3387931fc00ae9bd5fff9fc8efe7537960cef92aac32133066172f3952fe1ed9

Analysis

max time kernel
899s
max time network
411s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
17/05/2026, 17:28

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
FiveM.exe
Size 4.9MB
Sample260517-v2byeabv5y
SHA256 3387931fc00ae9bd5fff9fc8efe7537960cef92aac32133066172f3952fe1ed9
MD5 7d1daf13865d725090511e79c480cccd
SHA1 f33b007f3df5f1ba949ecedf5645fd10f83d36ce
SHA512 e8e1ebcbf1d9065a01089e833b6dcfccbeaf435a80370ea042f633571b1879a1f31269e3244453fde6851a1c38d5594be670d76a48e57abca3a5e0d67ee27408
SSDEEP 49152:nOjPWFZwclTLDHWk7o1HMvdCuYTfksFHaciUylf00Ki482X/ub2PwTAK7BJQmDfz:JXnLouYTB7N8vyO7UqGGyL6bs3U0mD
TLSH
T1FE369D5663A401E8C1B7D178CA978627EBB27C151331DBDB02A0666A1F37BE16F3E710
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

defense_evasion discovery

Malware Config

Signatures

Drops desktop.ini file(s) 2 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Videos\Captures\desktop.ini	svchost.exe
File opened for modification	C:\Users\Admin\AppData\Local\FiveM\FiveM.app\desktop.ini	FiveM.exe

Network Service Discovery 1 TTPs 1 IoCs

Attempt to gather information on host's network.

discovery

Network Service Discovery

T1046

pid	Process
3540	GameBarPresenceWriter.exe

Deletes itself 1 IoCs

pid	Process
5788	CitizenFX.exe.new

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Executes dropped EXE 4 IoCs

pid	Process
5788	CitizenFX.exe.new
3300	FiveM.exe
404	FiveM.exe
3076	FiveM_DumpServer

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 4 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	svchost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	svchost.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	svchost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	svchost.exe

Modifies Control Panel 2 IoCs

defense_evasion

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000\Control Panel\Colors	FiveM.exe
Key created	\REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000\Control Panel\Colors	FiveM.exe

Modifies registry class 23 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	FiveM.exe
Key created	\REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	FiveM.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02	FiveM.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\NodeSlot = "1"	FiveM.exe
Key created	\Registry\User\S-1-5-21-226940941-599731907-2645636698-1000_Classes\NotificationData	FiveM.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-226940941-599731907-2645636698-1000\{8EFB7DF5-3A9D-4274-AF60-D8D2BFAF10BD}	svchost.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots	FiveM.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 = 14001f50e04fd020ea3a6910a2d808002b30309d0000	FiveM.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 00000000ffffffff	FiveM.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\MRUListEx = ffffffff	FiveM.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\SniffedFolderType = "Documents"	FiveM.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	FiveM.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-226940941-599731907-2645636698-1000\{169FCDCF-154B-46C7-A195-BF4C66DA0443}	svchost.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff	FiveM.exe
Key created	\REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0	FiveM.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	FiveM.exe
Key created	\REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell	FiveM.exe
Key created	\REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	FiveM.exe
Key created	\REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000_Classes\Local Settings	FiveM.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 = 14002e80922b16d365937a46956b92703aca08af0000	FiveM.exe
Key created	\REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0	FiveM.exe
Key created	\REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags	FiveM.exe
Key created	\REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1	FiveM.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
404	FiveM.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
5788	CitizenFX.exe.new

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
616	FiveM.exe
404	FiveM.exe

Suspicious use of SetWindowsHookEx 5 IoCs

pid	Process
616	FiveM.exe
4092	OpenWith.exe
404	FiveM.exe
404	FiveM.exe
404	FiveM.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 616 wrote to memory of 5788	616	FiveM.exe	84
PID 5788 wrote to memory of 3300	5788	CitizenFX.exe.new	85
PID 3300 wrote to memory of 404	3300	FiveM.exe	86
PID 404 wrote to memory of 3076	404	FiveM.exe	88

C:\Users\Admin\AppData\Local\Temp\FiveM.exe
"C:\Users\Admin\AppData\Local\Temp\FiveM.exe"
1⤵
- Modifies Control Panel
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:616
- C:\Users\Admin\AppData\Local\Temp\CitizenFX.exe.new
  CitizenFX.exe.new -bootstrap "C:\Users\Admin\AppData\Local\Temp\FiveM.exe"
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - Suspicious behavior: RenamesItself
  - Suspicious use of WriteProcessMemory
  PID:5788
- - C:\Users\Admin\AppData\Local\Temp\FiveM.exe
    "C:\Users\Admin\AppData\Local\Temp\FiveM.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:3300
  - - C:\Users\Admin\AppData\Local\FiveM\FiveM.exe
      "C:\Users\Admin\AppData\Local\FiveM\FiveM.exe"
      4⤵
      Drops desktop.ini file(s)
      Executes dropped EXE
      Modifies Control Panel
      Modifies registry class
      Suspicious behavior: GetForegroundWindowSpam
      Suspicious use of FindShellTrayWindow
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:404
    - - C:\Users\Admin\AppData\Local\FiveM\FiveM.app\data\cache\subprocess\FiveM_DumpServer
        
        "C:\Users\Admin\AppData\Local\FiveM\FiveM.app\data\cache\subprocess\FiveM_DumpServer" -dumpserver:2412 -parentpid:404
        5⤵
        Executes dropped EXE
        
        PID:3076

C:\Windows\System32\GameBarPresenceWriter.exe
"C:\Windows\System32\GameBarPresenceWriter.exe" -ServerName:Windows.Gaming.GameBar.Internal.PresenceWriterServer
1⤵
- Network Service Discovery
PID:3540

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:4092

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k BcastDVRUserService -s BcastDVRUserService
1⤵
- Drops desktop.ini file(s)
- Checks processor information in registry
- Modifies registry class
PID:2072

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k BcastDVRUserService -s BcastDVRUserService
1⤵
- Checks processor information in registry
- Modifies registry class
PID:900

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Network Service Discovery

T1046

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.meta.tmp

Path C:\Users\Admin\AppData\Local\FiveM\FiveM.app\citizen\platform-2372\data\control\settings.meta.tmp
Size 37KB
SHA256 f9ae094812ce9fbd56b58dab7739451792aba8f56c5f21eee15ef96682b413a6
MD5 3656c6636cd9dbceaf83230c3c9a2be9
SHA1 989f27c6736a943fd4690091fed26f7c17e3c17f
SHA512 52bbb8f2b2d6183f30b908d9171a2ec8c2128bbce145b7af0095d4c199b1ec431d650ec4ed0b1b6cbc7bcc8d29da3285cdcc61368faa8c4e57b45315ced4e4ad
SSDEEP 384:Gs34QmZSgC5RHTiVfNSAvRSOxRlne8lISI11zHdlz9a8QSuF5MGsXZXgCoRKRyR8:D34QMfNSEWJvz39pjE4
TLSH
T1B803DA6C3A9D5F5A198880B71CF704C971AFECBA2FEA19941B25A13307C3E602376675
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.meta.tmp

Path C:\Users\Admin\AppData\Local\FiveM\FiveM.app\citizen\platform-3095\data\control\settings.meta.tmp
Size 39KB
SHA256 71ad5591441d62d02d2b62155abcf2cab587af49b86e2db5be6729a5b39df5d1
MD5 619814b8b98007c1698576b7e4efb3ec
SHA1 e60f3ceaf5ca78f74e6867f0b042951bffb91786
SHA512 55ab0bd3c1750d63ad3304e63b7c26251f01c8994f385e5643e2bbd37fc6595fd0e9f5fc0d76aa655fe8ad3bc6fdee33248d9f4a76cce11a25d84c3f5de16236
SSDEEP 384:Gs34QSSgC5RHTiVfF3AvRSOxRlne8lY7Sf11zHdlz9a8NSuFsMysXZXgCoRKRyR7:D34QOfF3E6qvz3NpcE4
TLSH
T17803CA2C3A9D5F56198880B71CF704C971AFECBA2FEA19941B25E03307C3E602376675
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

release.txt

Path C:\Users\Admin\AppData\Local\FiveM\FiveM.app\citizen\release.txt
Size 7B
SHA256 5419888a2ac2e3c34c150e3e9f0a265dfca6223f7af1a270cf86256f55521622
MD5 48877f213108af3be7a257d6386b45ce
SHA1 553fefc104f0d2ac775b5ba0eff7b700993672b6
SHA512 fafbd4559d28b9c9728a4936417e0e40f831484e0be435772ba9810f67f31be4cc8db2f7512ffb4b497ac5953f847b8bbd35843dbe683464262e5fb68823afe8
MD5 SHA1 SHA512

Submit Download

natives_universal.lua.tmp

Path C:\Users\Admin\AppData\Local\FiveM\FiveM.app\citizen\scripting\lua\natives_universal.lua.tmp
Size 2.0MB
SHA256 9d77fc3adf023a18d1ba3d8e1ea1077f6326061b3658917646f275a9bbda8e59
MD5 d611eae2641484aee6b132c0072e6f20
SHA1 c5ee40193f85baafe49770e096e736bbd371807b
SHA512 7fc78b6ef458dca7ed0c097fbe89884590e97e2e4c8647cee8acd1b9582ee0a3bf7414a17843ac7f9c70d325a81eec5aa14ff9dc6a5225930354808064c71638
SSDEEP 49152:gNbJqV8HZrbVWFY65oMzDhpp0ocv+aeHBqkAxZhXMBvFZGh:rg2FY6BcLh
TLSH
T1009509DA781ED3559543632A511F194BF269C0A8212D01F0F185B8DE2432FB96BFF8FA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

natives_universal.d.ts.tmp

Path C:\Users\Admin\AppData\Local\FiveM\FiveM.app\citizen\scripting\v8\natives_universal.d.ts.tmp
Size 2.3MB
SHA256 b1afb18877008259b73909fa24303c81dd649afaff1727837fce612b5d5a8c99
MD5 73f679358ea07012eb904b5a479a0edc
SHA1 24ccef24ac03426b7dcdba56e196aa6533044626
SHA512 0a904a37577fe0b0d06cb0b3be90255e6a5dc41f588b052d1626776268b40c5f35793590b8bca9ca11376a38d603ca59823b4a11f58d37b141ae979d558dc2c6
SSDEEP 49152:sO4NUHbAeYZJkG21H9gA32HD7lcmu6DjBvdnrD:sO4K6JkG9AUD
TLSH
T172B5969AFF493233E6B29232B0BF5048E9746258A91131DF7CF464540F1B2BC26A7D9D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

natives_universal.js.tmp

Path C:\Users\Admin\AppData\Local\FiveM\FiveM.app\citizen\scripting\v8\natives_universal.js.tmp
Size 2.1MB
SHA256 505a5b3fa5385f3fd28fd42d14b6f11622c2ae9aba7cb526a3471f367534088d
MD5 d79bb249f18df318a66f4847c4db828b
SHA1 617fdcaab1577a7d94d212a4d3acb2959f5de0d0
SHA512 0d64515e09c3c2d54aa92349370018bb6672945c9952d2612b37e697155a3714014b71989d03de1461258680c61b90814b5732b15fa231abe8472c024f11e585
SSDEEP 49152:BIMMNUY2FaHRKkMjJp1R9N9AaKeNrEDEi8XbhNEVgs:ilZKkM1AWs
TLSH
T1BAA5E8E93881622AE523723CD12B5D09F374E431598D21E8BCDD64982D24FBD46FEDAC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

desktop.ini

Path C:\Users\Admin\AppData\Local\FiveM\FiveM.app\desktop.ini
Size 157B
SHA256 b1fe21f251cf7875783ea162ef86c2a5b5022a1c5157bbb7972b6b34e14ec08a
MD5 f9d948aa9426cb1a2a82e651b81a1912
SHA1 2d496caeef3b0bff6b91b99e58736cea51366348
SHA512 a962fae3853f43e4a8e2b33aa5f51a917673d76648845dffcc32037c25cb3f300e4c4fc3ea633bf78b714449dbda84416e41cc16256373c170fb82d8485e3369
TLSH
T14DC04C06818FC62DC42ED0BB1DA1A248CCBD0D2BAF6E7E04D6C0D50827D6F4FACA5685
MD5 SHA1 SHA512 TLSH

Submit Download

CitizenFX.exe.new

Path C:\Users\Admin\AppData\Local\Temp\CitizenFX.exe.new
Size 4.9MB
SHA256 0e28a122156b951f12b88f47105b64a33f832071f056fed430f38d591f368d98
MD5 5ca67051624c5c69d123a3e14d40e64f
SHA1 2c534a2ca5365fa4fab597885c9456ae6067ef37
SHA512 8ed340ad02009129af3eade8ef25b9d0ab3fbf49ac064ad563835f412a75c4662f1d92eaf44f6dc3a5116b8bccea569adc08dc49265d31b28fdd813294bde704
SSDEEP 49152:ZOjPWcelNB3la41Hf3ln5EdccXqHyVJmoAcnye7DVEhjbJTB/RlbGQq2uUAANQIW:HtNhCXqHyVmTAlXgQMm3BuN70fuHmgC
TLSH
T1D3369D5663A801E8C5B7D178CA978627E7B27C061371C7DF02A0666A1F37BE16E3E710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FiveM.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\FiveM.lnk
Size 2KB
SHA256 1b8c7b98aa3920c8922631a96d86c14635abbdaa643a894be87713e7d1ad9fd1
MD5 3275cc7f792bcd532f23ff14f7bc85fa
SHA1 84a082a2f4efb81750abba71d41b53d0c783de44
SHA512 67d013803705a002a6367c80bb817090b81071cdf17b63f39fe4564256141c54a1c87ad9864dc04b2df5bfbb005a1c97e01ed77d24bcba54d8b85b3c1fafdbc8
TLSH
T15041E0179EEA9F30E3EAD8B018B797216672BC9AF3559B0F404082881DA1D11DC98F4B
MD5 SHA1 SHA512 TLSH

Submit Download

desktop.ini

Path C:\Users\Admin\Videos\Captures\desktop.ini
Size 190B
SHA256 86d9f822aeb989755fac82929e8db369b3f5f04117ef96fd76e3d5f920a501d2
MD5 b0d27eaec71f1cd73b015f5ceeb15f9d
SHA1 62264f8b5c2f5034a1e4143df6e8c787165fbc2f
SHA512 7b5c9783a0a14b600b156825639d24cbbc000f5066c48ce9fecc195255603fc55129aaaca336d7ce6ad4e941d5492b756562f2c7a1d151fcfc2dabac76f3946c
TLSH
T11EC0121892F93224A1728D12BD7460119AB1F4217C16CA9D1380508F08A1601E631B53
MD5 SHA1 SHA512 TLSH

Submit Download

memory/4092-14-0x0000021E7F580000-0x0000021E7FD3A000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads