Analysis

  • max time kernel
    148s
  • max time network
    149s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    04/08/2026, 02:38

General

  • Target
    e4883e590993c0e71ab6da06f8fb8d098871fd16e2a7b10e81fe2690f04b8eeb.exe
  • Size 3.8MB
  • Sample260804-c48faaep6x
  • SHA256 e4883e590993c0e71ab6da06f8fb8d098871fd16e2a7b10e81fe2690f04b8eeb
  • MD5 SHA1 SHA512 SSDEEP TLSH

Malware Config

Signatures

  • Executes dropped EXE 10 IoCs
  • Loads dropped DLL 31 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • HTTP links in PDF interactive object 1 IoCs

    Detects HTTP links in interactive objects within PDF files.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 11 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Modifies registry class 9 IoCs
  • Suspicious behavior: EnumeratesProcesses 56 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SendNotifyMessage 1 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 11 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\e4883e590993c0e71ab6da06f8fb8d098871fd16e2a7b10e81fe2690f04b8eeb.exe
    "C:\Users\Admin\AppData\Local\Temp\e4883e590993c0e71ab6da06f8fb8d098871fd16e2a7b10e81fe2690f04b8eeb.exe"
    1⤵
    • Adds Run key to start application
    • System Location Discovery: System Language Discovery
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:908
    • C:\Users\Admin\AppData\Local\Gtarcade\app\GTARCADE.EXE
      "C:\Users\Admin\AppData\Local\Gtarcade\app\GTARCADE.EXE" /flag=e4883e590993c0e71ab6da06f8fb8d098871fd16e2a7b10e81fe2690f04b8eeb /user_frome=0 /start_from=1
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      PID:5424
  • C:\Users\Admin\AppData\Local\Gtarcade\app\Gtarcade.exe
    "C:\Users\Admin\AppData\Local\Gtarcade\app\gtarcade.exe" /auto_start=1
    1⤵
    • Executes dropped EXE
    • Loads dropped DLL
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:1596
    • C:\Users\Admin\AppData\Local\Gtarcade\app\GTaCrashHandler.exe
      "C:\Users\Admin\AppData\Local\Gtarcade\app\GTaCrashHandler.exe" /log_path="C:\Users\Admin\AppData\Local\Gtarcade\app\log\20260804034021128\ "
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      PID:5976
    • C:\Users\Admin\AppData\Local\Gtarcade\app\gamehall\GTarExternal.exe
      "C:\Users\Admin\AppData\Local\Gtarcade\app\gamehall\GTarExternal.exe" --start-from-gtarapp=3.1.15.4046
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:6044
      • C:\Users\Admin\AppData\Local\Gtarcade\app\gamehall\GTarExternal.exe
        "C:\Users\Admin\AppData\Local\Gtarcade\app\gamehall\GTarExternal.exe" --type=gpu-process --field-trial-handle=1616,7598968450020936580,14037576102871771193,131072 --enable-features=CastMediaRouteProvider --disable-features=OutOfBlinkCors --log-file="C:\Users\Admin\AppData\Local\Gtarcade\app\gamehall\debug.log" --user-agent="Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/84.0.4147.105 Safari/537.36 gtarcade/1.0 webpage QtWebEngine ver/3.1.15.4046" --lang=en-US --gpu-preferences=MAAAAAAAAADgACAwAAAAAAAAAAAAAAAAAABgAAAAAAAQAAAAAAAAAAAAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAA= --log-file="C:\Users\Admin\AppData\Local\Gtarcade\app\gamehall\debug.log" --mojo-platform-channel-handle=1632 /prefetch:2
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        PID:3200
      • C:\Users\Admin\AppData\Local\Gtarcade\app\gamehall\GTarExternal.exe
        "C:\Users\Admin\AppData\Local\Gtarcade\app\gamehall\GTarExternal.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1616,7598968450020936580,14037576102871771193,131072 --enable-features=CastMediaRouteProvider --disable-features=OutOfBlinkCors --lang=en-US --service-sandbox-type=network --log-file="C:\Users\Admin\AppData\Local\Gtarcade\app\gamehall\debug.log" --user-agent="Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/84.0.4147.105 Safari/537.36 gtarcade/1.0 webpage QtWebEngine ver/3.1.15.4046" --lang=en-US --log-file="C:\Users\Admin\AppData\Local\Gtarcade\app\gamehall\debug.log" --mojo-platform-channel-handle=2224 /prefetch:8
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        PID:5736
      • C:\Users\Admin\AppData\Local\Gtarcade\app\gamehall\GTarExternal.exe
        "C:\Users\Admin\AppData\Local\Gtarcade\app\gamehall\GTarExternal.exe" --type=renderer --js-flags=--expose-wasm --log-file="C:\Users\Admin\AppData\Local\Gtarcade\app\gamehall\debug.log" --field-trial-handle=1616,7598968450020936580,14037576102871771193,131072 --enable-features=CastMediaRouteProvider --disable-features=OutOfBlinkCors --lang=en-US --log-file="C:\Users\Admin\AppData\Local\Gtarcade\app\gamehall\debug.log" --user-agent="Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/84.0.4147.105 Safari/537.36 gtarcade/1.0 webpage QtWebEngine ver/3.1.15.4046" --ppapi-flash-path=./pepflashplayer.dll --ppapi-flash-version=99.0.0.999 --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2596 /prefetch:1
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        PID:5152
      • C:\Users\Admin\AppData\Local\Gtarcade\app\gamehall\GTarExternal.exe
        "C:\Users\Admin\AppData\Local\Gtarcade\app\gamehall\GTarExternal.exe" --type=renderer --js-flags=--expose-wasm --log-file="C:\Users\Admin\AppData\Local\Gtarcade\app\gamehall\debug.log" --field-trial-handle=1616,7598968450020936580,14037576102871771193,131072 --enable-features=CastMediaRouteProvider --disable-features=OutOfBlinkCors --lang=en-US --log-file="C:\Users\Admin\AppData\Local\Gtarcade\app\gamehall\debug.log" --user-agent="Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/84.0.4147.105 Safari/537.36 gtarcade/1.0 webpage QtWebEngine ver/3.1.15.4046" --ppapi-flash-path=./pepflashplayer.dll --ppapi-flash-version=99.0.0.999 --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=4 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2604 /prefetch:1
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        PID:456
    • C:\Users\Admin\AppData\Local\Gtarcade\app\gtarcadehelper.exe
      "C:\Users\Admin\AppData\Local\Gtarcade\app\gtarcadehelper.exe" /action=start-from-gtar
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      PID:5524
    • C:\Users\Admin\AppData\Local\Gtarcade\app\GTarBugReport.exe
      "C:\Users\Admin\AppData\Local\Gtarcade\app\GTarBugReport.exe" /prod=gtar_report
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      PID:5224

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        DuiLib.dll

        • Path C:\Users\Admin\AppData\Local\Gtarcade\app\DuiLib.dll
        • Size 1.9MB
        • SHA256 dc85b82539542b8c44751eb41e1946184296ccca216f082fb71693d107f13cf0
        • MD5 SHA1 SHA512 SSDEEP TLSH

        GTaCrashHandler.exe

        • Path C:\Users\Admin\AppData\Local\Gtarcade\app\GTaCrashHandler.exe
        • Size 875KB
        • SHA256 09625a1dc168f7909b8446fd39860d2456ba658b090e9fe9cceb126dd40fc309
        • MD5 SHA1 SHA512 SSDEEP TLSH

        GTarBugReport.exe

        • Path C:\Users\Admin\AppData\Local\Gtarcade\app\GTarBugReport.exe
        • Size 2.4MB
        • SHA256 acc2c9330f5ed4f991caf0b18a85e32c8a5b1768492d533e493d42395fc0280c
        • MD5 SHA1 SHA512 SSDEEP TLSH

        Gtarcade.exe

        • Path C:\Users\Admin\AppData\Local\Gtarcade\app\Gtarcade.exe
        • Size 5.7MB
        • SHA256 ce0d1baabf7c206dfdd1b781b0a1e5a1cc1ab9d01663da3142f5cb3deccf28e1
        • MD5 SHA1 SHA512 SSDEEP TLSH

        IPC.dll

        • Path C:\Users\Admin\AppData\Local\Gtarcade\app\IPC.dll
        • Size 201KB
        • SHA256 b93423a365d31f9fe46dca20a3e82702af5f14b03d8274a5073723db0f97413d
        • MD5 SHA1 SHA512 SSDEEP TLSH

        game.json

        • Path C:\Users\Admin\AppData\Local\Gtarcade\app\gamedata\game.json
        • Size 9KB
        • SHA256 008160d6ea3fb41b73c8dc8fdad0b673f6f6aef4b0aebc05bed494f9c0680fc3
        • MD5 SHA1 SHA512 SSDEEP TLSH

        D3DCompiler_47.dll

        • Path C:\Users\Admin\AppData\Local\Gtarcade\app\gamehall\D3DCompiler_47.dll
        • Size 3.5MB
        • SHA256 ad201409104b124a6951e345f9e214750b3e718082860f80fc88a89fcb076f0e
        • MD5 SHA1 SHA512 SSDEEP TLSH

        GTarExternal.exe

        • Path C:\Users\Admin\AppData\Local\Gtarcade\app\gamehall\GTarExternal.exe
        • Size 2.5MB
        • SHA256 9b663b89bd75610e772c8b9db0bb363111ef3a29166db80aef8e7c8ab7534156
        • MD5 SHA1 SHA512 SSDEEP TLSH

        IPC.dll

        • Path C:\Users\Admin\AppData\Local\Gtarcade\app\gamehall\IPC.dll
        • Size 185KB
        • SHA256 646055f5d37b7f9a2e116060439ea3eff057f91a7b4b73cc017528913014c9ca
        • MD5 SHA1 SHA512 SSDEEP TLSH

        cef.pak

        • Path C:\Users\Admin\AppData\Local\Gtarcade\app\gamehall\cef.pak
        • Size 1.9MB
        • SHA256 a047bff373d5b24aecdcd2439b2ea3ce5394cefde15cbd3899d67fba745326b1
        • MD5 SHA1 SHA512 SSDEEP TLSH

        cef_100_percent.pak

        • Path C:\Users\Admin\AppData\Local\Gtarcade\app\gamehall\cef_100_percent.pak
        • Size 262KB
        • SHA256 2c0b60f8cfd3fd1a09e0baae6954f3eb424b161ba85d8a6878bfa51547a03426
        • MD5 SHA1 SHA512 SSDEEP TLSH

        cef_200_percent.pak

        • Path C:\Users\Admin\AppData\Local\Gtarcade\app\gamehall\cef_200_percent.pak
        • Size 413KB
        • SHA256 6662f758bfd2ce4680d06722e2ede8e783be61aa52a9c74b52a2bc4670f9fbef
        • MD5 SHA1 SHA512 SSDEEP TLSH

        cef_extensions.pak

        • Path C:\Users\Admin\AppData\Local\Gtarcade\app\gamehall\cef_extensions.pak
        • Size 1.2MB
        • SHA256 68b7fbd023fc2fcdab826205d4d9cdb4933e7a8f6d1836b865f1d8c9d25ec074
        • MD5 SHA1 SHA512 SSDEEP TLSH

        chrome_elf.dll

        • Path C:\Users\Admin\AppData\Local\Gtarcade\app\gamehall\chrome_elf.dll
        • Size 815KB
        • SHA256 2909c5bd223a0f06a4777d240c7c750e95f64dc28be484e8f92f1e2216961982
        • MD5 SHA1 SHA512 SSDEEP TLSH

        devtools_resources.pak

        • Path C:\Users\Admin\AppData\Local\Gtarcade\app\gamehall\devtools_resources.pak
        • Size 1.5MB
        • SHA256 ec4ce93b18d5b5ca241c9a2ad60ef9653704af427c2cba2a29a25abc690aad54
        • MD5 SHA1 SHA512 SSDEEP TLSH

        icudtl.dat

        • Path C:\Users\Admin\AppData\Local\Gtarcade\app\gamehall\icudtl.dat
        • Size 10.0MB
        • SHA256 e9933d8b99df96b95f87d4562b86cefa645f4989dd190a0e9af41a2832c6c94b
        • MD5 SHA1 SHA512 SSDEEP TLSH

        en-US.pak

        • Path C:\Users\Admin\AppData\Local\Gtarcade\app\gamehall\locales\en-US.pak
        • Size 219KB
        • SHA256 a1b32c76020578bea103c9e04b74ce97ecb76ee467fbb554d29b24209c05fdae
        • MD5 SHA1 SHA512 SSDEEP TLSH

        libEGL.dll

        • Path C:\Users\Admin\AppData\Local\Gtarcade\app\gamehall\swiftshader\libEGL.dll
        • Size 344KB
        • SHA256 63ad61e6a97c502319d02455019a90f0f89d3ea0efb07f0f6ec96a6bad97a8eb
        • MD5 SHA1 SHA512 SSDEEP TLSH

        libglesv2.dll

        • Path C:\Users\Admin\AppData\Local\Gtarcade\app\gamehall\swiftshader\libglesv2.dll
        • Size 2.9MB
        • SHA256 a0dee0edad20411799b1422727898a32a5bb897287c69cb091235abcba792527
        • MD5 SHA1 SHA512 SSDEEP TLSH

        v8_context_snapshot.bin

        • Path C:\Users\Admin\AppData\Local\Gtarcade\app\gamehall\v8_context_snapshot.bin
        • Size 166KB
        • SHA256 a87c32c2e01994be8685b3c8fff7e37febcb4f88af7cd10db28cafd482626cd2
        • MD5 SHA1 SHA512 SSDEEP TLSH

        gtarcade.ini

        • Path C:\Users\Admin\AppData\Local\Gtarcade\app\gtarcade.ini
        • Size 66B
        • SHA256 2aeef2b69508ccd16ac81e2b849371b32d47d771226ee413b77a35532fbb62c7
        • MD5 SHA1 SHA512 TLSH

        gtarcade.xml

        • Path C:\Users\Admin\AppData\Local\Gtarcade\app\gtarcade.xml
        • Size 20KB
        • SHA256 7ca860dc9b12b2ecd79c7e7aaa2de5f140356230d0ae3d03176c565ddc83c691
        • MD5 SHA1 SHA512 SSDEEP TLSH

        gtarcadehelper.exe

        • Path C:\Users\Admin\AppData\Local\Gtarcade\app\gtarcadehelper.exe
        • Size 1.1MB
        • SHA256 37a6de5f0f8b2178af4650b7d9cbf46edc8f31a64e879b795a39f369f6f373ec
        • MD5 SHA1 SHA512 SSDEEP TLSH

        libcrypto-1_1.dll

        • Path C:\Users\Admin\AppData\Local\Gtarcade\app\libcrypto-1_1.dll
        • Size 2.5MB
        • SHA256 fd787bd2b29d653718e8a25a1de24ad2c47372cdc9dd5e937deaafda2c08edb2
        • MD5 SHA1 SHA512 SSDEEP TLSH

        libssl-1_1.dll

        • Path C:\Users\Admin\AppData\Local\Gtarcade\app\libssl-1_1.dll
        • Size 879KB
        • SHA256 2dda6058c99197e94bf2000ae434d77f9e01be6a09455e757e746dba5604f51f
        • MD5 SHA1 SHA512 SSDEEP TLSH

        log4cplus.dll

        • Path C:\Users\Admin\AppData\Local\Gtarcade\app\log4cplus.dll
        • Size 558KB
        • SHA256 20a49d013f560d3c090d784adffd14ba01b1358407c359cbe676d019c3cf975d
        • MD5 SHA1 SHA512 SSDEEP TLSH

        000001.dbtmp

        • Path C:\Users\Admin\AppData\Local\Gtarcade\cache\game\000001.dbtmp
        • Size 16B
        • SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
        • MD5 SHA1 SHA512

        the-real-index

        • Path C:\Users\Admin\AppData\Local\Gtarcade\cache\game\Code Cache\js\index-dir\the-real-index
        • Size 288B
        • SHA256 e09e46ca93ec2c4bcf43d54871e7af0e357fb713fea7e8a30ce5233575c63685
        • MD5 SHA1 SHA512 TLSH

        the-real-index~RFe5a7001.TMP

        • Path C:\Users\Admin\AppData\Local\Gtarcade\cache\game\Code Cache\js\index-dir\the-real-index~RFe5a7001.TMP
        • Size 48B
        • SHA256 7d436912583aa02b01acecdf73c42280389169ca49a96eb4a75f7b954e73d37b
        • MD5 SHA1 SHA512

        TransportSecurity

        • Path C:\Users\Admin\AppData\Local\Gtarcade\cache\game\TransportSecurity
        • Size 212B
        • SHA256 298888dd94acf1d13a942952e4f8bb4c1ee674d9294b4398f78ff9967ed053e2
        • MD5 SHA1 SHA512 TLSH

        TransportSecurity~RFe5a8473.TMP

        • Path C:\Users\Admin\AppData\Local\Gtarcade\cache\game\TransportSecurity~RFe5a8473.TMP
        • Size 212B
        • SHA256 0455fadd4eea2ce5768ff655eb6b916e6b6e3a36c851c82fa0d3193487f91552
        • MD5 SHA1 SHA512 TLSH

        config.ini

        • Path C:\Users\Admin\AppData\Local\Gtarcade\config.ini
        • Size 100B
        • SHA256 ddcf7ef34059460190b64b408c93551919940e380ec26b8c829e0feb1f5ab034
        • MD5 SHA1 SHA512 TLSH

        config.ini

        • Path C:\Users\Admin\AppData\Local\Gtarcade\config.ini
        • Size 74B
        • SHA256 0a19534345cafebe58cae4b0454fc1e6b459b8d242b4a9c8281af5ab7471e319
        • MD5 SHA1 SHA512 TLSH