Overview
overview
5Static
static
3Cheat Engine.zip
windows11-21h2-x64
1Cheat Engi...32.exe
windows11-21h2-x64
3Cheat Engi...64.exe
windows11-21h2-x64
1Cheat Engi...64.exe
windows11-21h2-x64
1Cheat Engi...et.exe
windows11-21h2-x64
3Cheat Engi...86.exe
windows11-21h2-x64
5Cheat Engi...X2.exe
windows11-21h2-x64
5Cheat Engi...64.exe
windows11-21h2-x64
5Cheat Engi...86.exe
windows11-21h2-x64
3Cheat Engi...64.exe
windows11-21h2-x64
1Cheat Engi...00.exe
windows11-21h2-x64
4Cheat Engi...ir.exe
windows11-21h2-x64
3Analysis
- max time kernel
149s - max time network
98s - platform
windows11-21h2_x64 - resource
win11-20260513-uk - resource tags
arch:x64arch:x86image:win11-20260513-uklocale:uk-uaos:windows11-21h2-x64systemwindows - submitted
02/07/2026, 14:35
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
Cheat Engine.zip
Resource
win11-20260513-uk
windows11-21h2-x64
0 signatures
150 seconds
Behavioral task
behavioral2
Sample
Cheat Engine/DotNetDataCollector32.exe
Resource
win11-20260513-uk
windows11-21h2-x64
2 signatures
150 seconds
Behavioral task
behavioral3
Sample
Cheat Engine/DotNetDataCollector64.exe
Resource
win11-20260513-uk
windows11-21h2-x64
1 signatures
150 seconds
Behavioral task
behavioral4
Sample
Cheat Engine/Tutorial-x86_64.exe
Resource
win11-20260513-uk
windows11-21h2-x64
0 signatures
150 seconds
Behavioral task
behavioral5
Sample
Cheat Engine/ceregreset.exe
Resource
win11-20260513-uk
windows11-21h2-x64
1 signatures
150 seconds
Behavioral task
behavioral6
Sample
Cheat Engine/cheatengine-i386.exe
Resource
win11-20260513-uk
windows11-21h2-x64
8 signatures
150 seconds
Behavioral task
behavioral7
Sample
Cheat Engine/cheatengine-x86_64-SSE4-AVX2.exe
Resource
win11-20260513-uk
windows11-21h2-x64
6 signatures
150 seconds
Behavioral task
behavioral8
Sample
Cheat Engine/cheatengine-x86_64.exe
Resource
win11-20260513-uk
windows11-21h2-x64
6 signatures
150 seconds
Behavioral task
behavioral9
Sample
Cheat Engine/gtutorial-i386.exe
Resource
win11-20260513-uk
windows11-21h2-x64
1 signatures
150 seconds
Behavioral task
behavioral10
Sample
Cheat Engine/gtutorial-x86_64.exe
Resource
win11-20260513-uk
windows11-21h2-x64
0 signatures
150 seconds
Behavioral task
behavioral11
Sample
Cheat Engine/unins000.exe
Resource
win11-20260513-uk
windows11-21h2-x64
3 signatures
150 seconds
Behavioral task
behavioral12
Sample
Cheat Engine/windowsrepair.exe
Resource
win11-20260513-uk
windows11-21h2-x64
1 signatures
150 seconds
General
- Target Cheat Engine/cheatengine-x86_64.exe
- Size 17.8MB
- Sample260702-rydfaads5m
- SHA256 9727076da50924e4a097b49a02155e4b34759269c3017ff31375364b8826eb4d
- MD5 f3407085144bae14e86702e4f18f3d71
- SHA1 a0373039f17ed3b8b43e9082b50a901d0b6afe6f
- SHA512 2f907ba95871e5ef389ca2e7280d0b1ec3d6578f25a1e808024ed1c88f2410803b40504dc3d6bbc0d4a80f33f6b17fd41c7ffc98575ed09c9dec0d4e91c8ef77
- SSDEEP 393216:9jKiokiaMrfAnybq140fUm17eb6hbsjteeMNgNe8k:9m9bq14gStwmeR
- TLSH T11E175CBBB7729A98C0CAC1715587C7F15F31BD6808B5134722C5331E9FB68806EA9D8E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
5/10
Malware Config
Signatures
- Drops file in System32 directory 47 IoCs
description ioc Process File opened for modification C:\Windows\System32\bcryptPrimitives.dll cheatengine-x86_64.exe File opened for modification C:\Windows\System32\gdi32full.dll cheatengine-x86_64.exe File opened for modification C:\Windows\SYSTEM32\PROPSYS.dll cheatengine-x86_64.exe File opened for modification C:\Windows\System32\MSCTF.dll cheatengine-x86_64.exe File opened for modification C:\Windows\SYSTEM32\textinputframework.dll cheatengine-x86_64.exe File opened for modification C:\Windows\System32\KERNEL32.DLL cheatengine-x86_64.exe File opened for modification C:\Windows\System32\user32.dll cheatengine-x86_64.exe File opened for modification C:\Windows\System32\psapi.dll cheatengine-x86_64.exe File opened for modification C:\Windows\SYSTEM32\hhctrl.ocx cheatengine-x86_64.exe File opened for modification C:\Windows\SYSTEM32\dwmapi.dll cheatengine-x86_64.exe File opened for modification C:\Windows\SYSTEM32\wintypes.dll cheatengine-x86_64.exe File opened for modification C:\Windows\System32\GDI32.dll cheatengine-x86_64.exe File opened for modification C:\Windows\System32\msvcrt.dll cheatengine-x86_64.exe File opened for modification C:\Windows\SYSTEM32\opengl32.dll cheatengine-x86_64.exe File opened for modification C:\Windows\system32\uxtheme.dll cheatengine-x86_64.exe File opened for modification C:\Windows\SYSTEM32\version.dll cheatengine-x86_64.exe File opened for modification C:\Windows\SYSTEM32\wsock32.dll cheatengine-x86_64.exe File opened for modification C:\Windows\System32\oleaut32.dll cheatengine-x86_64.exe File opened for modification C:\Windows\System32\sechost.dll cheatengine-x86_64.exe File opened for modification C:\Windows\System32\ole32.dll cheatengine-x86_64.exe File opened for modification C:\Windows\System32\clbcatq.dll cheatengine-x86_64.exe File opened for modification C:\Windows\SYSTEM32\CoreUIComponents.dll cheatengine-x86_64.exe File opened for modification C:\Windows\SYSTEM32\CRYPTBASE.DLL cheatengine-x86_64.exe File opened for modification C:\Windows\System32\RPCRT4.dll cheatengine-x86_64.exe File opened for modification C:\Windows\System32\comdlg32.dll cheatengine-x86_64.exe File opened for modification C:\Windows\System32\shcore.dll cheatengine-x86_64.exe File opened for modification C:\Windows\System32\SHLWAPI.dll cheatengine-x86_64.exe File opened for modification C:\Windows\SYSTEM32\winhttp.dll cheatengine-x86_64.exe File opened for modification C:\Windows\SYSTEM32\GLU32.dll cheatengine-x86_64.exe File opened for modification C:\Windows\System32\win32u.dll cheatengine-x86_64.exe File opened for modification C:\Windows\System32\msvcp_win.dll cheatengine-x86_64.exe File opened for modification C:\Windows\System32\combase.dll cheatengine-x86_64.exe File opened for modification C:\Windows\System32\imagehlp.dll cheatengine-x86_64.exe File opened for modification C:\Windows\SYSTEM32\windows.storage.dll cheatengine-x86_64.exe File opened for modification C:\Windows\System32\shell32.dll cheatengine-x86_64.exe File opened for modification C:\Windows\System32\imm32.dll cheatengine-x86_64.exe File opened for modification C:\Windows\SYSTEM32\msimg32.dll cheatengine-x86_64.exe File opened for modification C:\Windows\SYSTEM32\dxcore.dll cheatengine-x86_64.exe File opened for modification C:\Windows\system32\explorerframe.dll cheatengine-x86_64.exe File opened for modification C:\Windows\SYSTEM32\CoreMessaging.dll cheatengine-x86_64.exe File opened for modification C:\Windows\System32\advapi32.dll cheatengine-x86_64.exe File opened for modification C:\Windows\SYSTEM32\ntdll.dll cheatengine-x86_64.exe File opened for modification C:\Windows\System32\KERNELBASE.dll cheatengine-x86_64.exe File opened for modification C:\Windows\System32\ucrtbase.dll cheatengine-x86_64.exe File opened for modification C:\Windows\System32\ws2_32.dll cheatengine-x86_64.exe File opened for modification C:\Windows\SYSTEM32\winmm.dll cheatengine-x86_64.exe File opened for modification C:\Windows\SYSTEM32\kernel.appcore.dll cheatengine-x86_64.exe - Drops file in Windows directory 1 IoCs
description ioc Process File opened for modification C:\Windows\WinSxS\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.22000.120_none_9d947278b86cc467\comctl32.dll cheatengine-x86_64.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Suspicious use of AdjustPrivilegeToken 16 IoCs
description pid Process Token: SeDebugPrivilege 2012 cheatengine-x86_64.exe Token: SeTcbPrivilege 2012 cheatengine-x86_64.exe Token: SeTcbPrivilege 2012 cheatengine-x86_64.exe Token: SeLoadDriverPrivilege 2012 cheatengine-x86_64.exe Token: SeCreateGlobalPrivilege 2012 cheatengine-x86_64.exe Token: SeLockMemoryPrivilege 2012 cheatengine-x86_64.exe Token: 33 2012 cheatengine-x86_64.exe Token: SeSecurityPrivilege 2012 cheatengine-x86_64.exe Token: SeTakeOwnershipPrivilege 2012 cheatengine-x86_64.exe Token: SeManageVolumePrivilege 2012 cheatengine-x86_64.exe Token: SeBackupPrivilege 2012 cheatengine-x86_64.exe Token: SeCreatePagefilePrivilege 2012 cheatengine-x86_64.exe Token: SeShutdownPrivilege 2012 cheatengine-x86_64.exe Token: SeRestorePrivilege 2012 cheatengine-x86_64.exe Token: 33 2012 cheatengine-x86_64.exe Token: SeIncBasePriorityPrivilege 2012 cheatengine-x86_64.exe - Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2012 cheatengine-x86_64.exe - Suspicious use of WriteProcessMemory 1 IoCs
description pid Process procid_target PID 2012 wrote to memory of 2932 2012 cheatengine-x86_64.exe 80
Processes
-
C:\Users\Admin\AppData\Local\Temp\Cheat Engine\cheatengine-x86_64.exe"C:\Users\Admin\AppData\Local\Temp\Cheat Engine\cheatengine-x86_64.exe"1⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:2012 -
C:\Users\Admin\AppData\Local\Temp\Cheat Engine\Tutorial-x86_64.exe"C:\Users\Admin\AppData\Local\Temp\Cheat Engine\Tutorial-x86_64.exe"2⤵PID:2932
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\Cheat Engine\ExceptionAutoSave_noname.ct
- Size 142B
- SHA256 df3daba3a699b6d7ab4475e170a0a9c4f8c519b298527ef3c9d9cb9ed5059873
- MD5 3bf254bcf45367ac0e271002f7fbf4f9
- SHA1 0a9450a92e6440297afb2974f80661ac116bf2df
- SHA512 adec0b2180e738ccfa9d2911186bd4172a023bcdea23c4b5255bd1d14612086581b0806fd2cbdd0088daa1679df21d4ccdb94c812aff4683ab8d1e8a9222bd72
- TLSH T163C08C24938078394A7089E0121E481812A0B69329501C7C6C464A3B8B0B4240082E30
- MD5 SHA1 SHA512 TLSH