41cdb18866b325c76c4aa6f5e560bf037b742001e046c744ec496ad4dfde6e0f

Analysis

max time kernel
899s
max time network
464s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
08/09/2026, 15:07

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
GTA 3/Unpak.bat
Size 557B
Sample260908-shqlcasgrf
SHA256 41cdb18866b325c76c4aa6f5e560bf037b742001e046c744ec496ad4dfde6e0f
MD5 b2391ec55bbdda331bf0a16dc8e87f0b
SHA1 98c897d440d45a49aa370beffe984851a7243af1
SHA512 8730566aa0e5c4e2d10ce66863914b3a03228aedef84b38a27fc16bf36f00834cb6dbfa145572f19ccb46e75bf94d078108e76bff941858f6066ae33d86e928f
TLSH
T16EF0AF13030B679E98AA9DD5DE4F95A02F4F819F124531C9440FD9C05684BF7E261CF0
MD5 SHA1 SHA512 TLSH

Score

7^/10

discovery execution upx

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
6032	o.exe
5580	startw.exe

UPX packed file 7 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral3/memory/4320-0-0x0000000000400000-0x0000000000492000-memory.dmp	upx
behavioral3/memory/4320-4-0x0000000000400000-0x0000000000492000-memory.dmp	upx
behavioral3/memory/788-8-0x0000000000400000-0x0000000000492000-memory.dmp	upx
behavioral3/memory/2900-121-0x0000000000400000-0x0000000000492000-memory.dmp	upx
behavioral3/memory/3480-240-0x0000000000400000-0x0000000000492000-memory.dmp	upx
behavioral3/memory/4104-244-0x0000000000400000-0x0000000000492000-memory.dmp	upx
behavioral3/memory/2820-666-0x0000000000400000-0x0000000000492000-memory.dmp	upx

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4468	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	UHARC.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	o.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	startw.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 4468 wrote to memory of 4320	4468	cmd.exe	90
PID 4468 wrote to memory of 788	4468	cmd.exe	91
PID 4468 wrote to memory of 2900	4468	cmd.exe	92
PID 4468 wrote to memory of 3480	4468	cmd.exe	93
PID 4468 wrote to memory of 4104	4468	cmd.exe	94
PID 4468 wrote to memory of 2820	4468	cmd.exe	95
PID 4468 wrote to memory of 6032	4468	cmd.exe	96
PID 4468 wrote to memory of 5580	4468	cmd.exe	98

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\GTA 3\Unpak.bat"
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4468
- C:\Users\Admin\AppData\Local\Temp\GTA 3\UHARC.EXE
  uharc.exe x -o+ -vm+ -y+ teccutsc.uha
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4320
- C:\Users\Admin\AppData\Local\Temp\GTA 3\UHARC.EXE
  uharc.exe x -o+ -vm+ -y+ tecimg.uha
  2⤵
  PID:788
- C:\Users\Admin\AppData\Local\Temp\GTA 3\UHARC.EXE
  uharc.exe x -o+ -vm+ -y+ tecmisc.uha
  2⤵
  PID:2900
- C:\Users\Admin\AppData\Local\Temp\GTA 3\UHARC.EXE
  uharc.exe x -o+ -vm+ -y+ tectxd.uha
  2⤵
  PID:3480
- C:\Users\Admin\AppData\Local\Temp\GTA 3\UHARC.EXE
  uharc.exe x -o+ -vm+ -y+ tecsnd1.uha
  2⤵
  PID:4104
- C:\Users\Admin\AppData\Local\Temp\GTA 3\UHARC.EXE
  uharc.exe x -o+ -vm+ -y+ tecmain.uha
  2⤵
  PID:2820
- C:\Users\Admin\AppData\Local\Temp\GTA 3\audio\o.exe
  o sfx.ogg
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:6032
- C:\Users\Admin\AppData\Local\Temp\GTA 3\audio\startw.exe
  startw
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:5580

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:4508

C:\Windows\System32\SecurityHealthHost.exe
\\?\C:\Windows\System32\SecurityHealthHost.exe {08728914-3F57-4D52-9E31-49DAECA5A80A} -Embedding
1⤵
PID:3972

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

TecAudio.bat

Path C:\Users\Admin\AppData\Local\Temp\GTA 3\TecAudio.bat
Size 108B
SHA256 9c1c5b6e53c93c7eb3b54bdf8835fb9f5433e5036cd3ae59dd3d8f17403719fb
MD5 3199bb8761be89cf824110ab2c545e39
SHA1 5d3fa5cdac005fda98627c8752b5d3b020b38182
SHA512 110694f2088bbc118b988147ba9aa487444ad1766e36946fdbbc4d5ac6f379ab0c3bd3399da38a697a1f2289bfe4818aaf5eea6e2a3d27741ce8483ac59fb41e
TLSH
T113B0920188012D89199D14E0F33D2D80BE0E40D207288704109A80B4AB134722106833
MD5 SHA1 SHA512 TLSH

Submit Download

gta3.ini

Path C:\Users\Admin\AppData\Local\Temp\GTA 3\anim\gta3.ini
Size 10B
SHA256 bd03fd541c1520f1bf34743052235a200ed87b34451801c772f7762b023ba81a
MD5 50328eef302d9792ba73fc8e03b7fb25
SHA1 4bbc1f624922d6be1cc2c2ea2da63247225eea1e
SHA512 b78604bc32c4c7c7debe50065dbcf5ff31c4dec030b550a55276deaa2b906feffb431be776f6c06b8d1c1c34f9d75de6dc3fa5761a55d5a2c0eed32b360a4eff
MD5 SHA1 SHA512

Submit Download

o.exe

Path C:\Users\Admin\AppData\Local\Temp\GTA 3\audio\o.exe
Size 152KB
SHA256 1f384a8283a0bf306272e89269e472ea0f1e032a0b6ff31c2c2ad1ab285e475c
MD5 b2d0e357ec3f7707e4d3d517f30248e7
SHA1 5fcc0f9ded2e63c1501d75c82ba9d02c29d810bd
SHA512 fbea69b6c13d9881397960c662d538d51c04922f0ddaa8c300b058ed2d7af148b30f7683f7c7d06f34fc3aa5a4b78988fed99483b808daf1c3abcec8e487698e
SSDEEP 3072:THnvVeE17Vftt3cDR5L1TBXWi0aG79+vvQNmof60:zvv17pc15L1TBG9aG79oQT6
TLSH
T1C4E38D52B58240FEE9CE05B014A6363BEA34566D1125DD93B36CEDF39F31E606E2920B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sfx.ogg

Path C:\Users\Admin\AppData\Local\Temp\GTA 3\audio\sfx.ogg
Size 9.2MB
SHA256 43c3eef334e7527e5b1656cf381c27968d5cc6e9d781e7a98d9c38ddeb2ea3cc
MD5 26729110afa7d46643a9686e16c27b85
SHA1 2915ffef7f011ffa1c734cca3dbac45dfe3f4b8a
SHA512 67b09bab1d3c6213a2416ed986c5ebd7587e4379f56674e066ac80f35bc121e9d9f130552a7c5f4e6871e508a112e4824ff4ac48047aa146728f9b98d2793832
SSDEEP 196608:gIuT4t99I00LvS0rC6aladbpJ+NWBKiN5F7uk1GBr24qPSx1:geKJa4dbpcIBKUjqk6LqPM1
TLSH
T164A63315E964583BE2A961F084EFD9D47B2D41CD0BFB2A870DE550138E41A02EF77E2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

startw.exe

Path C:\Users\Admin\AppData\Local\Temp\GTA 3\audio\startw.exe
Size 29KB
SHA256 657e5283858e35773135211597faf1462b4b56931ffdc58330a9e16a4d364642
MD5 79cdbb7f107ef958ffdc79e1df74aedc
SHA1 353455aaaa471283ab2359d098640c32201be158
SHA512 d54ee8c6079b13b787d804d7506d496b2bcf9a123f7690981ade7137ec5f9308b69a4b1a7b2e810e66bce6ceefe596b8604415a3384d44bf42395df8741c34fc
SSDEEP 384:7W25ZPtKy7xZSMQY62D7P9TRyXyJxMfgF0g+ufpNbuJi7w:CimGIitRQTgPBNui
TLSH
T187D25C47E480C5F3F881227012A7FB776B3B555A41668B47EB88CCBA5D321A0593A3DD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

comNbtm.ipl

Path C:\Users\Admin\AppData\Local\Temp\GTA 3\data\maps\comNbtm.ipl
Size 67KB
SHA256 d3ea586344f2c74ada8ba9076c7c1fa74de4b9bcd48f63ba90491c39e9fc6286
MD5 98cf66af41fc10519fec32da19452e92
SHA1 0b06e969b8f4bca1abe69da5d5df9e57f5371fa1
SHA512 44883b5b4d7efb8fb8cdb32c8fc6e2cfe75bf080ed4ccde9f02eb5a083f7f0c97806f7421b30893dedf1b5fa55cd8f6c74b9382b320f7f810fc7b720e4000df7
SSDEEP 1536:MKcH0GhLBpUhsSZKbKQIJ4TWMNUbGe6YP7dRicS7RnztKHIn4VTzpLWdcfV:0jb2Jfx
TLSH
T13363B95F038D06ED16DAEB5C05A20C1B6FE0C9391A2E90DFC7943AE6D41D72ED7648B2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

comNtop.ipl

Path C:\Users\Admin\AppData\Local\Temp\GTA 3\data\maps\comNtop.ipl
Size 79KB
SHA256 f80d9995fb3304b0585ef43c16bda5563aa3d2b9181dec1cc0c6c966275f5de1
MD5 50f561e41933becee796b1b81b020e29
SHA1 18042f78f656d6cdfe83f660e550da0346ff64ae
SHA512 097b8cc00b5ec7b6fbe8f14557e2ec61f1f87b8710df0882044fb36bc935fde99b911137de3bb76d87487f6216006fb96d1db9f2b3abd01a36f96e2c3641da61
SSDEEP 1536:7vPl9V7wf1LLn8n41B79QNZhigBiQ4gx8e0HxcgEoQl36Dweo4:8u7ExTo4
TLSH
T18A83CD9B038E0ADD2A8AEB9C04620C4B6FF0D9751B3C54DFC7952BD2D42D69E63848D7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

comSE.ipl

Path C:\Users\Admin\AppData\Local\Temp\GTA 3\data\maps\comSE.ipl
Size 42KB
SHA256 b3d74956cde01c1949609f38ba671aba01b35b73efec28746aa6f3d938a01a67
MD5 225bd9974cae8e39a1f9331183a241fd
SHA1 ea5f88bc1167220c553d39b79fa8b9a15977d477
SHA512 bb1e01b011c0b66752b6ee0a1292980437424bb5fd33f777ba65be3347e5425a4e497eb74814421554319e27750bd18c3fa9ae7cd76df0988957696ae5caae48
SSDEEP 384:okJq9jVpCiJ9oJhbbEakSgEw5dq5EY4aLZMc0qjJlX1bSwt43PWia4I+rnjiqk2J:1q9ppCiJ9/z5dq5EXaLZMJWq42mMZ/F
TLSH
T10313DD4F038A06DC16D9EA4D84B35C6B7FE0DA39263C84DFC78926D2C41E35E9794DA2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

comSW.ipl

Path C:\Users\Admin\AppData\Local\Temp\GTA 3\data\maps\comSW.ipl
Size 59KB
SHA256 e860a948c8f473a6c3b52f297cfa6e52037b88a29841e721844a37694225113a
MD5 4757b72a09c91eaf511ed92892794252
SHA1 1fc4acba7781df32156ac0d203c329c6d19476a0
SHA512 8d5a547893af488af2c4839ffc1e28b90e8c45e2b4c53e0b163ed6268a1abe4e0913546e08da6aff8f0958f476712a8455a2b52f45f608bb32abd1eb3eb2cebe
SSDEEP 1536:BPY7NlEnGERPTRw/ZANfG3OVsctWeLu7hZ4h8f6/qPTkjT9rYbxeokMDBDyjxuID:BAkPTRw/ZsyW
TLSH
T14C43AB9F038906DD26CAE65D40F30C1BAFE0DE38162DD4DFC78829D5C81D75E9B998A2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

industSE.ipl

Path C:\Users\Admin\AppData\Local\Temp\GTA 3\data\maps\industSE.ipl
Size 53KB
SHA256 cffc8f4f88d45d2cb8621f53091a4123bafb4b255aa8e2e642ced8d8c3745c6a
MD5 208c23f090f11418443f7eed5d7b065a
SHA1 db3dc27fe2546206c5f14637923d31d45380143e
SHA512 a837940ce13519103ae0f08ef25e7a31a3454e980ddb5a8af76211c9fd3edc4d5233f238c7ec1b494467d77abf7d05cbdd00e66cb1e8ac98766da734045a076d
SSDEEP 384:Oi0+wNoeMXdJXDJ7q3aixfZvaY0wdFoaT0LZBViIcPFgt27cpnBPNLW3qzm/NoRo:a3MX/03aitNabwdFFe3iLgM/bwD8
TLSH
T12433CCBF138A4ADC8AC6F76C40120C1BAFE4D971577EA4DFCB456AC1D82DB9A0744DA0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

industSW.ipl

Path C:\Users\Admin\AppData\Local\Temp\GTA 3\data\maps\industSW.ipl
Size 49KB
SHA256 905ae057d8cd95089a30e89a0117422fdb5f26eee54a9501f097f99eb942d552
MD5 3aaab8a61df2493b416a2f5162d98ae5
SHA1 ec906edb20b4fc50b3771619b3e5c4c0ad80fa56
SHA512 1d935fcbbfbf5a9d38b472597ae8bb979288bbb6ca9dbd74b20d40127a16fccf2ccca9205ee5fb0c4b73701b66323ae7af93d82ad024f6c4b5a8d0aeebdf679b
SSDEEP 1536:qST9BIalAFxQulNeONNIrymfRVOHVFfX0umlia2ENXef:qu9BAFUmeA
TLSH
T1B1330CAB274D0AEC2ACFFB5D04120C1B6FE4DD34577E51CFCA9829E1E10EA6B53149A1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

suburbne.ipl

Path C:\Users\Admin\AppData\Local\Temp\GTA 3\data\maps\suburbne.ipl
Size 70KB
SHA256 038219203382a1e301682457477d84d1c7080cc53dfc9ba082efe681d83804e1
MD5 bcf7db9487f9da08a26b9b3cf0e386e8
SHA1 39f1402c68a5329f6ea0a4f26a1c0fe65f990331
SHA512 906bf73ee7d40064290c9ef090344b2fcf20b3469df93b22cde64d08616910b2b7f69dc99766cfc1d0b0b7ea939ae84a901c29bb2297d61f8f6d26e435885c55
SSDEEP 1536:1N6S6kQb/hRJOfudNkQ7YlMyf3lEZMeiq/R1NRxVFH5kFl9WFI8I/Fc1y0uUe2e6:36S6Hb/hRJOuNkQ7YlMyf3Fef5VFH5kK
TLSH
T1AB63FF8B038E07EC198FEB6C10660C1BAFE0DD3A267E40DFD7906AD9D41E7A75754861
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

GTAtitlesGER.mpg

Path C:\Users\Admin\AppData\Local\Temp\GTA 3\movies\GTAtitlesGER.mpg
Size 722KB
SHA256 f829bc862394790885c26935d9036aa308927f14902026148b3907adb0411460
MD5 c29de92210f1e3829d9e9544f4a104f5
SHA1 a126a36bc2f05287a3902341b010bc249141bd6b
SHA512 db1e9dbc773e840082a157e56ede6c55650e813769c12bad52deb548c5c16f06545811955ef57299625da9d08d8d8a133d17a53ae0ca09d6510b2c6a14255126
SSDEEP 12288:WEzfwGAldco0zphPHWZiO3Dtnm5OIYY6y6zYlLp16Eavph6tvHOP2vFVZbkexO:WAg4P4iO3DtnrI6WYE8poFHhEB
TLSH
T1A8F412CCAFD6D952C20D6BB3448B575A517B4CBA479070328399B6DA323527CDF238D8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

player.bmp

Path C:\Users\Admin\AppData\Local\Temp\GTA 3\skins\player.bmp
Size 192KB
SHA256 94d230e38345c5a4e7ac654f3f934c4863f8ac0a9835922e9abc4626146b712a
MD5 a5b4affb8b9ebff7f920cc072d91d3b1
SHA1 3b34ec9bcfa615e82b4298e55189cd063676bb52
SHA512 4ec06ad30f8eabc9e261220248d9150a8edb514f2473539d46991b068e7338852d5917658537a2b1d8d829a84c3b72d2084fca2fe9a96bef0371242119f211a4
SSDEEP 768:xHGbdRf/Wp9cGikmrULAQViHef9Upb8HEFrhBOi2xR1/ULJDRHU7WeXwyulN7oS9:xOfpTeAQ4+f9Upb8mFB7bNdHUZgJN7gC
TLSH
T1A314B68391AF9807B5E0580211F2633F4AE1C33F7ED76EE27DD86842E2565707E15CAA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/788-8-0x0000000000400000-0x0000000000492000-memory.dmp

Download

memory/2820-666-0x0000000000400000-0x0000000000492000-memory.dmp

Download

memory/2900-121-0x0000000000400000-0x0000000000492000-memory.dmp

Download

memory/3480-240-0x0000000000400000-0x0000000000492000-memory.dmp

Download

memory/4104-244-0x0000000000400000-0x0000000000492000-memory.dmp

Download

memory/4320-0-0x0000000000400000-0x0000000000492000-memory.dmp

Download

memory/4320-4-0x0000000000400000-0x0000000000492000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads