Overview
overview
3Static
static
3AMDUnityPlugin.dll
windows10-2004-x64
1AMDUnityPlugin.dll
windows11-ltsc_2024-x64
1NVUnityPlugin.dll
windows10-2004-x64
1NVUnityPlugin.dll
windows11-ltsc_2024-x64
1The Ghost�...re.exe
windows10-2004-x64
1The Ghost�...re.exe
windows11-ltsc_2024-x64
1UnityCrash...64.exe
windows10-2004-x64
1UnityCrash...64.exe
windows11-ltsc_2024-x64
1UnityPlayer.dll
windows10-2004-x64
1UnityPlayer.dll
windows11-ltsc_2024-x64
1nvngx_dlss.dll
windows10-2004-x64
1nvngx_dlss.dll
windows11-ltsc_2024-x64
1Analysis
- max time kernel
149s - max time network
154s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
27/07/2026, 16:57
Static task
static1
Behavioral task
behavioral1
Sample
AMDUnityPlugin.dll
Resource
win10v2004-20260513-en
Behavioral task
behavioral2
Sample
AMDUnityPlugin.dll
Resource
win11ltsc2024-20260710-en
Behavioral task
behavioral3
Sample
NVUnityPlugin.dll
Resource
win10v2004-20260513-en
Behavioral task
behavioral4
Sample
NVUnityPlugin.dll
Resource
win11ltsc2024-20260709-en
Behavioral task
behavioral5
Sample
The Ghost’s Intimate Cure.exe
Resource
win10v2004-20260513-en
Behavioral task
behavioral6
Sample
The Ghost’s Intimate Cure.exe
Resource
win11ltsc2024-20260709-en
Behavioral task
behavioral7
Sample
UnityCrashHandler64.exe
Resource
win10v2004-20260513-en
Behavioral task
behavioral8
Sample
UnityCrashHandler64.exe
Resource
win11ltsc2024-20260709-en
Behavioral task
behavioral9
Sample
UnityPlayer.dll
Resource
win10v2004-20260513-en
Behavioral task
behavioral10
Sample
UnityPlayer.dll
Resource
win11ltsc2024-20260709-en
Behavioral task
behavioral11
Sample
nvngx_dlss.dll
Resource
win10v2004-20260513-en
Behavioral task
behavioral12
Sample
nvngx_dlss.dll
Resource
win11ltsc2024-20260709-en
General
- Target The Ghost’s Intimate Cure.exe
- Size 652KB
- Sample260727-vgl8mscb59
- SHA256 b4107fe7c1d023f04795b4329bc98ea90b3d81b3f2a4cc5c386c8caf3f706992
- MD5 7f4202a4390e0b8700b134d23f860391
- SHA1 6a550f1829ab97a07204e9da001cb9d07caa5ea6
- SHA512 3758e0efb93312e9651eabf25dd02c1f275b4ab1557511fb56606ba386ec85443a61bfd3062f9ce0a7e15a1a52dbc9d6608cf39de9d684507af82944cc62cd14
- SSDEEP 6144:IaMjvuUwZpaUhLY6jNRb23E+sDo9kbONBUvLxdQuOt2lew4sPG3KShuisyY3W2Q0:ItVwZpXhWsvPQqyhVXWFdPiS
- TLSH T1B0E4E906171ADDCBD307367DE6F0F36A42A893F86477CAD69E230481BE25D85AD181F8
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 3196 The Ghost’s Intimate Cure.exe 3196 The Ghost’s Intimate Cure.exe - Suspicious use of WriteProcessMemory 2 IoCs
description pid Process procid_target PID 3196 wrote to memory of 2364 3196 The Ghost’s Intimate Cure.exe 88 PID 2364 wrote to memory of 3768 2364 UnityCrashHandler64.exe 89
Processes
-
C:\Users\Admin\AppData\Local\Temp\The Ghost’s Intimate Cure.exe"C:\Users\Admin\AppData\Local\Temp\The Ghost’s Intimate Cure.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3196 -
C:\Users\Admin\AppData\Local\Temp\UnityCrashHandler64.exe"C:\Users\Admin\AppData\Local\Temp\UnityCrashHandler64.exe" --attach 3196 28512722657282⤵
- Suspicious use of WriteProcessMemory
PID:2364 -
C:\Users\Admin\AppData\Local\Temp\UnityCrashHandler64.exe"C:\Users\Admin\AppData\Local\Temp\UnityCrashHandler64.exe" "3196" "2851272265728" "cbmUrl=" "cbmFile="3⤵PID:3768
-
-