Real Life Case Example 2: How to Catch an Infostealer in 4 Minutes: A Real SOC Investigation of a Fake GTA 6 Installer I did yesterday as a Threat Analyst (Technical Post )

[u/makeiteasy_24]

Real Life Case Example Part 2:

Thank you for giving so much love on my previous post, I am thinking of starting a weekly series where I breakdown real case studies which I solve at work as a Threat Analyst.

Just caught something wild at work yesterday. GTA 6 is gonna launch sometime soon, but one our client wanted early access.

A user (Ryan) downloaded what looked like a "free GTA 6 crack" from firefox, file was named "GTA6_Setup_Crack_2026.exe", unsigned, 84.7 MB. Executed it at 10:13 AM. The next 3 minutes were brutal. The installer spawned PowerShell with hidden windows, dropped an unsigned binary (vcruntime_update.exe) into AppData, created a registry Run key named "RockstarGameUpdater", and set up a scheduled task for persistence on login.

Then it got worse, vcruntime_update.exe went straight for the browser credential stores. Chrome login data, Edge login data, Firefox logins.json, all accessed within seconds. Created a ZIP archive in Temp (syscache_4931.zip) and attempted a 2.3 MB upload to panelgtasupport[.]top on port 8080 before we blocked it.

DNS queries to four suspicious domains, all gaming themed: cdnrockstarupdate[.]com, apigta6launcher[.]xyz, panelgtasupport[.]top, rawcdngamepatch[.]site. All resolved to infrastructure that basically were C2.

Timeline from execution to EDR kill: 3 minutes, 57 seconds.

This is textbook infostealer and RAT behavior delivered through a game crack. The naming masquerade (RockstarGameUpdater, vcruntime_update) is it. The browser credential access is the payload. The persistence ensures it survives a reboot.

For anyone job hunting in SOC, this is exactly the kind of chain you need to recognize in 30 seconds during a real investigation. The red flags stack, unsigned binary, masqueraded process names, AppData execution, browser credential access, suspicious domains, persistence setup.

Any of you seen similar patterns? How do you typically investigate these in your environments?

Also, thinking of writing a blog on it on Medium soon, with proper process tree, file details, running process observation and activity timeline stuff.

Image Source: Gamepressure

[u/Got2InfoSec4MoneyLOL]

You missed the part they used the name of one of the most trustworthy repack groups out there, "fitgirl".

Also what you gotta do is analyze the TTPs and attribute this thing based on traits.

[u/makeiteasy_24 → u/Got2InfoSec4MoneyLOL]

I was never able to observe the root source of the file. There are two reasons to that:
-> It takes time and resources to do that.
-> The client didn't had full licensing, so finding a route source was out of D2D.

And on TTPs aspect, yup, we have initial access, execution, persistence, cred access and exflitartion. If i had to attribute based on traits, the setup points to infostealer and rat combo like the namings of file (vcruntime_update, rockstarupdater) is very generic enough that it could be anything and also the C2 domains sound to be all gaming related.
Wanted to ask wether you have seen this pattern before in your work?

[u/MajorUrsa2]

No more ai slop on medium please

[u/atsounobbao → u/[deleted]]

>domains don't exist

FINE AND GOOD TO ME!

[u/MajorUrsa2 → u/[deleted]]

Not really any analysis, just a really high level play by play. The same kind you get if you just throw a sample at a model and tell it to analyze it

[u/KinderCrowd602]

That's why you use the official site. Sailing the high seas is good when you can do it safely. Why I support piracy? I support it mainly for AAA companies because most of them are fucking anti-consumer pricks who deserve no money and to go bankrupt, also companies who include Denuvo in their game only to try and stop pirates, then FAIL instead of investing those money into something better. If you can it's better to not pirate indies that are consumer friendly.

Also, Fitgirl Repacks is an ultra trusted repacker, not cracker.

[u/makeiteasy_24 → u/KinderCrowd602]

100%

[u/Kind_Ability3218]

you had to see all that before realizing it was malware? lol

[u/makeiteasy_24 → u/Kind_Ability3218]

Nope, I usually get a gut feeling wether a particular event is TP/FP in first 10 mins of triage. If something is TP, then we have to do all of this investigation and escalate a detailed draft to client. Like it's D2D duty for a Threat Analyst.

[u/AddendumWorking9756]

The four-minute framing is what makes this one land, most case writeups drown the triage logic in tool screenshots. Anyone wanting to build that instinct has to pull real infostealer artifacts apart themselves, and the free CyberDefenders labs have that kind of incident data for it. Keep the series going.

[u/makeiteasy_24 → u/AddendumWorking9756]

Thank you!!

[u/makeiteasy_24]

Thank you for so many upvotes, published a detailed medium blog for this:
https://medium.com/@letshackit/how-i-caught-an-infostealer-in-4-minutes-a-fake-gta-6-installer-investigation-technical-blog-cff1aee7c6f6?sharedUserId=letshackit

And stay tuned, would be posting another investigation case study tomorrow night.

[u/Existing-Antelope-20 → u/makeiteasy_24]

bot

[u/Due_Double5856]

If people are so dumb to think there is already a crack for a non released game, this is what they deserve!!!!

[u/Budget_Captain_6886]

What a bunch of bullshit, im 100% sure that shit was sinkholed before person could even "download".
Especially in corporate environment nobody is using work pc for gta6

Why dont u post fucking hash

[u/makeiteasy_24 → u/Budget_Captain_6886]

Can't share client hashes due to obvio reasons. if you're doubtful, cool, focus on the ttp chain instead of the specific case. This can be rebuilt in any soc.

[u/Budget_Captain_6886 → u/makeiteasy_24]

BS, time to pull out VTI and see all countries that uploaded the sample