Resubmissions
26/09/2026, 02:57
260926-dfsklasgrd624/09/2026, 04:10
260924-erc5qaydqh24/08/2026, 22:26
260824-2cxl5sfc775Analysis
- user interaction
yes - max time kernel
150s - max time network
132s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
- submitted
26/09/2026, 02:57
General
- Target GameSir-Connect-Setup-1.11.1.exe
- Size 125.0MB
- Sample260926-dfsklasgrd
- SHA256 b4b5750c7fb6c07f498049b94a1fb31c0e636564cea25771f31fc375cedfeab9
Malware Config
Signatures
- Enumerates connected drives 3 TTPs 1 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Executes dropped EXE 5 IoCs
- Loads dropped DLL 33 IoCs
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Using powershell.exe command.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 1 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
- Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
- System Location Discovery: System Language Discovery 1 TTPs 8 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Checks processor information in registry 2 TTPs 24 IoCs
Processor information is often read in order to detect sandboxing environments.
- Suspicious behavior: EnumeratesProcesses 15 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of WriteProcessMemory 6 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\GameSir-Connect-Setup-1.11.1.exe"C:\Users\Admin\AppData\Local\Temp\GameSir-Connect-Setup-1.11.1.exe"1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Programs\GameSir Connect\GameSir Connect.exe"C:\Users\Admin\AppData\Local\Programs\GameSir Connect\GameSir Connect.exe"1⤵
- Executes dropped EXE
- Loads dropped DLL
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Programs\GameSir Connect\GameSir Connect.exe"C:\Users\Admin\AppData\Local\Programs\GameSir Connect\GameSir Connect.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Roaming\gamesir_connect /prefetch:7 --no-rate-limit --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Roaming\gamesir_connect\Crashpad --annotation=_productName=gamesir_connect --annotation=_version=1.11.1 --annotation=prod=Electron --annotation=ver=13.6.9 --initial-client-data=0x4e8,0x4ec,0x4f0,0x4e0,0x48c,0x6f99820,0x6f99830,0x6f9983c2⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\AppData\Local\Programs\GameSir Connect\GameSir Connect.exe"C:\Users\Admin\AppData\Local\Programs\GameSir Connect\GameSir Connect.exe" --type=gpu-process --field-trial-handle=1724,10048512968817967241,9820386411379013779,131072 --disable-features=CookiesWithoutSameSiteMustBeSecure,SameSiteByDefaultCookies,SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1736 /prefetch:22⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\AppData\Local\Programs\GameSir Connect\GameSir Connect.exe"C:\Users\Admin\AppData\Local\Programs\GameSir Connect\GameSir Connect.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1724,10048512968817967241,9820386411379013779,131072 --disable-features=CookiesWithoutSameSiteMustBeSecure,SameSiteByDefaultCookies,SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand --lang=en-US --service-sandbox-type=none --standard-schemes=app --secure-schemes=app --bypasscsp-schemes --cors-schemes --fetch-schemes=app --service-worker-schemes --streaming-schemes --mojo-platform-channel-handle=1952 /prefetch:82⤵
- Executes dropped EXE
- Loads dropped DLL
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Users\Admin\AppData\Local\Programs\GameSir Connect\GameSir Connect.exe"C:\Users\Admin\AppData\Local\Programs\GameSir Connect\GameSir Connect.exe" --type=renderer --field-trial-handle=1724,10048512968817967241,9820386411379013779,131072 --disable-features=CookiesWithoutSameSiteMustBeSecure,SameSiteByDefaultCookies,SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand --lang=en-US --standard-schemes=app --secure-schemes=app --bypasscsp-schemes --cors-schemes --fetch-schemes=app --service-worker-schemes --streaming-schemes --app-path="C:\Users\Admin\AppData\Local\Programs\GameSir Connect\resources\app.asar" --no-sandbox --no-zygote --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=4 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2424 /prefetch:12⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "powershell -command "Get-WmiObject Win32_LogicalDisk | Where-Object { $_.DriveType -eq 2 } | Select-Object -ExpandProperty DeviceID""2⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -command "Get-WmiObject Win32_LogicalDisk | Where-Object { $_.DriveType -eq 2 } | Select-Object -ExpandProperty DeviceID"3⤵
- Enumerates connected drives
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
Network
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
2PowerShell
1Windows Command Shell
1Replay Monitor
Loading Replay Monitor...
Downloads
ffmpeg.dll
icudtl.dat
bindings.js
package.json
package.json
debug.js
index.js
node.js
test.props
test.targets
test.xml
ffitarget.h
ffi.h
bindings.js
ffi.js
package.json
index.js
package.json
index.js
package.json
index.js
node-gyp-build.js
package.json
hidapi.lib.recipe
046D_C534_0001_FF00_expected.rpt_desc
046D_C534_0002_FF00_expected.rpt_desc
nodehid.js
package.json
.forge-meta
binding.node
ref.js
package.json
common.js
index.js
node.js
index.js
license.md
package.json
package.json
code-of-conduct.md
struct.js
LICENSE
node.js
package.json
LICENSE
binding.lib
binding.vcxproj.filters
compile.js
gh-pages.sh
apple-touch-icon-114x114.png
apple-touch-icon-72x72.png
apple-touch-icon.png
favicon.ico
ref.pxm
index.jade
main.js
base.css
layout.css
skeleton.css
ref.js
package.json
browser.js
common.js
index.js
node.js
electron.napi.node
v8_context_snapshot.bin
52f104dd-5149-4d0d-baca-0e8de1d52bc3.tmp.node
StdUtils.dll
System.dll
UAC.dll
WinShell.dll
nsDialogs.dll
nsProcess.dll
nsis7z.dll
default.exc
settings.dat
main.log
memory/5840-2421-0x0000000005B30000-0x000000000617A000-memory.dmp
memory/5840-2422-0x0000000006280000-0x00000000062A2000-memory.dmp
memory/5840-2423-0x0000000006320000-0x0000000006386000-memory.dmp
memory/5840-2424-0x0000000006390000-0x00000000063F6000-memory.dmp
memory/5840-2427-0x0000000006400000-0x000000000675B000-memory.dmp
memory/5840-2428-0x0000000006910000-0x000000000692E000-memory.dmp
memory/5840-2429-0x0000000006950000-0x000000000699C000-memory.dmp
memory/5840-2420-0x0000000003410000-0x0000000003446000-memory.dmp
memory/5840-2440-0x00000000078D0000-0x0000000007966000-memory.dmp
memory/5840-2442-0x0000000006EA0000-0x0000000006EC2000-memory.dmp
memory/5840-2441-0x0000000006E50000-0x0000000006E6A000-memory.dmp
memory/5840-2443-0x0000000007F90000-0x000000000854A000-memory.dmp
memory/5840-2444-0x0000000008BD0000-0x000000000924C000-memory.dmp