Analysis
- user interaction
yes - max time kernel
227s - max time network
232s - platform
windows11-21h2_x64 - resource
win11-20260513-en - resource tags
- submitted
14/08/2026, 10:33
General
- Target cheat-engine-7-6-0.exe
- Size 35.0MB
- Sample260814-mlvfta11ev
- SHA256 f96eca4a678f34c5d6c5e8b3ebb0f086f17ffc869c021e5576f8b906dace0336
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
- Loads dropped DLL 1 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Inno Setup is an open-source installation builder for Windows applications. 2 IoCs
Inno Setup installer
- Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
- Suspicious behavior: EnumeratesProcesses 4 IoCs
- Suspicious use of WriteProcessMemory 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\cheat-engine-7-6-0.exe"C:\Users\Admin\AppData\Local\Temp\cheat-engine-7-6-0.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-8VAIV.tmp\cheat-engine-7-6-0.tmp"C:\Users\Admin\AppData\Local\Temp\is-8VAIV.tmp\cheat-engine-7-6-0.tmp" /SL5="$60226,35769578,776192,C:\Users\Admin\AppData\Local\Temp\cheat-engine-7-6-0.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
Opera_new.png
WeatherZero.png
WebAdvisor.png
logo.png
zbShieldUtils.dll
cheat-engine-7-6-0.tmp
memory/1752-13-0x0000000000400000-0x00000000004CB000-memory.dmp
memory/1752-0-0x0000000000400000-0x00000000004CB000-memory.dmp
memory/4076-14-0x0000000000400000-0x0000000000706000-memory.dmp
memory/4076-15-0x00000000025C0000-0x00000000025C1000-memory.dmp
memory/4076-33-0x0000000004FF0000-0x0000000005130000-memory.dmp
memory/4076-30-0x0000000004FF0000-0x0000000005130000-memory.dmp
memory/4076-29-0x0000000004FF0000-0x0000000005130000-memory.dmp
memory/4076-70-0x0000000004FF0000-0x0000000005130000-memory.dmp
memory/4076-71-0x0000000004FF0000-0x0000000005130000-memory.dmp
memory/4076-32-0x0000000000400000-0x0000000000706000-memory.dmp
memory/4076-75-0x0000000004FF0000-0x0000000005130000-memory.dmp
memory/4076-78-0x0000000004FF0000-0x0000000005130000-memory.dmp
memory/4076-77-0x0000000000400000-0x0000000000706000-memory.dmp
memory/4076-5-0x00000000025C0000-0x00000000025C1000-memory.dmp
memory/4076-82-0x0000000004FF0000-0x0000000005130000-memory.dmp
memory/4076-83-0x0000000004FF0000-0x0000000005130000-memory.dmp
memory/4076-84-0x0000000004FF0000-0x0000000005130000-memory.dmp
memory/4076-86-0x0000000000400000-0x0000000000706000-memory.dmp