b473c3e7fe0736531be831543e89e4c20831325399bd3b4868ae8f7e06858b9a

Analysis

max time kernel
148s
max time network
125s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
03/08/2026, 03:39

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
swatscheats.exe
Size 501KB
Sample260803-d75dgabf32
SHA256 b473c3e7fe0736531be831543e89e4c20831325399bd3b4868ae8f7e06858b9a
MD5 412c3f19f9558ea8f2ff02b1e0e083b0
SHA1 82ca33192eafc000c88705abbb44adaf3d7f3345
SHA512 89638d51eb8eaad8526fcbbfb3afa7f0830e8cb386df4a2187872294a221293a8acd0a6002d7aa85d49116acbfaf21cbb681abfb60454cb1f44b0681383c5bff
SSDEEP 12288:AkH0PjawCBjGn5MN1xKZrBs61WEYiEnmq:AkHOahS5MXgZrX1WDiEnmq
TLSH
T17DB4BF46F2BEA7F5C06BD034E546BA0BFE313858075059DB63E409A527E37E09BB7242
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

execution

Malware Config

Signatures

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
932	cmd.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2992	swatscheats.exe
2992	swatscheats.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 2992 wrote to memory of 932	2992	swatscheats.exe	90

C:\Users\Admin\AppData\Local\Temp\swatscheats.exe
"C:\Users\Admin\AppData\Local\Temp\swatscheats.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2992
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c pause
  2⤵
  - Executes a command shell one-liner
  PID:932

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads