Overview

overview

9

Static

static

3

GameOverlay.exe

windows10-2004-x64

9

GameOverlay.exe

windows11-ltsc_2024-x64

9

Analysis

  • max time kernel
    148s
  • max time network
    132s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    10/09/2026, 07:30

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    GameOverlay.exe
  • Size 510KB
  • Sample260910-jbxxeazejf
  • SHA256 be5e306c720b1aee66f0657e11b9f9d2d43e97a75004dd7727d588883df8962f
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
defense_evasiondiscoveryexecutionpersistenceprivilege_escalationransomware

Malware Config

Signatures

  • Clears Windows event logs 1 TTPs 2 IoCs
    defense_evasionransomware
  • Creates a file in the Startup directory 1 TTPs 1 IoCs

    A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

    persistenceprivilege_escalation
  • Executes dropped EXE 2 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Looks up external IP address via web service 1 TTPs 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery
  • Maps connected drives based on registry 3 TTPs 2 IoCs

    Disk information is often read in order to detect sandboxing environments.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Executes a command shell one-liner 1 TTPs 2 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

    execution
  • Suspicious behavior: EnumeratesProcesses 8 IoCs
  • Suspicious use of AdjustPrivilegeToken 9 IoCs
  • Suspicious use of WriteProcessMemory 12 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Users\Admin\AppData\Local\Temp\GameOverlay.exe
    "C:\Users\Admin\AppData\Local\Temp\GameOverlay.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:3124
    • C:\Users\Admin\AppData\Local\Temp\hdxrah2x.5ee.exe
      "C:\Users\Admin\AppData\Local\Temp\hdxrah2x.5ee.exe"
      2⤵
      • Creates a file in the Startup directory
      • Executes dropped EXE
      • Adds Run key to start application
      • Maps connected drives based on registry
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:3932
      • C:\Windows\SYSTEM32\wevtutil.exe
        "wevtutil" epl System "C:\Users\Admin\AppData\Local\Temp\evtsys.evtx"
        3⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:5708
      • C:\Windows\SYSTEM32\wevtutil.exe
        "wevtutil" cl System
        3⤵
        • Clears Windows event logs
        • Suspicious use of AdjustPrivilegeToken
        PID:2840
      • C:\Windows\SYSTEM32\wevtutil.exe
        "wevtutil" epl Security "C:\Users\Admin\AppData\Local\Temp\evtsec.evtx"
        3⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:4832
      • C:\Windows\SYSTEM32\wevtutil.exe
        "wevtutil" cl Security
        3⤵
        • Clears Windows event logs
        • Suspicious use of AdjustPrivilegeToken
        PID:3448
      • C:\Windows\SYSTEM32\fsutil.exe
        "fsutil" usn deletejournal /D "C:\Users\Admin\AppData\Local\Temp"
        3⤵
          PID:2324
        • C:\Windows\SYSTEM32\fsutil.exe
          "fsutil" usn deletejournal /D "C:\Users\Admin\AppData\Roaming"
          3⤵
            PID:4840
          • C:\Windows\SYSTEM32\cmd.exe
            "cmd.exe" /c reg add "HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Memory Management\PrefetchParameters" /v ExePrefetchList /t REG_MULTI_SZ /d "hdxrah2x.5ee.exe" /f
            3⤵
            • Executes a command shell one-liner
            • Suspicious use of WriteProcessMemory
            PID:2412
            • C:\Windows\system32\reg.exe
              reg add "HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Memory Management\PrefetchParameters" /v ExePrefetchList /t REG_MULTI_SZ /d "hdxrah2x.5ee.exe" /f
              4⤵
                PID:4992
            • C:\Windows\SYSTEM32\cmd.exe
              "cmd.exe" /c reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows\System" /v EnableSmartScreen /t REG_DWORD /d 0 /f
              3⤵
              • Executes a command shell one-liner
              • Suspicious use of WriteProcessMemory
              PID:1672
              • C:\Windows\system32\reg.exe
                reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows\System" /v EnableSmartScreen /t REG_DWORD /d 0 /f
                4⤵
                  PID:724
              • C:\Windows\SYSTEM32\schtasks.exe
                "schtasks" /delete /tn "GameBarWatchdog" /f
                3⤵
                  PID:1104
            • C:\Users\Admin\AppData\Local\Temp\GameBarSync.exe
              "C:\Users\Admin\AppData\Local\Temp\GameBarSync.exe"
              1⤵
              • Executes dropped EXE
              PID:4168

            Network

                  MITRE ATT&CK Enterprise v16

                  Replay Monitor

                  Loading Replay Monitor...

                  Downloads

                  hdxrah2x.5ee.exe
                  • Path C:\Users\Admin\AppData\Local\Temp\hdxrah2x.5ee.exe
                  • Size 942KB
                  • SHA256 3babcc98f3b1b94395fcd03af925a902382f78c6a6b66d1b8097d787f10428b9
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download