efd2a733ef605467841ff54c95997982270297c32f6afe35eee52dab7071e575

Resubmissions

18/08/2026, 23:26

260818-3ez1qaca277

18/08/2026, 23:24

260818-3dw8faca237

Analysis

user interaction
yes
max time kernel
150s
max time network
153s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
18/08/2026, 23:24

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
external_alpha/cheat.exe
Size 52.0MB
Sample260818-3dw8faca23
SHA256 efd2a733ef605467841ff54c95997982270297c32f6afe35eee52dab7071e575
MD5 11dc16254979ffe0976cbd2293d841c2
SHA1 fbad5bc5759588a52b83b1e8646e128fd3c176cf
SHA512 a41793c5ff7284dc6a073fa5d9d6e4fbbeed07479f4651d619ee3cb21268cb51b516b3ef70ba602a5dd18a34e469acb87409511c051e24902a7a5192c7f48854
SSDEEP 786432:3usDqjKx26E931ISuig9QvHsMuKF6ArK:esv26ECMuKF6ArK
TLSH
T19DC73A09B2542449E6B2C2748D571187D660B8776F623ADF34DDA6DC2F33BE0EB39248
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Signatures

Loads dropped DLL 3 IoCs

pid	Process
1496	cheat.exe
1496	cheat.exe
1496	cheat.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 6 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	cheat.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	cheat.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A0953C92-50DC-43bf-BE83-3742FED03C9C}\Instance\	cheat.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1CF1260C-4DD0-4ebb-811F-33C572699FDE}\Instance\	cheat.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3ADD1653-EB32-4cb0-BBD7-DFA0ABB5ACCA}\Instance\	cheat.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{374DE290-123F-4565-9164-39C4925E467B}\Instance\	cheat.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4360 wrote to memory of 1496	4360	cheat.exe	89

C:\Users\Admin\AppData\Local\Temp\external_alpha\cheat.exe
"C:\Users\Admin\AppData\Local\Temp\external_alpha\cheat.exe"
1⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4360
- C:\Users\Admin\AppData\Local\Temp\external_alpha\cheat.exe
  C:\Users\Admin\AppData\Local\Temp\external_alpha\cheat.exe
  2⤵
  - Loads dropped DLL
  PID:1496

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4776

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

VCRUNTIME140.dll

Path C:\Users\Admin\AppData\Local\Temp\onefile_4360_026006_vRlmiAz6Xiw\VCRUNTIME140.dll
Size 117KB
SHA256 052ad6a20d375957e82aa6a3c441ea548d89be0981516ca7eb306e063d5027f4
MD5 32da96115c9d783a0769312c0482a62d
SHA1 2ea840a5faa87a2fe8d7e5cb4367f2418077d66b
SHA512 616c78b4a24761d4640ae2377b873f7779322ef7bc26f8de7da0d880b227c577ed6f5ed794fc733468477b2fcdb7916def250e5dc63e79257616f99768419087
SSDEEP 1536:Z9TXF5YXWbj8qr51XlN+dULTCe1IGhKWyxLiyaXYaNxoecbdhUoaLjTz164zEd:ZEnsvReGsWyxLizXFkecbd1aPTzW
TLSH
T10DC38C8572A002FBD16AC274C1A36A17FB75B94487B0A7CF03B58A650F53BE09E3D356
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cheat.dll

Path C:\Users\Admin\AppData\Local\Temp\onefile_4360_026006_vRlmiAz6Xiw\cheat.dll
Size 18.8MB
SHA256 f281789e8b88eda9f690438778fa7d30f2337eb0ecce787140212a3978720e38
MD5 59359ac701b1f422f173fc24823a5256
SHA1 8ab7b0ca6b1b729730a663e5662adb891d862602
SHA512 0d7970e0210e2d8ec21f8e05947198dcdd5497aad794de9e83f48a39ec7c07773d4ef1c4ef39061ef2b2c627f54fef671cca4133a65fc016bb1b589ff25f4f70
SSDEEP 196608:7C83j8hi80HOQElz2KPY+gqjK5KjQYa26E4D:75z6sDqjKUG26E4
TLSH
T100174B0262B85052EA60D3BD6C75124AEB71B409FB3777E7186CC40D6B939A687BF34C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

python313.dll

Path C:\Users\Admin\AppData\Local\Temp\onefile_4360_026006_vRlmiAz6Xiw\python313.dll
Size 5.8MB
SHA256 3a7a6170ea840bf2a2a76d05b687b946fcdc8d0cfedfe159012b38f1e8959a7c
MD5 b0f3aa8a9fc7462f25b1f48f3174dfa5
SHA1 63243edfcf789b5fb9370e5baa27e9a07ba3ebaa
SHA512 07b83bd20ff501f4753273684e4e539a5722dd0eb2689c045665da12e5a1b0950c70ba9c8e4dd99be72057b9311ed4199b643639b8f49f1cba8c41c8c29bc57e
SSDEEP 49152:kYxOb4yPiEMqTGnJwYE2M8SMW+IC1f37M2nGyN7yd5va4ifhSBqVX0Yy13KR/x1n:gPzKWIHosdoBcqbei8I0CSvNHDMiEnsj
TLSH
T15D567C16729E40ACD97B8078CA17864BFBB27C013E60534B61E6BB5D2FB3362476E705
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads