWOW64\uxtheme.dll cheatengine-i386.exe File opened for modification C:\Windows\SysWOW64\kernel.appcore.dll cheatengine-i386.exe File opened for modification C:\Windows\SysWOW64\NTASN1.dll cheatengine-i386.exe File opened for modification C:\Windows\SysWOW64\gdi32full.dll cheatengine-i386.exe File opened for modification C:\Windows\SysWOW64\GLU32.dll cheatengine-i386.exe File opened for modification C:\Windows\SysWOW64\textinputframework.dll cheatengine-i386.exe File opened for modification C:\Windows\SysWOW64\CoreMessaging.dll cheatengine-i386.exe File opened for modification C:\Windows\SysWOW64\CRYPTBASE.DLL cheatengine-i386.exe File opened for modification C:\Windows\SysWOW64\NSI.dll cheatengine-i386.exe File opened for modification C:\Windows\SysWOW64\dxcore.dll cheatengine-i386.exe File opened for modification C:\Windows\SysWOW64\CoreUIComponents.dll cheatengine-i386.exe File opened for modification C:\Windows\SysWOW64\SHLWAPI.dll cheatengine-i386.exe File opened for modification C:\Windows\SysWOW64\ws2_32.dll cheatengine-i386.exe File opened for modification C:\Windows\SysWOW64\PROPSYS.dll cheatengine-i386.exe - Drops file in Windows directory 1 IoCs
description ioc Process File opened for modification C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.22000.120_none_e541a94fcce8ed6d\COMCTL32.dll cheatengine-i386.exe - Executes dropped EXE 1 IoCs
pid Process 3132 Tutorial-i386.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cheatengine-i386.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Tutorial-i386.exe - Suspicious use of AdjustPrivilegeToken 15 IoCs
description pid Process Token: SeDebugPrivilege 2924 cheatengine-i386.exe Token: SeTcbPrivilege 2924 cheatengine-i386.exe Token: SeTcbPrivilege 2924 cheatengine-i386.exe Token: SeLoadDriverPrivilege 2924 cheatengine-i386.exe Token: SeCreateGlobalPrivilege 2924 cheatengine-i386.exe Token: 33 2924 cheatengine-i386.exe Token: SeSecurityPrivilege 2924 cheatengine-i386.exe Token: SeTakeOwnershipPrivilege 2924 cheatengine-i386.exe Token: SeManageVolumePrivilege 2924 cheatengine-i386.exe Token: SeBackupPrivilege 2924 cheatengine-i386.exe Token: SeCreatePagefilePrivilege 2924 cheatengine-i386.exe Token: SeShutdownPrivilege 2924 cheatengine-i386.exe Token: SeRestorePrivilege 2924 cheatengine-i386.exe Token: 33 2924 cheatengine-i386.exe Token: SeIncBasePriorityPrivilege 2924 cheatengine-i386.exe - Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2924 cheatengine-i386.exe - Suspicious use of WriteProcessMemory 1 IoCs
description pid Process procid_target PID 2924 wrote to memory of 3132 2924 cheatengine-i386.exe 80
Processes
-
C:\Users\Admin\AppData\Local\Temp\Cheat Engine\cheatengine-i386.exe"C:\Users\Admin\AppData\Local\Temp\Cheat Engine\cheatengine-i386.exe"1⤵
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:2924 -
C:\Users\Admin\AppData\Local\Temp\Cheat Engine\Tutorial-i386.exe"C:\Users\Admin\AppData\Local\Temp\Cheat Engine\Tutorial-i386.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3132
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\Cheat Engine\ExceptionAutoSave_No Process Selected.ct
- Size 142B
- SHA256 df3daba3a699b6d7ab4475e170a0a9c4f8c519b298527ef3c9d9cb9ed5059873
- MD5 3bf254bcf45367ac0e271002f7fbf4f9
- SHA1 0a9450a92e6440297afb2974f80661ac116bf2df
- SHA512 adec0b2180e738ccfa9d2911186bd4172a023bcdea23c4b5255bd1d14612086581b0806fd2cbdd0088daa1679df21d4ccdb94c812aff4683ab8d1e8a9222bd72
- TLSH T163C08C24938078394A7089E0121E481812A0B69329501C7C6C464A3B8B0B4240082E30
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\Cheat Engine\Tutorial-i386.exe
- Size 2.5MB
- SHA256 31b56a68b8d5c2a1c7921a1bb8ce8c356e92213758b493ae67b625f4a99b56bf
- MD5 b57d03bcdf1ebe9076333bcb7323542c
- SHA1 326e44dbb2c37ffc1febe771bf56dd1d5acd5d92
- SHA512 77b3f5dd0cfa3ed5ff7abe9431ce73df67b5bcd326a0f0a2d02da8830fab5ff0947fafa6542ac73931cdba4a924571889f28b74fd814f47d17a26d15154d4b9a
- SSDEEP 49152:lFCaInGo876A/iB8JN+uwLmiS6WuDgRPwtBhUF/n8:lFCrGO5B8vwLwR8
- TLSH T1B9C53A62F203C22BD47377B4856785C85F61B6282527989B33DF2F8E6B71A817D25B03
- MD5 SHA1 SHA512 SSDEEP TLSH