adcd6f7a7b8bee0d27e680c43a845d689509d2367177b59dfbbbcdaf390fbaec

Analysis

max time kernel
899s
max time network
484s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
27/07/2026, 22:44

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
cheat-engine-7.5/Cheat Engine/luaremoteexecutor.bat
Size 26KB
Sample260727-2nssbssfna
SHA256 adcd6f7a7b8bee0d27e680c43a845d689509d2367177b59dfbbbcdaf390fbaec
MD5 aa32da47e80757ad11cf96e99494e3f1
SHA1 f8c76ec9dd8c4a3a876b93080635b4b163a7bc7f
SHA512 8866daab8e2988f99322bdde815b27ef6f346e88d11170fab5b7bb651896c06181ce8ed315b6441cc7b039f0745ddad98ed131b1d7eadb270a550120a2437100
SSDEEP 768:4dO0ASe6gdYmTGjZTjP15vQD+czQPt1IbsHUz/it/z+:4YsHQD+c+1JHm/i/i
TLSH
T1F7C27215BE3E17B251B2508217EB91426717124F2250D0F474EECE402F9AB9EB5B8FBD
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

execution

Malware Config

Signatures

Enumerates connected drives 3 TTPs 1 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\r:	cmd.exe

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4496	cmd.exe

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\cheat-engine-7.5\Cheat Engine\luaremoteexecutor.bat"
1⤵
- Enumerates connected drives
- Executes a command shell one-liner
PID:4496

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:3504

C:\Windows\System32\SecurityHealthHost.exe
\\?\C:\Windows\System32\SecurityHealthHost.exe {08728914-3F57-4D52-9E31-49DAECA5A80A} -Embedding
1⤵
PID:3596

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads