c31baa5af6919a2be8be2b19275d161fcc113ca936a905855bdeecf2cacc1ecb

Resubmissions

09/08/2026, 01:05

260809-bfnkjafp6v6

09/08/2026, 01:02

260809-bd13vagb546

Analysis

max time kernel
149s
max time network
133s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
09/08/2026, 01:02

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
FiveM.exe
Size 5.0MB
Sample260809-bd13vagb54
SHA256 c31baa5af6919a2be8be2b19275d161fcc113ca936a905855bdeecf2cacc1ecb
MD5 9bc89d3b1400d2ec8db893bdc4db81c1
SHA1 f5e266a08a31ffb7e0b7be6d536d06d4ebc894b0
SHA512 fbe870cf6e1cc9040663cae11b7a82cac9e71c6ede0d1ea4cbdeb34f692dcd618d556801732b53d9010299fbf46ad04fb238051747d598825eb7f61c6b19c0c7
SSDEEP 49152:TOjPWIYgLg9GI35nZemOvAVDAIqNVB+VSavnAERUtnzrNKY3rNgMVBE5IouLTdaO:vGIVqvB+VvYxUCBaKcw0xCoBkdH92kr
TLSH
T11136AD5673A400E8D5B7D178CA968527E7B2BC061371CBDF02A0666A1F37BE16E3E710
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

defense_evasion discovery

Malware Config

Signatures

Drops desktop.ini file(s) 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\FiveM\FiveM.app\desktop.ini	FiveM.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Executes dropped EXE 1 IoCs

pid	Process
5504	FiveM.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies Control Panel 1 IoCs

defense_evasion

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Control Panel\Colors	FiveM.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
5800	FiveM.exe
5800	FiveM.exe
5504	FiveM.exe
5504	FiveM.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
5504	FiveM.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
5504	FiveM.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 5800 wrote to memory of 5504	5800	FiveM.exe	89

C:\Users\Admin\AppData\Local\Temp\FiveM.exe
"C:\Users\Admin\AppData\Local\Temp\FiveM.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:5800
- C:\Users\Admin\AppData\Local\FiveM\FiveM.exe
  "C:\Users\Admin\AppData\Local\FiveM\FiveM.exe"
  2⤵
  - Drops desktop.ini file(s)
  - Executes dropped EXE
  - Modifies Control Panel
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  PID:5504

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.meta.tmp

Path C:\Users\Admin\AppData\Local\FiveM\FiveM.app\citizen\platform-2372\data\control\settings.meta.tmp
Size 37KB
SHA256 f9ae094812ce9fbd56b58dab7739451792aba8f56c5f21eee15ef96682b413a6
MD5 3656c6636cd9dbceaf83230c3c9a2be9
SHA1 989f27c6736a943fd4690091fed26f7c17e3c17f
SHA512 52bbb8f2b2d6183f30b908d9171a2ec8c2128bbce145b7af0095d4c199b1ec431d650ec4ed0b1b6cbc7bcc8d29da3285cdcc61368faa8c4e57b45315ced4e4ad
SSDEEP 384:Gs34QmZSgC5RHTiVfNSAvRSOxRlne8lISI11zHdlz9a8QSuF5MGsXZXgCoRKRyR8:D34QMfNSEWJvz39pjE4
TLSH
T1B803DA6C3A9D5F5A198880B71CF704C971AFECBA2FEA19941B25A13307C3E602376675
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.meta.tmp

Path C:\Users\Admin\AppData\Local\FiveM\FiveM.app\citizen\platform-3095\data\control\settings.meta.tmp
Size 39KB
SHA256 71ad5591441d62d02d2b62155abcf2cab587af49b86e2db5be6729a5b39df5d1
MD5 619814b8b98007c1698576b7e4efb3ec
SHA1 e60f3ceaf5ca78f74e6867f0b042951bffb91786
SHA512 55ab0bd3c1750d63ad3304e63b7c26251f01c8994f385e5643e2bbd37fc6595fd0e9f5fc0d76aa655fe8ad3bc6fdee33248d9f4a76cce11a25d84c3f5de16236
SSDEEP 384:Gs34QSSgC5RHTiVfF3AvRSOxRlne8lY7Sf11zHdlz9a8NSuFsMysXZXgCoRKRyR7:D34QOfF3E6qvz3NpcE4
TLSH
T17803CA2C3A9D5F56198880B71CF704C971AFECBA2FEA19941B25E03307C3E602376675
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

natives_universal.lua.tmp

Path C:\Users\Admin\AppData\Local\FiveM\FiveM.app\citizen\scripting\lua\natives_universal.lua.tmp
Size 2.0MB
SHA256 de11a2b8c358f670870849ec20602938f32216c7c68b98dd9a10a0f381b2ddd9
MD5 0b086870cb47cd0d818099da7607a872
SHA1 7f0ff7cf7f462c45d72f7494dcf8b72ce47997cb
SHA512 a74693b672f8dfe9110fd6c1eb6c35c9105e4eee56398d59c33432944adc8e0987d2ff1873a392fc1585938c0ff18ff275821cbcca2715bf7c61e734f5706424
SSDEEP 49152:JNbJqV8HyrbVWFY45oFz7hpp0ZcM+aeHBqkAxZhXMBvFZGh:Ig9FY45cuh
TLSH
T1509509DA781ED3559543632A511F194BF269C0A8212D01F0F185B8DE2432FB96BFF8FA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

natives_universal.d.ts.tmp

Path C:\Users\Admin\AppData\Local\FiveM\FiveM.app\citizen\scripting\v8\natives_universal.d.ts.tmp
Size 2.3MB
SHA256 52499390f5fc1a91165b4b8980b0c7c3fb3798d1db71499892e9eaa1319f56c3
MD5 b6c23a02770b32f213c2595ef5c0ae1c
SHA1 1b34f25141e2ac2aa326a7ab77ba04e100de4ff8
SHA512 d2ed9c3aed79d6be37887a19d94d815c4a004c1a54d2c0bdc66732cd9f67b39d2cc754891f328d7b0f974fb9886da2cc76d582a74a2e47b738cc0c1ab913995f
SSDEEP 49152:kO4NUH1AeYZJkIx1H9AAH2HD7lcmu6DjBvdnrD:kO4K4JkI2AkD
TLSH
T10CB5969AFF493233E6B29232B0BF5048E9746258A91131DF7CF464540F1B2BC26A7D9D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

natives_universal.js.tmp

Path C:\Users\Admin\AppData\Local\FiveM\FiveM.app\citizen\scripting\v8\natives_universal.js.tmp
Size 2.1MB
SHA256 02e08cc92e39910f68356f73946acdfa462f270fa3bf541dedbd4b64713dbf5d
MD5 9949bda20f33c3e4598e8ef24c735bb6
SHA1 3982a1cdf3a16be944fcae8c349e0835b23b1757
SHA512 e53400c828f00eac8dda8d2ebe393f813405a735d4406a60987ebbcf13959518977c52f3fb6790c756b3826bde2281344c12adac163b94f8698bd49353af034a
SSDEEP 49152:eIMMNUYXFaHRKk0jJG1R9NGABKeNrEDEi8XbhNEVgs:ZlmKk0ZAhs
TLSH
T193A5E8E93881622AE523723CD12B5D09F374E431598D21E8BCDD64982D24FBD46FEDAC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FiveM.exe

Path C:\Users\Admin\AppData\Local\FiveM\FiveM.exe
Size 5.0MB
SHA256 c31baa5af6919a2be8be2b19275d161fcc113ca936a905855bdeecf2cacc1ecb
MD5 9bc89d3b1400d2ec8db893bdc4db81c1
SHA1 f5e266a08a31ffb7e0b7be6d536d06d4ebc894b0
SHA512 fbe870cf6e1cc9040663cae11b7a82cac9e71c6ede0d1ea4cbdeb34f692dcd618d556801732b53d9010299fbf46ad04fb238051747d598825eb7f61c6b19c0c7
SSDEEP 49152:TOjPWIYgLg9GI35nZemOvAVDAIqNVB+VSavnAERUtnzrNKY3rNgMVBE5IouLTdaO:vGIVqvB+VvYxUCBaKcw0xCoBkdH92kr
TLSH
T11136AD5673A400E8D5B7D178CA968527E7B2BC061371CBDF02A0666A1F37BE16E3E710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FiveM.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\FiveM.lnk
Size 2KB
SHA256 df4e341fa898339260aa52510c3818036ea4d2ca34adfdeec51084e7c8a45c40
MD5 2112fdaa15416aa441ad77fcbc128f4b
SHA1 4c9e8b394456c1581baedb3a2764a2b863c7897b
SHA512 6feba1f01296f29cefeb54174218cc0b9a02eb91bde7ac4852aae31f3d4e7f4bef8fa779b1107c3a42019a9be81679894e443c1bad2f3fa4b2f24fd38058aa04
TLSH
T1C941F00389EA4B20D3FAC9B554F6B2514A72BC91FB65CF0E4050C2882E51E21D891F4B
MD5 SHA1 SHA512 TLSH