Overview
overview
3Static
static
3GTA VI/D3D...re.dll
windows10-2004-x64
1GTA VI/GTA VI.exe
windows10-2004-x64
1GTA VI/GTA...rp.dll
windows10-2004-x64
1GTA VI/GTA...ne.dll
windows10-2004-x64
1GTA VI/GTA...ty.dll
windows10-2004-x64
1GTA VI/GTA...on.dll
windows10-2004-x64
1GTA VI/GTA...on.dll
windows10-2004-x64
1GTA VI/GTA...on.dll
windows10-2004-x64
1GTA VI/GTA...re.dll
windows10-2004-x64
1GTA VI/GTA...ns.dll
windows10-2004-x64
1GTA VI/GTA...ta.dll
windows10-2004-x64
1GTA VI/GTA...ng.dll
windows10-2004-x64
1GTA VI/GTA...es.dll
windows10-2004-x64
1GTA VI/GTA...em.dll
windows10-2004-x64
1GTA VI/GTA...on.dll
windows10-2004-x64
1GTA VI/GTA...tp.dll
windows10-2004-x64
1GTA VI/GTA...cs.dll
windows10-2004-x64
1GTA VI/GTA...on.dll
windows10-2004-x64
1GTA VI/GTA...me.dll
windows10-2004-x64
1GTA VI/GTA...ty.dll
windows10-2004-x64
1GTA VI/GTA...ls.dll
windows10-2004-x64
1GTA VI/GTA...ns.dll
windows10-2004-x64
1GTA VI/GTA...nq.dll
windows10-2004-x64
1GTA VI/GTA...ml.dll
windows10-2004-x64
1GTA VI/GTA...em.dll
windows10-2004-x64
1GTA VI/GTA...on.dll
windows10-2004-x64
1GTA VI/GTA...cy.dll
windows10-2004-x64
1GTA VI/GTA...fe.dll
windows10-2004-x64
1GTA VI/GTA...st.dll
windows10-2004-x64
1GTA VI/GTA...rt.dll
windows10-2004-x64
1GTA VI/GTA...ns.dll
windows10-2004-x64
1GTA VI/GTA...UI.dll
windows10-2004-x64
1Analysis
- user interaction
yes - max time kernel
629s - max time network
620s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
10/09/2026, 15:21
Static task
static1
Behavioral task
behavioral1
Sample
GTA VI/D3D12/D3D12Core.dll
Resource
win10v2004-20260513-en
Behavioral task
behavioral2
Sample
GTA VI/GTA VI.exe
Resource
win10v2004-20260513-en
Behavioral task
behavioral3
Sample
GTA VI/GTA VI_Data/Managed/Assembly-CSharp.dll
Resource
win10v2004-20260513-en
Behavioral task
behavioral4
Sample
GTA VI/GTA VI_Data/Managed/Cinemachine.dll
Resource
win10v2004-20260513-en
Behavioral task
behavioral5
Sample
GTA VI/GTA VI_Data/Managed/Mono.Security.dll
Resource
win10v2004-20260513-en
Behavioral task
behavioral6
Sample
GTA VI/GTA VI_Data/Managed/Newtonsoft.Json.dll
Resource
win10v2004-20260513-en
Behavioral task
behavioral7
Sample
GTA VI/GTA VI_Data/Managed/System.ComponentModel.Composition.dll
Resource
win10v2004-20260513-en
Behavioral task
behavioral8
Sample
GTA VI/GTA VI_Data/Managed/System.Configuration.dll
Resource
win10v2004-20260513-en
Behavioral task
behavioral9
Sample
GTA VI/GTA VI_Data/Managed/System.Core.dll
Resource
win10v2004-20260513-en
Behavioral task
behavioral10
Sample
GTA VI/GTA VI_Data/Managed/System.Data.DataSetExtensions.dll
Resource
win10v2004-20260513-en
Behavioral task
behavioral11
Sample
GTA VI/GTA VI_Data/Managed/System.Data.dll
Resource
win10v2004-20260513-en
Behavioral task
behavioral12
Sample
GTA VI/GTA VI_Data/Managed/System.Drawing.dll
Resource
win10v2004-20260513-en
Behavioral task
behavioral13
Sample
GTA VI/GTA VI_Data/Managed/System.EnterpriseServices.dll
Resource
win10v2004-20260513-en
Behavioral task
behavioral14
Sample
GTA VI/GTA VI_Data/Managed/System.IO.Compression.FileSystem.dll
Resource
win10v2004-20260513-en
Behavioral task
behavioral15
Sample
GTA VI/GTA VI_Data/Managed/System.IO.Compression.dll
Resource
win10v2004-20260513-en
Behavioral task
behavioral16
Sample
GTA VI/GTA VI_Data/Managed/System.Net.Http.dll
Resource
win10v2004-20260513-en
Behavioral task
behavioral17
Sample
GTA VI/GTA VI_Data/Managed/System.Numerics.dll
Resource
win10v2004-20260513-en
Behavioral task
behavioral18
Sample
GTA VI/GTA VI_Data/Managed/System.Runtime.Serialization.dll
Resource
win10v2004-20260513-en
Behavioral task
behavioral19
Sample
GTA VI/GTA VI_Data/Managed/System.Runtime.dll
Resource
win10v2004-20260513-en
Behavioral task
behavioral20
Sample
GTA VI/GTA VI_Data/Managed/System.Security.dll
Resource
win10v2004-20260513-en
Behavioral task
behavioral21
Sample
GTA VI/GTA VI_Data/Managed/System.ServiceModel.Internals.dll
Resource
win10v2004-20260513-en
Behavioral task
behavioral22
Sample
GTA VI/GTA VI_Data/Managed/System.Transactions.dll
Resource
win10v2004-20260513-en
Behavioral task
behavioral23
Sample
GTA VI/GTA VI_Data/Managed/System.Xml.Linq.dll
Resource
win10v2004-20260513-en
Behavioral task
behavioral24
Sample
GTA VI/GTA VI_Data/Managed/System.Xml.dll
Resource
win10v2004-20260513-en
Behavioral task
behavioral25
Sample
GTA VI/GTA VI_Data/Managed/System.dll
Resource
win10v2004-20260513-en
Behavioral task
behavioral26
Sample
GTA VI/GTA VI_Data/Managed/Unity.AI.Navigation.dll
Resource
win10v2004-20260513-en
Behavioral task
behavioral27
Sample
GTA VI/GTA VI_Data/Managed/Unity.Analytics.DataPrivacy.dll
Resource
win10v2004-20260513-en
Behavioral task
behavioral28
Sample
GTA VI/GTA VI_Data/Managed/Unity.Burst.Unsafe.dll
Resource
win10v2004-20260513-en
Behavioral task
behavioral29
Sample
GTA VI/GTA VI_Data/Managed/Unity.Burst.dll
Resource
win10v2004-20260513-en
Behavioral task
behavioral30
Sample
GTA VI/GTA VI_Data/Managed/Unity.Collections.LowLevel.ILSupport.dll
Resource
win10v2004-20260513-en
Behavioral task
behavioral31
Sample
GTA VI/GTA VI_Data/Managed/Unity.Collections.dll
Resource
win10v2004-20260513-en
Behavioral task
behavioral32
Sample
GTA VI/GTA VI_Data/Managed/Unity.InputSystem.ForUI.dll
Resource
win10v2004-20260513-en
General
- Target GTA VI/GTA VI.exe
- Size 656KB
- Sample260910-srmk2stxa1
- SHA256 6840d22192fcb8552e866790612f6ea6fb69262965d78cf8fe6817518d46b7dd
- MD5 9f28c5278a8db490b67cc7826383ac55
- SHA1 a8c89fe1e305578e158d437d014d3d15dc96d16c
- SHA512 f25e89f3ec80a1d1b08004b1b14b1c9c13e12f634c56d278575e7091ee20c8a6a03fb8bf19201619b695454aeba07b77a61ed3335367c08d6f01323c9c7d95ff
- SSDEEP 6144:z2E4CD20ZB4Gr34QHHkZuURI2/oU6HlIk1dFNL6T3Ee5Wt3T:z2NCD1Jr3dnUI2/SD1NL6T3Eb5T
- TLSH T1B2E45BCFB1C114F9D135FE798152CD7897E37DE5BBA86A8A0AA87106AF331C10C05D6A
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Checks SCSI registry key(s) 3 TTPs 4 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000 GTA VI.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags GTA VI.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000 GTA VI.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags GTA VI.exe - Checks processor information in registry 2 TTPs 4 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\HARDWARE\DESCRIPTION\System\CentralProcessor\0 GTA VI.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 GTA VI.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz GTA VI.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString GTA VI.exe - Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 3596 GTA VI.exe - Suspicious use of WriteProcessMemory 1 IoCs
description pid Process procid_target PID 3596 wrote to memory of 2532 3596 GTA VI.exe 85
Processes
-
C:\Users\Admin\AppData\Local\Temp\GTA VI\GTA VI.exe"C:\Users\Admin\AppData\Local\Temp\GTA VI\GTA VI.exe"1⤵
- Checks SCSI registry key(s)
- Checks processor information in registry
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3596 -
C:\Users\Admin\AppData\Local\Temp\GTA VI\UnityCrashHandler64.exe"C:\Users\Admin\AppData\Local\Temp\GTA VI\UnityCrashHandler64.exe" --attach 3596 30564884848642⤵PID:2532
-
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x4fc 0x46c1⤵PID:3764
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\LocalLow\DefaultCompany\GTA VI\Unity\9132a8f5-521d-4b48-a92c-27ca874805af\Analytics\ArchivedEvents\178905439400003.7c1866e5\g
- Size 1B
- SHA256 d4735e3a265e16eee03f59718b9b5d03019c07d8b6c51f90da3a666eec13ab35
- MD5 c81e728d9d4c2f636f067f89cc14862c
- SHA1 da4b9237bacccdf19c0760cab7aec4a8359010b0
- SHA512 40b244112641dd78dd4f93b6c9190dd46e0099194d5a44257b7efad6ef9ff4683da1eda0244448cb343aa688f5d3efd7314dafe580ac0bcbf115aeca9e8dc114
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\DefaultCompany\GTA VI\Unity\9132a8f5-521d-4b48-a92c-27ca874805af\Analytics\ArchivedEvents\178905439400003.7c1866e5\s
- Size 429B
- SHA256 da35b17024b083ac2ef8445a1f3ebf53d3a2f4c56f745c3e33e8947c7a78d3ae
- MD5 7553a134200af6c9ccd42b4595168728
- SHA1 38fc4066ffd0e25b767eda35bfc056006e77837b
- SHA512 327bd1a2a2dd25b19780efefe6bf94bc299940c322d1ce712305c8213a4b06ab03619e6d535132ac38031317483f6e08df78d11722d4b8daf423c6bbba6c4ddf
- TLSH T1DFE0A3374219AA34BBB60513166931B6CE3C163CE581E27F447CA54E57D894F9B02919
- MD5 SHA1 SHA512 TLSH