Analysis
- max time kernel
150s - max time network
136s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
- submitted
14/11/2026, 10:51
General
- Target GTA V.exe
- Size 246KB
- Sample261114-mxtnnafy41
- SHA256 3f0c1313bac92a2e20966ff0819ad0d59da93dea23e6d946713bd82367db066c
Malware Config
Extracted
-
stealc
-
GitGatHap
-
http://37.59.205.8
Signatures
- Family: Stealc
Stealc is an infostealer written in C++.
- Detects Stealc stealer Version 3 15 IoCs
- Looks up external IP address via web service 1 TTPs 3 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Modifies Internet Explorer settings 1 TTPs 1 IoCs
- Suspicious behavior: EnumeratesProcesses 1 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of SetWindowsHookEx 2 IoCs
- Suspicious use of WriteProcessMemory 9 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\GTA V.exe"C:\Users\Admin\AppData\Local\Temp\GTA V.exe"1⤵
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\data\bin\python.exe"data\bin\python.exe" - "data\bin\blen.blend"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\explorer.exe"C:\Windows\explorer.exe"3⤵
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
ms_log.txt
memory/1020-63-0x0000000140000000-0x00000001400B2000-memory.dmp
memory/1020-50-0x0000000140000000-0x00000001400B2000-memory.dmp
memory/1020-52-0x0000000140000000-0x00000001400B2000-memory.dmp
memory/1020-55-0x0000000140000000-0x00000001400B2000-memory.dmp
memory/1020-57-0x0000000140000000-0x00000001400B2000-memory.dmp
memory/1020-58-0x0000000140000000-0x00000001400B2000-memory.dmp
memory/1020-54-0x0000000140000000-0x00000001400B2000-memory.dmp
memory/1020-56-0x0000000140000000-0x00000001400B2000-memory.dmp
memory/1020-59-0x0000000140000000-0x00000001400B2000-memory.dmp
memory/1020-61-0x0000000140000000-0x00000001400B2000-memory.dmp
memory/1020-60-0x0000000140000000-0x00000001400B2000-memory.dmp
memory/1020-62-0x0000000140000000-0x00000001400B2000-memory.dmp
memory/1020-53-0x0000000140000000-0x00000001400B2000-memory.dmp
memory/1020-51-0x0000000140000000-0x00000001400B2000-memory.dmp
memory/1020-43-0x0000000000680000-0x0000000000681000-memory.dmp
memory/1020-44-0x00000000003E0000-0x00000000003E1000-memory.dmp
memory/1020-34-0x0000000140000000-0x00000001400B2000-memory.dmp
memory/4604-11-0x00007FFF45000000-0x00007FFF459A4000-memory.dmp
memory/4604-8-0x00007FFF45000000-0x00007FFF459A4000-memory.dmp
memory/4604-23-0x00007FFF45000000-0x00007FFF459A4000-memory.dmp
memory/4604-24-0x0000016EE86C0000-0x0000016EE8E66000-memory.dmp
memory/4604-25-0x00007FFF45000000-0x00007FFF459A4000-memory.dmp
memory/4604-19-0x00007FFF45000000-0x00007FFF459A4000-memory.dmp
memory/4604-18-0x00007FFF45000000-0x00007FFF459A4000-memory.dmp
memory/4604-17-0x00007FFF45000000-0x00007FFF459A4000-memory.dmp
memory/4604-14-0x00000166CD480000-0x00000166CD48E000-memory.dmp
memory/4604-15-0x00000166E5F00000-0x00000166E5F44000-memory.dmp
memory/4604-13-0x00007FFF45000000-0x00007FFF459A4000-memory.dmp
memory/4604-12-0x00007FFF45000000-0x00007FFF459A4000-memory.dmp
memory/4604-1-0x00000166CB660000-0x00000166CB69E000-memory.dmp
memory/4604-10-0x00007FFF45000000-0x00007FFF459A4000-memory.dmp
memory/4604-9-0x00007FFF45000000-0x00007FFF459A4000-memory.dmp
memory/4604-20-0x00007FFF45000000-0x00007FFF459A4000-memory.dmp
memory/4604-7-0x00007FFF45000000-0x00007FFF459A4000-memory.dmp
memory/4604-6-0x00000166CD4B0000-0x00000166CD4E0000-memory.dmp
memory/4604-5-0x00007FFF45000000-0x00007FFF459A4000-memory.dmp
memory/4604-4-0x00007FFF45000000-0x00007FFF459A4000-memory.dmp
memory/4604-3-0x00000166E5DA0000-0x00000166E5EFA000-memory.dmp
memory/4604-2-0x00000166CBB30000-0x00000166CBB4A000-memory.dmp
memory/4604-0-0x00007FFF4518F000-0x00007FFF45190000-memory.dmp
memory/4604-67-0x00007FFF45000000-0x00007FFF459A4000-memory.dmp
memory/4604-68-0x00007FFF45000000-0x00007FFF459A4000-memory.dmp
memory/4604-69-0x00007FFF45000000-0x00007FFF459A4000-memory.dmp
memory/4604-70-0x00007FFF45000000-0x00007FFF459A4000-memory.dmp
memory/4604-71-0x00007FFF45000000-0x00007FFF459A4000-memory.dmp
memory/4604-72-0x00007FFF45000000-0x00007FFF459A4000-memory.dmp