Analysis
- max time kernel
150s - max time network
151s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260617-en - resource tags
- submitted
29/06/2026, 05:48
General
- Target gbcheatv16.exe
- Size 4.9MB
- Sample260629-ghl3daes2y
- SHA256 910f8a21a34ab429689f8843adf1072258ef7d2782b7ebe07df12998ee4c04c3
Malware Config
Signatures
- Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\gbcheatv16.exe"C:\Users\Admin\AppData\Local\Temp\gbcheatv16.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
memory/1504-0-0x00007FF8EA27F000-0x00007FF8EA280000-memory.dmp
memory/1504-1-0x0000021FD3AE0000-0x0000021FD3FD4000-memory.dmp
memory/1504-2-0x00007FF8EA0F0000-0x00007FF8EAA94000-memory.dmp
memory/1504-3-0x00007FF8EA0F0000-0x00007FF8EAA94000-memory.dmp
memory/1504-4-0x0000021FEE580000-0x0000021FEE668000-memory.dmp
memory/1504-5-0x00007FF8EA0F0000-0x00007FF8EAA94000-memory.dmp
memory/1504-6-0x00007FF8EA0F0000-0x00007FF8EAA94000-memory.dmp
memory/1504-7-0x0000021FEE690000-0x0000021FEE7FA000-memory.dmp
memory/1504-10-0x0000021FD4430000-0x0000021FD443A000-memory.dmp
memory/1504-12-0x0000021FD5CA0000-0x0000021FD5CE2000-memory.dmp
memory/1504-13-0x0000021FEE8E0000-0x0000021FEE994000-memory.dmp
memory/1504-11-0x0000021FD44D0000-0x0000021FD44DA000-memory.dmp
memory/1504-9-0x0000021FEE800000-0x0000021FEE8DC000-memory.dmp
memory/1504-8-0x00007FF8EA0F0000-0x00007FF8EAA94000-memory.dmp
memory/1504-14-0x0000021FD5D80000-0x0000021FD5D88000-memory.dmp
memory/1504-15-0x00007FF8EA0F0000-0x00007FF8EAA94000-memory.dmp
memory/1504-16-0x00007FF8EA0F0000-0x00007FF8EAA94000-memory.dmp
memory/1504-17-0x00007FF8EA0F0000-0x00007FF8EAA94000-memory.dmp
memory/1504-18-0x0000021FEEE20000-0x0000021FEEE42000-memory.dmp