c31baa5af6919a2be8be2b19275d161fcc113ca936a905855bdeecf2cacc1ecb

Analysis

max time kernel
148s
max time network
146s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
27/07/2026, 19:57

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-27_9bc89d3b1400d2ec8db893bdc4db81c1_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe
Size 5.0MB
Sample260727-ypl5dsdk7v
SHA256 c31baa5af6919a2be8be2b19275d161fcc113ca936a905855bdeecf2cacc1ecb
MD5 9bc89d3b1400d2ec8db893bdc4db81c1
SHA1 f5e266a08a31ffb7e0b7be6d536d06d4ebc894b0
SHA512 fbe870cf6e1cc9040663cae11b7a82cac9e71c6ede0d1ea4cbdeb34f692dcd618d556801732b53d9010299fbf46ad04fb238051747d598825eb7f61c6b19c0c7
SSDEEP 49152:TOjPWIYgLg9GI35nZemOvAVDAIqNVB+VSavnAERUtnzrNKY3rNgMVBE5IouLTdaO:vGIVqvB+VvYxUCBaKcw0xCoBkdH92kr
TLSH
T11136AD5673A400E8D5B7D178CA968527E7B2BC061371CBDF02A0666A1F37BE16E3E710
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

defense_evasion discovery

Malware Config

Signatures

Drops desktop.ini file(s) 2 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\FiveM\FiveM.app\desktop.ini	FiveM.exe
File opened for modification	C:\Users\Admin\Videos\Captures\desktop.ini	svchost.exe

Network Service Discovery 1 TTPs 1 IoCs

Attempt to gather information on host's network.

discovery

Network Service Discovery

T1046

pid	Process
2868	GameBarPresenceWriter.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Executes dropped EXE 2 IoCs

pid	Process
3976	FiveM.exe
840	FiveM_DumpServer

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 4 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	svchost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	svchost.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	svchost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	svchost.exe

Modifies Control Panel 1 IoCs

defense_evasion

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Control Panel\Colors	FiveM.exe

Modifies registry class 30 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags	FiveM.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{374DE290-123F-4565-9164-39C4925E467B}\Instance\	FiveM.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3dfdf296-dbec-4fb4-81d1-6a3438bcf4de}\Instance\	FiveM.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings	FiveM.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A0953C92-50DC-43bf-BE83-3742FED03C9C}\Instance\	FiveM.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2	FiveM.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1CF1260C-4DD0-4ebb-811F-33C572699FDE}\Instance\	FiveM.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3ADD1653-EB32-4cb0-BBD7-DFA0ABB5ACCA}\Instance\	FiveM.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	FiveM.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{088e3905-0323-4b02-9826-5d99428e115f}\Instance\	FiveM.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-552508041-2681165170-3229858294-1000\{E98B9F8A-59CF-445A-B515-C1E91D34E664}	svchost.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	FiveM.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1	FiveM.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 0202	FiveM.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{f86fa3ab-70d2-4fc7-9c99-fcbf05467f3a}\Instance\	FiveM.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{24ad3ad4-a569-4530-98e1-ab02f9417aa8}\Instance\	FiveM.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-552508041-2681165170-3229858294-1000\{91BFCBB8-1693-4ED1-9765-899A0BA7AE6F}	svchost.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	FiveM.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1 = 14001f481cffcda87848be43b5fdf8091c1c60d00000	FiveM.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell	FiveM.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell\SniffedFolderType = "Documents"	FiveM.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02	FiveM.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\NodeSlot = "2"	FiveM.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\NotificationData	FiveM.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	FiveM.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\MRUListEx = ffffffff	FiveM.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	FiveM.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{d3162b92-9365-467a-956b-92703aca08af}\Instance\	FiveM.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	FiveM.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 0100000000000000ffffffff	FiveM.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
4972	2026-07-27_9bc89d3b1400d2ec8db893bdc4db81c1_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe
4972	2026-07-27_9bc89d3b1400d2ec8db893bdc4db81c1_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe
3976	FiveM.exe
3976	FiveM.exe
840	FiveM_DumpServer
840	FiveM_DumpServer

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3976	FiveM.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3976	FiveM.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
3976	FiveM.exe
4556	OpenWith.exe
3976	FiveM.exe
3976	FiveM.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 4972 wrote to memory of 3976	4972	2026-07-27_9bc89d3b1400d2ec8db893bdc4db81c1_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe	89
PID 3976 wrote to memory of 840	3976	FiveM.exe	96

C:\Users\Admin\AppData\Local\Temp\2026-07-27_9bc89d3b1400d2ec8db893bdc4db81c1_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-27_9bc89d3b1400d2ec8db893bdc4db81c1_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4972
- C:\Users\Admin\AppData\Local\FiveM\FiveM.exe
  "C:\Users\Admin\AppData\Local\FiveM\FiveM.exe"
  2⤵
  - Drops desktop.ini file(s)
  - Executes dropped EXE
  - Modifies Control Panel
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3976
- - C:\Users\Admin\AppData\Local\FiveM\FiveM.app\data\cache\subprocess\FiveM_DumpServer
    "C:\Users\Admin\AppData\Local\FiveM\FiveM.app\data\cache\subprocess\FiveM_DumpServer" -dumpserver:2284 -parentpid:3976
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    PID:840

C:\Windows\System32\GameBarPresenceWriter.exe
"C:\Windows\System32\GameBarPresenceWriter.exe" -ServerName:Windows.Gaming.GameBar.Internal.PresenceWriterServer
1⤵
- Network Service Discovery
PID:2868

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:4556

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k BcastDVRUserService -s BcastDVRUserService
1⤵
- Drops desktop.ini file(s)
- Checks processor information in registry
- Modifies registry class
PID:4912

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k BcastDVRUserService -s BcastDVRUserService
1⤵
- Checks processor information in registry
- Modifies registry class
PID:1196

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Network Service Discovery

T1046

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.meta.tmp

Path C:\Users\Admin\AppData\Local\FiveM\FiveM.app\citizen\platform-2372\data\control\settings.meta.tmp
Size 37KB
SHA256 f9ae094812ce9fbd56b58dab7739451792aba8f56c5f21eee15ef96682b413a6
MD5 3656c6636cd9dbceaf83230c3c9a2be9
SHA1 989f27c6736a943fd4690091fed26f7c17e3c17f
SHA512 52bbb8f2b2d6183f30b908d9171a2ec8c2128bbce145b7af0095d4c199b1ec431d650ec4ed0b1b6cbc7bcc8d29da3285cdcc61368faa8c4e57b45315ced4e4ad
SSDEEP 384:Gs34QmZSgC5RHTiVfNSAvRSOxRlne8lISI11zHdlz9a8QSuF5MGsXZXgCoRKRyR8:D34QMfNSEWJvz39pjE4
TLSH
T1B803DA6C3A9D5F5A198880B71CF704C971AFECBA2FEA19941B25A13307C3E602376675
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.meta.tmp

Path C:\Users\Admin\AppData\Local\FiveM\FiveM.app\citizen\platform-3095\data\control\settings.meta.tmp
Size 39KB
SHA256 71ad5591441d62d02d2b62155abcf2cab587af49b86e2db5be6729a5b39df5d1
MD5 619814b8b98007c1698576b7e4efb3ec
SHA1 e60f3ceaf5ca78f74e6867f0b042951bffb91786
SHA512 55ab0bd3c1750d63ad3304e63b7c26251f01c8994f385e5643e2bbd37fc6595fd0e9f5fc0d76aa655fe8ad3bc6fdee33248d9f4a76cce11a25d84c3f5de16236
SSDEEP 384:Gs34QSSgC5RHTiVfF3AvRSOxRlne8lY7Sf11zHdlz9a8NSuFsMysXZXgCoRKRyR7:D34QOfF3E6qvz3NpcE4
TLSH
T17803CA2C3A9D5F56198880B71CF704C971AFECBA2FEA19941B25E03307C3E602376675
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

release.txt

Path C:\Users\Admin\AppData\Local\FiveM\FiveM.app\citizen\release.txt
Size 7B
SHA256 76ddc67e1d585315601f884c61d396d470ee8d8a5738492aa91900bf2de00589
MD5 7dd1591f1ca77e7c0490579f81046f6c
SHA1 95942a91bd7b29837bf467ef107129559d4e502e
SHA512 394b632d82a4db356e4b9c2d5904e98c9e9f5cadd3d1aa417a783b5f62aa4ae6d0c06580b45153e05bf8a86a8904bd3497f1f58c6d20d023666a8172a33f937d
MD5 SHA1 SHA512

Submit Download

natives_universal.lua.tmp

Path C:\Users\Admin\AppData\Local\FiveM\FiveM.app\citizen\scripting\lua\natives_universal.lua.tmp
Size 2.0MB
SHA256 de11a2b8c358f670870849ec20602938f32216c7c68b98dd9a10a0f381b2ddd9
MD5 0b086870cb47cd0d818099da7607a872
SHA1 7f0ff7cf7f462c45d72f7494dcf8b72ce47997cb
SHA512 a74693b672f8dfe9110fd6c1eb6c35c9105e4eee56398d59c33432944adc8e0987d2ff1873a392fc1585938c0ff18ff275821cbcca2715bf7c61e734f5706424
SSDEEP 49152:JNbJqV8HyrbVWFY45oFz7hpp0ZcM+aeHBqkAxZhXMBvFZGh:Ig9FY45cuh
TLSH
T1509509DA781ED3559543632A511F194BF269C0A8212D01F0F185B8DE2432FB96BFF8FA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

natives_21E43A33.d.ts.tmp

Path C:\Users\Admin\AppData\Local\FiveM\FiveM.app\citizen\scripting\v8\natives_21E43A33.d.ts.tmp
Size 2.3MB
SHA256 52499390f5fc1a91165b4b8980b0c7c3fb3798d1db71499892e9eaa1319f56c3
MD5 b6c23a02770b32f213c2595ef5c0ae1c
SHA1 1b34f25141e2ac2aa326a7ab77ba04e100de4ff8
SHA512 d2ed9c3aed79d6be37887a19d94d815c4a004c1a54d2c0bdc66732cd9f67b39d2cc754891f328d7b0f974fb9886da2cc76d582a74a2e47b738cc0c1ab913995f
SSDEEP 49152:kO4NUH1AeYZJkIx1H9AAH2HD7lcmu6DjBvdnrD:kO4K4JkI2AkD
TLSH
T10CB5969AFF493233E6B29232B0BF5048E9746258A91131DF7CF464540F1B2BC26A7D9D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

natives_universal.js.tmp

Path C:\Users\Admin\AppData\Local\FiveM\FiveM.app\citizen\scripting\v8\natives_universal.js.tmp
Size 2.1MB
SHA256 02e08cc92e39910f68356f73946acdfa462f270fa3bf541dedbd4b64713dbf5d
MD5 9949bda20f33c3e4598e8ef24c735bb6
SHA1 3982a1cdf3a16be944fcae8c349e0835b23b1757
SHA512 e53400c828f00eac8dda8d2ebe393f813405a735d4406a60987ebbcf13959518977c52f3fb6790c756b3826bde2281344c12adac163b94f8698bd49353af034a
SSDEEP 49152:eIMMNUYXFaHRKk0jJG1R9NGABKeNrEDEi8XbhNEVgs:ZlmKk0ZAhs
TLSH
T193A5E8E93881622AE523723CD12B5D09F374E431598D21E8BCDD64982D24FBD46FEDAC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

desktop.ini

Path C:\Users\Admin\AppData\Local\FiveM\FiveM.app\desktop.ini
Size 157B
SHA256 b1fe21f251cf7875783ea162ef86c2a5b5022a1c5157bbb7972b6b34e14ec08a
MD5 f9d948aa9426cb1a2a82e651b81a1912
SHA1 2d496caeef3b0bff6b91b99e58736cea51366348
SHA512 a962fae3853f43e4a8e2b33aa5f51a917673d76648845dffcc32037c25cb3f300e4c4fc3ea633bf78b714449dbda84416e41cc16256373c170fb82d8485e3369
TLSH
T14DC04C06818FC62DC42ED0BB1DA1A248CCBD0D2BAF6E7E04D6C0D50827D6F4FACA5685
MD5 SHA1 SHA512 TLSH

Submit Download

FiveM.exe

Path C:\Users\Admin\AppData\Local\FiveM\FiveM.exe
Size 5.0MB
SHA256 c31baa5af6919a2be8be2b19275d161fcc113ca936a905855bdeecf2cacc1ecb
MD5 9bc89d3b1400d2ec8db893bdc4db81c1
SHA1 f5e266a08a31ffb7e0b7be6d536d06d4ebc894b0
SHA512 fbe870cf6e1cc9040663cae11b7a82cac9e71c6ede0d1ea4cbdeb34f692dcd618d556801732b53d9010299fbf46ad04fb238051747d598825eb7f61c6b19c0c7
SSDEEP 49152:TOjPWIYgLg9GI35nZemOvAVDAIqNVB+VSavnAERUtnzrNKY3rNgMVBE5IouLTdaO:vGIVqvB+VvYxUCBaKcw0xCoBkdH92kr
TLSH
T11136AD5673A400E8D5B7D178CA968527E7B2BC061371CBDF02A0666A1F37BE16E3E710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FiveM.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\FiveM.lnk
Size 2KB
SHA256 0d0daf7d04748a8b743562d8db45881c81cf948e82551c3f1df43d22a034b7e0
MD5 0d19b186f5c5ff2b1747b1f94a33d1f3
SHA1 a2ed5408d06f01b54987cabaa16db9da7da4831a
SHA512 a8544c1549db95da7cff03ad575ce3e486a027b35deae600164bb9ac8ebf8e594bd85c60c99ebd3bf4abdacbdcfca9bc29c29386375a2277302cd400aa6cbec1
TLSH
T1FF41EE0289D75B60D3EAC47549FB72109A36BC61E3659B4F008081882961E01ACD6F9B
MD5 SHA1 SHA512 TLSH

Submit Download

desktop.ini

Path C:\Users\Admin\Videos\Captures\desktop.ini
Size 190B
SHA256 86d9f822aeb989755fac82929e8db369b3f5f04117ef96fd76e3d5f920a501d2
MD5 b0d27eaec71f1cd73b015f5ceeb15f9d
SHA1 62264f8b5c2f5034a1e4143df6e8c787165fbc2f
SHA512 7b5c9783a0a14b600b156825639d24cbbc000f5066c48ce9fecc195255603fc55129aaaca336d7ce6ad4e941d5492b756562f2c7a1d151fcfc2dabac76f3946c
TLSH
T11EC0121892F93224A1728D12BD7460119AB1F4217C16CA9D1380508F08A1601E631B53
MD5 SHA1 SHA512 TLSH