Analysis
- max time kernel
149s - max time network
146s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
10/08/2026, 05:58
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
a2bdd1bfafa3a08024c49f2e24b17774ea90b1d68bc53308eb09dbac0eb1a6fc.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
14 signatures
150 seconds
Behavioral task
behavioral2
Sample
a2bdd1bfafa3a08024c49f2e24b17774ea90b1d68bc53308eb09dbac0eb1a6fc.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
13 signatures
150 seconds
General
- Target a2bdd1bfafa3a08024c49f2e24b17774ea90b1d68bc53308eb09dbac0eb1a6fc.exe
- Size 25KB
- Sample260810-gpdpksed72
- SHA256 a2bdd1bfafa3a08024c49f2e24b17774ea90b1d68bc53308eb09dbac0eb1a6fc
- MD5 c9e8ebdae5af8e2213049969050f6169
- SHA1 b9f9c7867e2ec5c2686ecff28f90b97add44f85c
- SHA512 d14e1edfdec696bed4324973b90321913ed87662e4eba2be736879ea8fe1a067c2c4d69beb9f3ac3294a24b0e9b361c020aec3f0f384d4e517aa9c36f2c40bff
- SSDEEP 384:7Ffy1pnyEkRnykFUgHlNUhlPChtGvInisharx6YrKJpOEGTTDj6Iz05V:4kdykFUgvUPChEAi39gJpOdTTDlzY
- TLSH T1B5B229112A4B8022C3F816709A6B6117813AB8131765D9FFB28CF4E56BB41D1CCF7A3E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Malware Config
Signatures
- Gh0st RAT payload 2 IoCs
resource yara_rule behavioral1/files/0x00070000000242cd-23.dat family_gh0strat behavioral1/memory/1424-25-0x0000000003690000-0x0000000003766000-memory.dmp family_gh0strat - Downloads MZ/PE file 2 IoCs
flow pid Process 4 2596 a2bdd1bfafa3a08024c49f2e24b17774ea90b1d68bc53308eb09dbac0eb1a6fc.exe 9 2596 a2bdd1bfafa3a08024c49f2e24b17774ea90b1d68bc53308eb09dbac0eb1a6fc.exe - Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\Control Panel\International\Geo\Nation a2bdd1bfafa3a08024c49f2e24b17774ea90b1d68bc53308eb09dbac0eb1a6fc.exe - Executes dropped EXE 1 IoCs
pid Process 1424 NvBackend.exe - Loads dropped DLL 1 IoCs
pid Process 1424 NvBackend.exe - Enumerates connected drives 3 TTPs 22 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\H: NvBackend.exe File opened (read-only) \??\I: NvBackend.exe File opened (read-only) \??\N: NvBackend.exe File opened (read-only) \??\T: NvBackend.exe File opened (read-only) \??\Z: NvBackend.exe File opened (read-only) \??\B: NvBackend.exe File opened (read-only) \??\L: NvBackend.exe File opened (read-only) \??\O: NvBackend.exe File opened (read-only) \??\P: NvBackend.exe File opened (read-only) \??\S: NvBackend.exe File opened (read-only) \??\E: NvBackend.exe File opened (read-only) \??\G: NvBackend.exe File opened (read-only) \??\Q: NvBackend.exe File opened (read-only) \??\U: NvBackend.exe File opened (read-only) \??\Y: NvBackend.exe File opened (read-only) \??\J: NvBackend.exe File opened (read-only) \??\K: NvBackend.exe File opened (read-only) \??\M: NvBackend.exe File opened (read-only) \??\R: NvBackend.exe File opened (read-only) \??\V: NvBackend.exe File opened (read-only) \??\W: NvBackend.exe File opened (read-only) \??\X: NvBackend.exe - Indicator Removal: File Deletion 1 TTPs
Adversaries may delete files left behind by the actions of their intrusion activity.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language a2bdd1bfafa3a08024c49f2e24b17774ea90b1d68bc53308eb09dbac0eb1a6fc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language NvBackend.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe - Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 NvBackend.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz NvBackend.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1424 NvBackend.exe 1424 NvBackend.exe 1424 NvBackend.exe 1424 NvBackend.exe 1424 NvBackend.exe 1424 NvBackend.exe 1424 NvBackend.exe 1424 NvBackend.exe 1424 NvBackend.exe 1424 NvBackend.exe 1424 NvBackend.exe 1424 NvBackend.exe 1424 NvBackend.exe 1424 NvBackend.exe 1424 NvBackend.exe 1424 NvBackend.exe 1424 NvBackend.exe 1424 NvBackend.exe 1424 NvBackend.exe 1424 NvBackend.exe 1424 NvBackend.exe 1424 NvBackend.exe 1424 NvBackend.exe 1424 NvBackend.exe 1424 NvBackend.exe 1424 NvBackend.exe 1424 NvBackend.exe 1424 NvBackend.exe 1424 NvBackend.exe 1424 NvBackend.exe 1424 NvBackend.exe 1424 NvBackend.exe 1424 NvBackend.exe 1424 NvBackend.exe 1424 NvBackend.exe 1424 NvBackend.exe 1424 NvBackend.exe 1424 NvBackend.exe 1424 NvBackend.exe 1424 NvBackend.exe 1424 NvBackend.exe 1424 NvBackend.exe 1424 NvBackend.exe 1424 NvBackend.exe 1424 NvBackend.exe 1424 NvBackend.exe 1424 NvBackend.exe 1424 NvBackend.exe 1424 NvBackend.exe 1424 NvBackend.exe 1424 NvBackend.exe 1424 NvBackend.exe 1424 NvBackend.exe 1424 NvBackend.exe 1424 NvBackend.exe 1424 NvBackend.exe 1424 NvBackend.exe 1424 NvBackend.exe 1424 NvBackend.exe 1424 NvBackend.exe 1424 NvBackend.exe 1424 NvBackend.exe 1424 NvBackend.exe 1424 NvBackend.exe - Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 1424 NvBackend.exe Token: SeIncBasePriorityPrivilege 2596 a2bdd1bfafa3a08024c49f2e24b17774ea90b1d68bc53308eb09dbac0eb1a6fc.exe - Suspicious use of WriteProcessMemory 2 IoCs
description pid Process procid_target PID 2596 wrote to memory of 1424 2596 a2bdd1bfafa3a08024c49f2e24b17774ea90b1d68bc53308eb09dbac0eb1a6fc.exe 93 PID 2596 wrote to memory of 204 2596 a2bdd1bfafa3a08024c49f2e24b17774ea90b1d68bc53308eb09dbac0eb1a6fc.exe 97
Processes
-
C:\Users\Admin\AppData\Local\Temp\a2bdd1bfafa3a08024c49f2e24b17774ea90b1d68bc53308eb09dbac0eb1a6fc.exe"C:\Users\Admin\AppData\Local\Temp\a2bdd1bfafa3a08024c49f2e24b17774ea90b1d68bc53308eb09dbac0eb1a6fc.exe"1⤵
- Downloads MZ/PE file
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2596 -
C:\NvBackend.exe"C:\NvBackend.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Enumerates connected drives
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1424
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c del /q C:\Users\Admin\AppData\Local\Temp\a2bdd1bfafa3a08024c49f2e24b17774ea90b1d68bc53308eb09dbac0eb1a6fc.exe2⤵
- System Location Discovery: System Language Discovery
PID:204
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\NvBackend.exe
- Size 2.3MB
- SHA256 ad2dfda427e3ccb5c8404f0afafe71c64b862d2e26a67e1bfc2b40738fd0b873
- MD5 94a8196066774252df015eedf02cca44
- SHA1 28b6667f95888ebd0f19d98c4329a17fb1f8f27a
- SHA512 a06b1b744493b74592edf63aa7abd73ee170764e58d9e84ccb6e3e320e66d06fedc8d7901b9cd6b4509c7e327c155b87c1846c47299cd5bd08de99293fdbee5c
- SSDEEP 49152:UVmYRW+CFZW8VT9PEpgeOmuQieauFPux87IKnMewyW/BrNTx1ZHfxoKdTRvzTSZK:UzWl5VT9PEpgexauFPux877nMewyaBrH
- TLSH T133B57C1277EE902BF4B32770A939976E89B1BDB01935C04BB3501E1E7AB16C29931F53
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Server.mmp
- Size 676KB
- SHA256 60a88b726690562c65d1b153e49dacb140854fb612019def00f874e73eb2cdaa
- MD5 562262e0bfe4998445bf1e166c1fe280
- SHA1 61eb79e4515e6f443a5644b47aecda6b9c1fe731
- SHA512 f947dad395619981e027523f032268c766ab85862b2650cc250061e7d37c39ebabd3eb3bc64e72ad5a75030e422adddeab9a60ad08b9eef2681ac7aecf7b8a0d
- SSDEEP 12288:SSYbNPV21kMcM5yBNGKNxpMtRDrBz5XTLv4LT8l:Da213cM5MNGKNxpMtRDrBz5XTMLIl
- TLSH T1EEE4F683E6714CB7C7D80074DC6EE2B93B24BA6CE7F745363080E5DBB9B6095791068A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\detoured.dll
- Size 17KB
- SHA256 667a6a2154db12cc15628f56af88dcce7945fcd687c4dc5a9b767956d6e3584e
- MD5 bfbce66844498ccdad3ba148a5d260bb
- SHA1 3787c6a4b336b83faf60af07282fbbf86c211680
- SHA512 a58a3aa199b0aae7cfef0e2e410a894afd501cdd49edde08365b63cdef24423469091f9a94d62d9726a75bf89c47270600b003ab97d4dd8b78d8da399546fbe6
- SSDEEP 384:eonKEjL+THvArfvMBDG5RW7NyAmL4/y8RzG:7nd+TIrfvMBSCaLk5E
- TLSH T1A9727C42DD085977C946283433DAD9B7EA7D632326C910E7BB55C8680F823C11EF92BD
- MD5 SHA1 SHA512 SSDEEP TLSH