Analysis
- max time kernel
148s - max time network
148s - platform
windows10-2004_x64 - resource
win10v2004-20260911-en - resource tags
- submitted
14/11/2026, 10:51
General
- Target GTA V.exe
- Size 246KB
- Sample261114-mxtnnafy41
- SHA256 3f0c1313bac92a2e20966ff0819ad0d59da93dea23e6d946713bd82367db066c
Malware Config
Extracted
-
stealc
-
GitGatHap
-
http://37.59.205.8
Signatures
- Family: Stealc
Stealc is an infostealer written in C++.
- Detects Stealc stealer Version 3 16 IoCs
- Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
- Looks up external IP address via web service 1 TTPs 3 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
- Modifies Internet Explorer settings 1 TTPs 1 IoCs
- Suspicious behavior: EnumeratesProcesses 55 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of SetWindowsHookEx 2 IoCs
- Suspicious use of WriteProcessMemory 13 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\GTA V.exe"C:\Users\Admin\AppData\Local\Temp\GTA V.exe"1⤵
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\data\bin\python.exe"data\bin\python.exe" - "data\bin\blen.blend"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\explorer.exe"C:\Windows\explorer.exe"3⤵
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe"4⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"4⤵
-
-
-
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
100F2CE9-D3B2-F955-5661-DA0D3E598245.txt
100F2CE9-D3B2-F955-5661-DA0D3E598245.txt
ms_log.txt
memory/2040-81-0x000002B1F2850000-0x000002B1F3EC7000-memory.dmp
memory/2040-79-0x000002B1F2850000-0x000002B1F3EC7000-memory.dmp
memory/2040-5-0x000002B1EE000000-0x000002B1EE00E000-memory.dmp
memory/2040-6-0x000002B1F0310000-0x000002B1F0354000-memory.dmp
memory/2040-8-0x000002B1F0040000-0x000002B1F0050000-memory.dmp
memory/2040-9-0x000002B1F0040000-0x000002B1F0050000-memory.dmp
memory/2040-12-0x000002B9F5730000-0x000002B9F5ED6000-memory.dmp
memory/2040-86-0x000002B1F2850000-0x000002B1F3EC7000-memory.dmp
memory/2040-84-0x000002B1F2850000-0x000002B1F3EC7000-memory.dmp
memory/2040-83-0x000002B1F2850000-0x000002B1F3EC7000-memory.dmp
memory/2040-82-0x000002B1F2850000-0x000002B1F3EC7000-memory.dmp
memory/2040-3-0x000002B1F01B0000-0x000002B1F030A000-memory.dmp
memory/2040-80-0x000002B1F2850000-0x000002B1F3EC7000-memory.dmp
memory/2040-4-0x000002B1EFFC0000-0x000002B1EFFF0000-memory.dmp
memory/2040-78-0x000002B1F2850000-0x000002B1F3EC7000-memory.dmp
memory/2040-77-0x000002B1F2850000-0x000002B1F3EC7000-memory.dmp
memory/2040-76-0x000002B1F2850000-0x000002B1F3EC7000-memory.dmp
memory/2040-75-0x000002B1F2850000-0x000002B1F3EC7000-memory.dmp
memory/2040-74-0x000002B1F2850000-0x000002B1F3EC7000-memory.dmp
memory/2040-0-0x000002B1EDB60000-0x000002B1EDB9E000-memory.dmp
memory/2040-73-0x000002B1F0040000-0x000002B1F0050000-memory.dmp
memory/2040-70-0x000002B1F2850000-0x000002B1F3EC7000-memory.dmp
memory/2040-71-0x000002B1F0040000-0x000002B1F0050000-memory.dmp
memory/2040-2-0x000002B1EDF80000-0x000002B1EDF9A000-memory.dmp
memory/2040-1-0x000002B1F0040000-0x000002B1F0050000-memory.dmp
memory/2040-61-0x000002B1F0040000-0x000002B1F0050000-memory.dmp
memory/3664-38-0x0000000140000000-0x00000001400B2000-memory.dmp
memory/3664-52-0x0000000140000000-0x00000001400B2000-memory.dmp
memory/3664-21-0x0000000140000000-0x00000001400B2000-memory.dmp
memory/3664-30-0x0000000000A50000-0x0000000000A51000-memory.dmp
memory/3664-72-0x0000000140000000-0x00000001400B2000-memory.dmp
memory/3664-31-0x0000000000A30000-0x0000000000A31000-memory.dmp
memory/3664-37-0x0000000140000000-0x00000001400B2000-memory.dmp
memory/3664-39-0x0000000140000000-0x00000001400B2000-memory.dmp
memory/3664-41-0x0000000140000000-0x00000001400B2000-memory.dmp
memory/3664-42-0x0000000140000000-0x00000001400B2000-memory.dmp
memory/3664-43-0x0000000140000000-0x00000001400B2000-memory.dmp
memory/3664-44-0x0000000140000000-0x00000001400B2000-memory.dmp
memory/3664-45-0x0000000140000000-0x00000001400B2000-memory.dmp
memory/3664-46-0x0000000140000000-0x00000001400B2000-memory.dmp
memory/3664-49-0x0000000140000000-0x00000001400B2000-memory.dmp
memory/3664-48-0x0000000140000000-0x00000001400B2000-memory.dmp
memory/3664-47-0x0000000140000000-0x00000001400B2000-memory.dmp
memory/3664-40-0x0000000140000000-0x00000001400B2000-memory.dmp