Overview
overview
8Static
static
3gmod_83b.exe
windows10-2004-x64
7gmod_83b.exe
windows11-ltsc_2024-x64
7$PLUGINSDI...ns.dll
windows10-2004-x64
3$PLUGINSDI...ns.dll
windows11-ltsc_2024-x64
8bin/client.dll
windows10-2004-x64
3bin/client.dll
windows11-ltsc_2024-x64
8bin/game_s...ry.dll
windows10-2004-x64
3bin/game_s...ry.dll
windows11-ltsc_2024-x64
8bin/server.dll
windows10-2004-x64
3bin/server.dll
windows11-ltsc_2024-x64
8motd.html
windows10-2004-x64
3motd.html
windows11-ltsc_2024-x64
4Analysis
- max time kernel
150s - max time network
123s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260706-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260706-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
07/07/2026, 07:46
Behavioral task
behavioral1
Sample
gmod_83b.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
12 signatures
150 seconds
Behavioral task
behavioral2
Sample
gmod_83b.exe
Resource
win11ltsc2024-20260706-en
windows11-ltsc_2024-x64
6 signatures
150 seconds
Behavioral task
behavioral3
Sample
$PLUGINSDIR/InstallOptions.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral4
Sample
$PLUGINSDIR/InstallOptions.dll
Resource
win11ltsc2024-20260706-en
windows11-ltsc_2024-x64
13 signatures
150 seconds
Behavioral task
behavioral5
Sample
bin/client.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral6
Sample
bin/client.dll
Resource
win11ltsc2024-20260706-en
windows11-ltsc_2024-x64
12 signatures
150 seconds
Behavioral task
behavioral7
Sample
bin/game_shader_generic_garry.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral8
Sample
bin/game_shader_generic_garry.dll
Resource
win11ltsc2024-20260706-en
windows11-ltsc_2024-x64
12 signatures
150 seconds
Behavioral task
behavioral9
Sample
bin/server.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral10
Sample
bin/server.dll
Resource
win11ltsc2024-20260706-en
windows11-ltsc_2024-x64
12 signatures
150 seconds
Behavioral task
behavioral11
Sample
motd.html
Resource
win10v2004-20260513-en
windows10-2004-x64
12 signatures
150 seconds
Behavioral task
behavioral12
Sample
motd.html
Resource
win11ltsc2024-20260706-en
windows11-ltsc_2024-x64
11 signatures
150 seconds
General
- Target gmod_83b.exe
- Size 8.8MB
- Sample260707-jmcqlscy7x
- SHA256 eeb0a7e01d107f27db862d851b699a3a2e7040290d018a0c29bce7b5e1f27759
- MD5 3141cfe8d1583085aa7ce7ad2a934a43
- SHA1 07f80eddb75f4895d962b4987f08d8596a1a7123
- SHA512 284641226179aa11c8ffe9b6888d157613289ff73b49995071f735aa44eb8d7504b41050cd3829c4134669e163fafa3c251e3deac269cc57d62fe90ee9278f56
- SSDEEP 196608:3S2+ck8uTghImpzcoMNzJS8/REKPBWQenBj36VaE+U+IWnlP:giuMe+fR8/xPBNEjvyWnJ
- TLSH T1449633A5B72068BCF224D8715D71B76B85792E0CF47E56431EA43E2EBAFB116C426C03
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Loads dropped DLL 2 IoCs
pid Process 5384 gmod_83b.exe 5384 gmod_83b.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files (x86)\gmod\gmod\materials\bm\dart_grip.vmt gmod_83b.exe File created C:\Program Files (x86)\gmod\gmod\materials\mixerman3d\other\skate_deck.vtf gmod_83b.exe File created C:\Program Files (x86)\gmod\gmod\models\Weapons\W_physics.phy gmod_83b.exe File created C:\Program Files (x86)\gmod\gmod\mods\hl2dm\materials\VGUI\chapters\dm_resistance.vtf gmod_83b.exe File opened for modification C:\Program Files (x86)\gmod\gmod\mods\spawnicons\materials\gmod\models\props_c17\support01.vmt gmod_83b.exe File opened for modification C:\Program Files (x86)\gmod\gmod\mods\spawnicons\materials\gmod\models\props_junk\cardboard_box002b.vtf gmod_83b.exe File created C:\Program Files (x86)\gmod\gmod\mods\spawnicons\materials\gmod\models\props_vehicles\apc_tire001.vmt gmod_83b.exe File created C:\Program Files (x86)\gmod\gmod\mods\spawnicons\materials\gmod\models\weapons\w_shotgun.vmt gmod_83b.exe File created C:\Program Files (x86)\gmod\gmod\models\Weapons\W_crossbow.phy gmod_83b.exe File opened for modification C:\Program Files (x86)\gmod\gmod\mods\spawnicons\materials\gmod\models\props_debris\concrete_cynderblock001.vmt gmod_83b.exe File created C:\Program Files (x86)\gmod\gmod\mods\spawnicons\materials\gmod\models\props_wasteland\wheel02b.vtf gmod_83b.exe File opened for modification C:\Program Files (x86)\gmod\gmod\shaders\fxc\g_blurx_vs20.vcs gmod_83b.exe File created C:\Program Files (x86)\gmod\gmod\materials\bm\dart_body.vtf gmod_83b.exe File opened for modification C:\Program Files (x86)\gmod\gmod\materials\pp\g_blurx.vmt gmod_83b.exe File created C:\Program Files (x86)\gmod\gmod\models\mixerman3d\bowling\bowling_pin.mdl gmod_83b.exe File created C:\Program Files (x86)\gmod\gmod\mods\spawnicons\materials\gmod\models\humans\group03m\male_04.vtf gmod_83b.exe File created C:\Program Files (x86)\gmod\gmod\mods\spawnicons\materials\gmod\models\props_c17\oildrum001_explosive.vtf gmod_83b.exe File created C:\Program Files (x86)\gmod\gmod\mods\spawnicons\materials\gmod\models\props_c17\streetsign003b.vmt gmod_83b.exe File opened for modification C:\Program Files (x86)\gmod\gmod\mods\spawnicons\materials\gmod\models\props_junk\metalgascan.vtf gmod_83b.exe File opened for modification C:\Program Files (x86)\gmod\gmod\mods\spawnicons\materials\gmod\models\props_wasteland\cargo_container01.vtf gmod_83b.exe File opened for modification C:\Program Files (x86)\gmod\gmod\materials\bm\dart_body.vtf gmod_83b.exe File opened for modification C:\Program Files (x86)\gmod\gmod\materials\mixerman3d\bowling\ball_normal.vtf gmod_83b.exe File opened for modification C:\Program Files (x86)\gmod\gmod\models\mixerman3d\other\arrow.dx80.vtx gmod_83b.exe File created C:\Program Files (x86)\gmod\gmod\mods\spawnicons\materials\gmod\mod_icon_spawnmenu.vtf gmod_83b.exe File created C:\Program Files (x86)\gmod\gmod\mods\spawnicons\materials\gmod\models\combine_helicopter\helicopter_bomb01.vmt gmod_83b.exe File opened for modification C:\Program Files (x86)\gmod\gmod\mods\spawnicons\materials\gmod\models\humans\group01\male_07.vmt gmod_83b.exe File opened for modification C:\Program Files (x86)\gmod\gmod\mods\spawnicons\materials\gmod\models\items\boxbuckshot.vmt gmod_83b.exe File created C:\Program Files (x86)\gmod\gmod\mods\spawnicons\materials\gmod\models\props_c17\streetsign004f.vmt gmod_83b.exe File created C:\Program Files (x86)\gmod\gmod\mods\spawnicons\materials\gmod\models\props_trainstation\TrackSign07.vtf gmod_83b.exe File created C:\Program Files (x86)\gmod\gmod\mods\spawnicons\materials\gmod\models\props_vehicles\car002a.vtf gmod_83b.exe File created C:\Program Files (x86)\gmod\gmod\mods\spawnicons\materials\gmod\models\props_vehicles\van001a.vtf gmod_83b.exe File opened for modification C:\Program Files (x86)\gmod\gmod\mods\spawnicons\materials\gmod\models\gibs\HGIBS.vmt gmod_83b.exe File opened for modification C:\Program Files (x86)\gmod\gmod\mods\spawnicons\materials\gmod\models\props_c17\FurnitureChair001a.vmt gmod_83b.exe File opened for modification C:\Program Files (x86)\gmod\gmod\mods\spawnicons\materials\gmod\models\props_junk\garbage_glassbottle003a.vtf gmod_83b.exe File created C:\Program Files (x86)\gmod\gmod\mods\spawnicons\materials\gmod\models\props_junk\TrafficCone001a.vmt gmod_83b.exe File opened for modification C:\Program Files (x86)\gmod\gmod\mods\spawnicons\materials\gmod\models\props_c17\FurnitureBathtub001a.vtf gmod_83b.exe File opened for modification C:\Program Files (x86)\gmod\gmod\mods\spawnicons\materials\gmod\models\props_c17\gravestone001a.vtf gmod_83b.exe File created C:\Program Files (x86)\gmod\gmod\mods\spawnicons\materials\gmod\models\props_c17\gravestone_coffinpiece001a.vtf gmod_83b.exe File opened for modification C:\Program Files (x86)\gmod\gmod\mods\spawnicons\materials\gmod\models\props_junk\CinderBlock01a.vmt gmod_83b.exe File opened for modification C:\Program Files (x86)\gmod\gmod\mods\spawnicons\materials\gmod\models\props_junk\iBeam01a_cluster01.vtf gmod_83b.exe File opened for modification C:\Program Files (x86)\gmod\gmod\mods\spawnicons\materials\gmod\models\props_vehicles\car002a.vtf gmod_83b.exe File created C:\Program Files (x86)\gmod\gmod\maps\d1_trainstation_01.ini gmod_83b.exe File opened for modification C:\Program Files (x86)\gmod\gmod\mods\spawnicons\materials\gmod\models\props_c17\consolebox01a.vtf gmod_83b.exe File opened for modification C:\Program Files (x86)\gmod\gmod\scripts\soundscapes_labs.txt gmod_83b.exe File created C:\Program Files (x86)\gmod\gmod\materials\gmod\rendertarget.vmt gmod_83b.exe File created C:\Program Files (x86)\gmod\gmod\materials\mixerman3d\bowling\pin.vtf gmod_83b.exe File created C:\Program Files (x86)\gmod\gmod\mods\counter-stike\materials\VGUI\chapters\de_train.vtf gmod_83b.exe File opened for modification C:\Program Files (x86)\gmod\gmod\mods\spawnicons\materials\gmod\models\props_c17\FurnitureDrawer002a.vtf gmod_83b.exe File opened for modification C:\Program Files (x86)\gmod\gmod\mods\spawnicons\materials\gmod\models\props_trainstation\TrackSign09.vtf gmod_83b.exe File opened for modification C:\Program Files (x86)\gmod\gmod\mods\spawnicons\materials\gmod\models\props_vehicles\carparts_axel01a.vtf gmod_83b.exe File opened for modification C:\Program Files (x86)\gmod\gmod\models\mixerman3d\other\skateboard.dx80.vtx gmod_83b.exe File opened for modification C:\Program Files (x86)\gmod\gmod\mods\spawnicons\materials\gmod\models\gman_high.vtf gmod_83b.exe File opened for modification C:\Program Files (x86)\gmod\gmod\mods\spawnicons\materials\gmod\models\props_junk\ravenholmsign.vmt gmod_83b.exe File created C:\Program Files (x86)\gmod\gmod\mods\spawnicons\materials\gmod\models\props_lab\tpplugholder_single.vtf gmod_83b.exe File opened for modification C:\Program Files (x86)\gmod\gmod\mods\spawnicons\materials\gmod\models\props_wasteland\barricade002a.vtf gmod_83b.exe File created C:\Program Files (x86)\gmod\gmod\mods\spawnicons\materials\gmod\models\props_wasteland\tram_bracket01.vmt gmod_83b.exe File opened for modification C:\Program Files (x86)\gmod\gmod\mods\spawnicons\materials\gmod\models\props_c17\gravestone_statue001a.vtf gmod_83b.exe File opened for modification C:\Program Files (x86)\gmod\gmod\materials\mixerman3d\weapons\axe_blade01.vtf gmod_83b.exe File opened for modification C:\Program Files (x86)\gmod\gmod\models\mixerman3d\other\skateboard.phy gmod_83b.exe File created C:\Program Files (x86)\gmod\gmod\mods\spawnicons\materials\gmod\models\props_c17\chair_kleiner03a.vmt gmod_83b.exe File created C:\Program Files (x86)\gmod\gmod\mods\spawnicons\materials\gmod\models\props_c17\TrapPropeller_Engine.vmt gmod_83b.exe File opened for modification C:\Program Files (x86)\gmod\gmod\mods\spawnicons\materials\gmod\models\props_trainstation\bench_indoor001a.vmt gmod_83b.exe File created C:\Program Files (x86)\gmod\gmod\models\bm\basketball.mdl gmod_83b.exe File created C:\Program Files (x86)\gmod\gmod\models\bm\basketball.phy gmod_83b.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language gmod_83b.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language NOTEPAD.EXE - Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1581435544-3586420778-2104125077-1000_Classes\Local Settings gmod_83b.exe - Suspicious use of WriteProcessMemory 1 IoCs
description pid Process procid_target PID 5384 wrote to memory of 2944 5384 gmod_83b.exe 87
Processes
-
C:\Users\Admin\AppData\Local\Temp\gmod_83b.exe"C:\Users\Admin\AppData\Local\Temp\gmod_83b.exe"1⤵
- Loads dropped DLL
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:5384 -
C:\Windows\SysWOW64\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" C:\Program Files (x86)\gmod\gmod\readme.txt2⤵
- System Location Discovery: System Language Discovery
PID:2944
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files (x86)\gmod\gmod\readme.txt
- Size 2KB
- SHA256 e5bcf9beebee168002e741e62fc254eafe7efd3a44f845241431643794e039df
- MD5 fd0ec5b58a8ce8c8dd79fccd6827d5e0
- SHA1 6fe3486d4e9cd9601c4bdd29bd76ce5f39c88347
- SHA512 517debb65df523ce2a56c5ed3b3145cba435ca20d60b0a7bb6f2a75b8856eee07bdccc2ededf6423bcb5af18434851d42b4979454d9cf284f2d463344712d1d4
- TLSH T1CF41720AED17F3D40B22F252D70529D9E322C4D3ED268A01B087A78AAD8B4190F0D98F
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files (x86)\gmod\gmod\shaders\fxc\g_downsample_vs20.vcs
- Size 304B
- SHA256 39b57b55f51770d831c5d6ececab2a88721a93824da2d87bf083f14d38735846
- MD5 8eaabf42e2436459105d432d86aa73f8
- SHA1 8deb3e4743f651a9aec57d07da8ce15f79b09c56
- SHA512 779b059bee20a6cbf785c7003544fd67891a03288524b4dfe9473bf6e90dc26a96eb2f90dffb810c761989c0b4a712436fb6052eb3846d26c7d67c48092a0bf3
- TLSH T1B2E0A7EAE18543FEDC14573911F34A143154F20527D7978B6871CE598E6D3C44DA074D
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\nsc629A.tmp\InstallOptions.dll
- Size 12KB
- SHA256 a505e6c537a5ce0166227dda9f7671605395592ac9f1a3764e8a01b713939db1
- MD5 07f3b3445f66e1089567796bf3c8be78
- SHA1 851eb574c1067b23a654f8aa47b17ef599b24d1c
- SHA512 8c56308fff3a947b26fd0d98dbdd96c406ddf967f5d7abee8cba082b6c46a4e575094bb0bb981551ac5160bb5089cf6fb125dd17a659c427e28c07402adab1c3
- SSDEEP 192:pzi5iBjGHp29db9Dd+w6VPESclh3I8dYvwqu7hwbbHF1QuCb:pO5kjGHSDdgjo6pvwqu72bbMum
- TLSH T1CE422A6223849CF3E795423AB0563B036B9696267D516ED1C7330FC67E2308E6EB6353
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\nsc629A.tmp\ioSpecial.ini
- Size 618B
- SHA256 30963d1f7f30efdd3f75c3a347ed56a92cf19d8e8e344b040a5064fe1c284cc5
- MD5 bcac615981bf3aa7a704cb10c03fc985
- SHA1 34b49dbaa3838665e8b52e8fd8f765e8f123429a
- SHA512 a5435562810ed77400c6cbb3963c392d83d6cf328ae584380439330fc0314dcecceccddec1a5ac43a067d722746ac5620852c8c8d05dc0fead59fe4fd135383c
- TLSH T137F07888820A632A08205153A9FE3A9243E01C344B113BB0F5634CC3EB8DCD29CED6C2
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\nsc629A.tmp\ioSpecial.ini
- Size 700B
- SHA256 2dfb3d2305eac3d30927c4ea348b09d0994be983d0166be6b1e1212d8cf0f372
- MD5 9af60d8331d167dc222c411342515220
- SHA1 0bf82ea73ee4f91a167cc93133a7b012443836ae
- SHA512 430d5e1c7f5138888b7088876714737c36d81231852275aa274a510015547b501295ab66916bf00930608c5d6aa50bb1b06bb98e1cf472b8c0954fa728482b08
- TLSH T108017B88851FF36904605496A4FD37A697D02C7C4B123DF6F0638886678C9D38AE9AD2
- MD5 SHA1 SHA512 TLSH