valleyrat_s2 | 3f813a74c7107af4e8161a3975d8e4e1368d21850efe154a144d106f3b8e1968

Analysis

max time kernel
300s
max time network
300s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
10/09/2026, 14:44

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
BE.85258942.exe
Size 4.6MB
Sample260910-r4mk5svele
SHA256 3f813a74c7107af4e8161a3975d8e4e1368d21850efe154a144d106f3b8e1968
MD5 913b8ec5e3d327178d93d0ee74aa7386
SHA1 8371e0f6632f9cfcb4c08dcfa1ab7f7fc851a783
SHA512 ea2e12e20facc2980c55ba02ea0fe3b60d9bd564a78ffb76ef2d48b597c4b597d78ec093c9d79a807b0f4bd74d3ab4321cfca6280f801f707bd643df81586831
SSDEEP 98304:UqjiIn2U7rm0yfujS5zgXMuN54OiZrq1DfPHNADtV6v+k:VjiIn2U7rm0ZS58N54O7NADtV6v+k
TLSH
T11C36AE45BEAC40D8D4AAD079C9175A1BEBB2BC515332479F0164AB9F6F337910E2F322
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

backdoor defense_evasion discovery execution valleyrat_s2 persistence ransomware

Malware Config

Signatures

Family: ValleyRat
ValleyRat stage2 is a backdoor written in C++.
backdoor valleyrat_s2

Detects ValleyRAT payload 5 IoCs

resource	yara_rule
behavioral2/memory/1004-35-0x000001F55B840000-0x000001F55B8B0000-memory.dmp	family_valleyrat_stage_2_v2
behavioral2/memory/1004-38-0x000001F55B840000-0x000001F55B8B0000-memory.dmp	family_valleyrat_stage_2_v2
behavioral2/memory/1004-36-0x000001F55B840000-0x000001F55B8B0000-memory.dmp	family_valleyrat_stage_2_v2
behavioral2/memory/1004-42-0x000001F55B840000-0x000001F55B8B0000-memory.dmp	family_valleyrat_stage_2_v2
behavioral2/memory/1004-41-0x000001F55B840000-0x000001F55B8B0000-memory.dmp	family_valleyrat_stage_2_v2

Enumerates connected drives 3 TTPs 22 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\D:	nvcontainer.FvSDKTestClient.exe
File opened (read-only)	\??\I:	nvcontainer.FvSDKTestClient.exe
File opened (read-only)	\??\M:	nvcontainer.FvSDKTestClient.exe
File opened (read-only)	\??\R:	nvcontainer.FvSDKTestClient.exe
File opened (read-only)	\??\U:	nvcontainer.FvSDKTestClient.exe
File opened (read-only)	\??\X:	nvcontainer.FvSDKTestClient.exe
File opened (read-only)	\??\N:	nvcontainer.FvSDKTestClient.exe
File opened (read-only)	\??\S:	nvcontainer.FvSDKTestClient.exe
File opened (read-only)	\??\T:	nvcontainer.FvSDKTestClient.exe
File opened (read-only)	\??\B:	nvcontainer.FvSDKTestClient.exe
File opened (read-only)	\??\G:	nvcontainer.FvSDKTestClient.exe
File opened (read-only)	\??\H:	nvcontainer.FvSDKTestClient.exe
File opened (read-only)	\??\K:	nvcontainer.FvSDKTestClient.exe
File opened (read-only)	\??\O:	nvcontainer.FvSDKTestClient.exe
File opened (read-only)	\??\Q:	nvcontainer.FvSDKTestClient.exe
File opened (read-only)	\??\V:	nvcontainer.FvSDKTestClient.exe
File opened (read-only)	\??\Y:	nvcontainer.FvSDKTestClient.exe
File opened (read-only)	\??\J:	nvcontainer.FvSDKTestClient.exe
File opened (read-only)	\??\L:	nvcontainer.FvSDKTestClient.exe
File opened (read-only)	\??\P:	nvcontainer.FvSDKTestClient.exe
File opened (read-only)	\??\W:	nvcontainer.FvSDKTestClient.exe
File opened (read-only)	\??\Z:	nvcontainer.FvSDKTestClient.exe

Looks up external IP address via web service 1 TTPs 3 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

discovery

Internet Connection Discovery

T1016.001

flow	ioc
2	api.ipify.org
2	ip-api.com
12	api.ipify.org

Discovers running processes 1 TTPs 5 IoCs

Running process information can be used to identify security tools or plan follow-on actions.

discovery

Process Discovery

T1057

pid	Process
4588	tasklist.exe
1448	tasklist.exe
5060	tasklist.exe
4488	tasklist.exe
2008	tasklist.exe

Executes dropped EXE 3 IoCs

pid	Process
1004	nvcontainer.FvSDKTestClient.exe
1212	NVIDIAZMQQsNalyQwm.pol
1196	nvcontainer.FvSDKTestClient.exe

Loads dropped DLL 2 IoCs

pid	Process
1004	nvcontainer.FvSDKTestClient.exe
1196	nvcontainer.FvSDKTestClient.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
5448	cmd.exe
908	cmd.exe
3820	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ComputerDefaults.exe

Delays execution with timeout.exe 5 IoCs

defense_evasion

pid	Process
5620	timeout.exe
1716	timeout.exe
6100	timeout.exe
1268	timeout.exe
1396	timeout.exe

Kills process with taskkill 1 IoCs

defense_evasion

pid	Process
4968	taskkill.exe

Modifies registry class 10 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\ms-settings\Shell\open\command	BE.85258942.exe
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\ms-settings\Shell	BE.85258942.exe
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\ms-settings\Shell\open	BE.85258942.exe
Key deleted	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\ms-settings\Shell	BE.85258942.exe
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\ms-settings	BE.85258942.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\ms-settings\Shell\open\command\ = "../../Users/Public/NvContainer/ifsgqZ.4855363697671971.SRY/nvcontainer.FvSDKTestClient.exe"	BE.85258942.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\ms-settings\Shell\open\command\DelegateExecute = "뤀"	BE.85258942.exe
Key deleted	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\ms-settings\Shell\open\command	BE.85258942.exe
Key deleted	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\ms-settings\Shell\open	BE.85258942.exe
Key deleted	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\ms-settings	BE.85258942.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1004	nvcontainer.FvSDKTestClient.exe
1004	nvcontainer.FvSDKTestClient.exe
1004	nvcontainer.FvSDKTestClient.exe
1004	nvcontainer.FvSDKTestClient.exe
1004	nvcontainer.FvSDKTestClient.exe
1004	nvcontainer.FvSDKTestClient.exe
1004	nvcontainer.FvSDKTestClient.exe
1004	nvcontainer.FvSDKTestClient.exe
1004	nvcontainer.FvSDKTestClient.exe
1004	nvcontainer.FvSDKTestClient.exe
1004	nvcontainer.FvSDKTestClient.exe
1004	nvcontainer.FvSDKTestClient.exe
1004	nvcontainer.FvSDKTestClient.exe
1004	nvcontainer.FvSDKTestClient.exe
1004	nvcontainer.FvSDKTestClient.exe
1004	nvcontainer.FvSDKTestClient.exe
1004	nvcontainer.FvSDKTestClient.exe
1004	nvcontainer.FvSDKTestClient.exe
1004	nvcontainer.FvSDKTestClient.exe
1004	nvcontainer.FvSDKTestClient.exe
1004	nvcontainer.FvSDKTestClient.exe
1004	nvcontainer.FvSDKTestClient.exe
1004	nvcontainer.FvSDKTestClient.exe
1004	nvcontainer.FvSDKTestClient.exe
1004	nvcontainer.FvSDKTestClient.exe
1004	nvcontainer.FvSDKTestClient.exe
1004	nvcontainer.FvSDKTestClient.exe
1004	nvcontainer.FvSDKTestClient.exe
1004	nvcontainer.FvSDKTestClient.exe
1004	nvcontainer.FvSDKTestClient.exe
1004	nvcontainer.FvSDKTestClient.exe
1004	nvcontainer.FvSDKTestClient.exe
1004	nvcontainer.FvSDKTestClient.exe
1004	nvcontainer.FvSDKTestClient.exe
1004	nvcontainer.FvSDKTestClient.exe
1004	nvcontainer.FvSDKTestClient.exe
1004	nvcontainer.FvSDKTestClient.exe
1004	nvcontainer.FvSDKTestClient.exe
1004	nvcontainer.FvSDKTestClient.exe
1004	nvcontainer.FvSDKTestClient.exe
1004	nvcontainer.FvSDKTestClient.exe
1004	nvcontainer.FvSDKTestClient.exe
1004	nvcontainer.FvSDKTestClient.exe
1004	nvcontainer.FvSDKTestClient.exe
1004	nvcontainer.FvSDKTestClient.exe
1004	nvcontainer.FvSDKTestClient.exe
1004	nvcontainer.FvSDKTestClient.exe
1004	nvcontainer.FvSDKTestClient.exe
1004	nvcontainer.FvSDKTestClient.exe
1004	nvcontainer.FvSDKTestClient.exe
1004	nvcontainer.FvSDKTestClient.exe
1004	nvcontainer.FvSDKTestClient.exe
1004	nvcontainer.FvSDKTestClient.exe
1004	nvcontainer.FvSDKTestClient.exe
1004	nvcontainer.FvSDKTestClient.exe
1004	nvcontainer.FvSDKTestClient.exe
1004	nvcontainer.FvSDKTestClient.exe
1004	nvcontainer.FvSDKTestClient.exe
1004	nvcontainer.FvSDKTestClient.exe
1004	nvcontainer.FvSDKTestClient.exe
1004	nvcontainer.FvSDKTestClient.exe
1004	nvcontainer.FvSDKTestClient.exe
1004	nvcontainer.FvSDKTestClient.exe
1004	nvcontainer.FvSDKTestClient.exe

Suspicious behavior: LoadsDriver 64 IoCs

pid	Process
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found

Suspicious use of AdjustPrivilegeToken 46 IoCs

description	pid	Process
Token: SeDebugPrivilege	1004	nvcontainer.FvSDKTestClient.exe
Token: SeLoadDriverPrivilege	1004	nvcontainer.FvSDKTestClient.exe
Token: SeTakeOwnershipPrivilege	1004	nvcontainer.FvSDKTestClient.exe
Token: SeIncBasePriorityPrivilege	1004	nvcontainer.FvSDKTestClient.exe
Token: SeTcbPrivilege	1004	nvcontainer.FvSDKTestClient.exe
Token: SeDebugPrivilege	4968	taskkill.exe
Token: SeDebugPrivilege	1004	nvcontainer.FvSDKTestClient.exe
Token: SeCreateTokenPrivilege	1004	nvcontainer.FvSDKTestClient.exe
Token: SeAssignPrimaryTokenPrivilege	1004	nvcontainer.FvSDKTestClient.exe
Token: SeLockMemoryPrivilege	1004	nvcontainer.FvSDKTestClient.exe
Token: SeIncreaseQuotaPrivilege	1004	nvcontainer.FvSDKTestClient.exe
Token: SeMachineAccountPrivilege	1004	nvcontainer.FvSDKTestClient.exe
Token: SeTcbPrivilege	1004	nvcontainer.FvSDKTestClient.exe
Token: SeSecurityPrivilege	1004	nvcontainer.FvSDKTestClient.exe
Token: SeTakeOwnershipPrivilege	1004	nvcontainer.FvSDKTestClient.exe
Token: SeLoadDriverPrivilege	1004	nvcontainer.FvSDKTestClient.exe
Token: SeSystemProfilePrivilege	1004	nvcontainer.FvSDKTestClient.exe
Token: SeSystemtimePrivilege	1004	nvcontainer.FvSDKTestClient.exe
Token: SeProfSingleProcessPrivilege	1004	nvcontainer.FvSDKTestClient.exe
Token: SeIncBasePriorityPrivilege	1004	nvcontainer.FvSDKTestClient.exe
Token: SeCreatePagefilePrivilege	1004	nvcontainer.FvSDKTestClient.exe
Token: SeCreatePermanentPrivilege	1004	nvcontainer.FvSDKTestClient.exe
Token: SeBackupPrivilege	1004	nvcontainer.FvSDKTestClient.exe
Token: SeRestorePrivilege	1004	nvcontainer.FvSDKTestClient.exe
Token: SeShutdownPrivilege	1004	nvcontainer.FvSDKTestClient.exe
Token: SeDebugPrivilege	1004	nvcontainer.FvSDKTestClient.exe
Token: SeAuditPrivilege	1004	nvcontainer.FvSDKTestClient.exe
Token: SeSystemEnvironmentPrivilege	1004	nvcontainer.FvSDKTestClient.exe
Token: SeChangeNotifyPrivilege	1004	nvcontainer.FvSDKTestClient.exe
Token: SeRemoteShutdownPrivilege	1004	nvcontainer.FvSDKTestClient.exe
Token: SeUndockPrivilege	1004	nvcontainer.FvSDKTestClient.exe
Token: SeSyncAgentPrivilege	1004	nvcontainer.FvSDKTestClient.exe
Token: SeEnableDelegationPrivilege	1004	nvcontainer.FvSDKTestClient.exe
Token: SeManageVolumePrivilege	1004	nvcontainer.FvSDKTestClient.exe
Token: SeImpersonatePrivilege	1004	nvcontainer.FvSDKTestClient.exe
Token: SeCreateGlobalPrivilege	1004	nvcontainer.FvSDKTestClient.exe
Token: 31	1004	nvcontainer.FvSDKTestClient.exe
Token: 32	1004	nvcontainer.FvSDKTestClient.exe
Token: 33	1004	nvcontainer.FvSDKTestClient.exe
Token: 34	1004	nvcontainer.FvSDKTestClient.exe
Token: 35	1004	nvcontainer.FvSDKTestClient.exe
Token: SeDebugPrivilege	4588	tasklist.exe
Token: SeDebugPrivilege	1448	tasklist.exe
Token: SeDebugPrivilege	5060	tasklist.exe
Token: SeDebugPrivilege	4488	tasklist.exe
Token: SeDebugPrivilege	2008	tasklist.exe

Suspicious use of SetWindowsHookEx 7 IoCs

pid	Process
3456	BE.85258942.exe
3456	BE.85258942.exe
1004	nvcontainer.FvSDKTestClient.exe
1004	nvcontainer.FvSDKTestClient.exe
1004	nvcontainer.FvSDKTestClient.exe
1196	nvcontainer.FvSDKTestClient.exe
1196	nvcontainer.FvSDKTestClient.exe

Suspicious use of WriteProcessMemory 21 IoCs

description	pid	Process	procid_target
PID 3456 wrote to memory of 5448	3456	BE.85258942.exe	89
PID 5448 wrote to memory of 1704	5448	cmd.exe	91
PID 1704 wrote to memory of 1004	1704	ComputerDefaults.exe	92
PID 1004 wrote to memory of 4968	1004	nvcontainer.FvSDKTestClient.exe	96
PID 1004 wrote to memory of 908	1004	nvcontainer.FvSDKTestClient.exe	101
PID 908 wrote to memory of 3820	908	cmd.exe	104
PID 3820 wrote to memory of 4588	3820	cmd.exe	105
PID 3820 wrote to memory of 5964	3820	cmd.exe	106
PID 3820 wrote to memory of 6100	3820	cmd.exe	107
PID 3820 wrote to memory of 1448	3820	cmd.exe	108
PID 3820 wrote to memory of 3160	3820	cmd.exe	109
PID 3820 wrote to memory of 1268	3820	cmd.exe	110
PID 3820 wrote to memory of 5060	3820	cmd.exe	111
PID 3820 wrote to memory of 2960	3820	cmd.exe	112
PID 3820 wrote to memory of 1396	3820	cmd.exe	113
PID 3820 wrote to memory of 4488	3820	cmd.exe	114
PID 3820 wrote to memory of 720	3820	cmd.exe	115
PID 3820 wrote to memory of 5620	3820	cmd.exe	116
PID 3820 wrote to memory of 2008	3820	cmd.exe	117
PID 3820 wrote to memory of 1344	3820	cmd.exe	118
PID 3820 wrote to memory of 1716	3820	cmd.exe	119

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\BE.85258942.exe
"C:\Users\Admin\AppData\Local\Temp\BE.85258942.exe"
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3456
- C:\Windows\SysWOW64\cmd.exe
  /c C:\Windows\SysWOW64\ComputerDefaults.exe
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5448
- - C:\Windows\SysWOW64\ComputerDefaults.exe
    C:\Windows\SysWOW64\ComputerDefaults.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1704
  - - C:\Users\Public\NvContainer\ifsgqZ.4855363697671971.SRY\nvcontainer.FvSDKTestClient.exe
      "nvcontainer.FvSDKTestClient.exe"
      4⤵
      Enumerates connected drives
      Executes dropped EXE
      Loads dropped DLL
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:1004
    - - C:\Windows\SYSTEM32\taskkill.exe
        
        taskkill /f /im cmd.exe
        5⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:4968
    - - C:\Windows\SYSTEM32\cmd.exe
        
        cmd.exe /c start "" /B cmd /C "C:\Users\Public\NVIDIA Corporation\S-1-5-21-1738198120-2966725515-3980530802\S-1-5-21-1738198120-2966725515-3980530802.bAt"
        5⤵
        Executes a command shell one-liner
        Suspicious use of WriteProcessMemory
        
        PID:908
      - C:\Windows\system32\cmd.exe
        
        cmd /C "C:\Users\Public\NVIDIA Corporation\S-1-5-21-1738198120-2966725515-3980530802\S-1-5-21-1738198120-2966725515-3980530802.bAt"
        6⤵
        Executes a command shell one-liner
        Suspicious use of WriteProcessMemory
        
        PID:3820
        
        C:\Windows\system32\tasklist.exe
        
        TASKLIST /FI "IMAGENAME eq nvcontainer.FvSDKTestClient.exe" /FO CSV
        7⤵
        Discovers running processes
        Suspicious use of AdjustPrivilegeToken
        
        PID:4588
        
        C:\Windows\system32\find.exe
        
        FIND /I "nvcontainer.FvSDKTestClient.exe"
        7⤵
        
        PID:5964
        
        C:\Windows\system32\timeout.exe
        
        TIMEOUT /t 60 /nobreak
        7⤵
        Delays execution with timeout.exe
        
        PID:6100
        
        C:\Windows\system32\tasklist.exe
        
        TASKLIST /FI "IMAGENAME eq nvcontainer.FvSDKTestClient.exe" /FO CSV
        7⤵
        Discovers running processes
        Suspicious use of AdjustPrivilegeToken
        
        PID:1448
        
        C:\Windows\system32\find.exe
        
        FIND /I "nvcontainer.FvSDKTestClient.exe"
        7⤵
        
        PID:3160
        
        C:\Windows\system32\timeout.exe
        
        TIMEOUT /t 60 /nobreak
        7⤵
        Delays execution with timeout.exe
        
        PID:1268
        
        C:\Windows\system32\tasklist.exe
        
        TASKLIST /FI "IMAGENAME eq nvcontainer.FvSDKTestClient.exe" /FO CSV
        7⤵
        Discovers running processes
        Suspicious use of AdjustPrivilegeToken
        
        PID:5060
        
        C:\Windows\system32\find.exe
        
        FIND /I "nvcontainer.FvSDKTestClient.exe"
        7⤵
        
        PID:2960
        
        C:\Windows\system32\timeout.exe
        
        TIMEOUT /t 60 /nobreak
        7⤵
        Delays execution with timeout.exe
        
        PID:1396
        
        C:\Windows\system32\tasklist.exe
        
        TASKLIST /FI "IMAGENAME eq nvcontainer.FvSDKTestClient.exe" /FO CSV
        7⤵
        Discovers running processes
        Suspicious use of AdjustPrivilegeToken
        
        PID:4488
        
        C:\Windows\system32\find.exe
        
        FIND /I "nvcontainer.FvSDKTestClient.exe"
        7⤵
        
        PID:720
        
        C:\Windows\system32\timeout.exe
        
        TIMEOUT /t 60 /nobreak
        7⤵
        Delays execution with timeout.exe
        
        PID:5620
        
        C:\Windows\system32\tasklist.exe
        
        TASKLIST /FI "IMAGENAME eq nvcontainer.FvSDKTestClient.exe" /FO CSV
        7⤵
        Discovers running processes
        Suspicious use of AdjustPrivilegeToken
        
        PID:2008
        
        C:\Windows\system32\find.exe
        
        FIND /I "nvcontainer.FvSDKTestClient.exe"
        7⤵
        
        PID:1344
        
        C:\Windows\system32\timeout.exe
        
        TIMEOUT /t 60 /nobreak
        7⤵
        Delays execution with timeout.exe
        
        PID:1716

C:\Users\Public\NVIDIAZMQQsNalyQwm.pol
C:\Users\Public\NVIDIAZMQQsNalyQwm.pol
1⤵
- Executes dropped EXE
PID:1212

C:\Users\Public\NvContainer\ifsgqZ.4855363697671971.SRY\nvcontainer.FvSDKTestClient.exe
C:\Users\Public\NvContainer\ifsgqZ.4855363697671971.SRY\nvcontainer.FvSDKTestClient.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:1196

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Process Discovery

T1057

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

S-1-5-21-1738198120-2966725515-3980530802.bAt

Path C:\Users\Public\NVIDIA Corporation\S-1-5-21-1738198120-2966725515-3980530802\S-1-5-21-1738198120-2966725515-3980530802.bAt
Size 1KB
SHA256 e0727507d447fb483bb1bdae71457cbea9604144a4feda4611e1e8e7f1786cae
MD5 44140fee7f74dbbbc42b0e8a3539a499
SHA1 327a8a4140a2d8bc88523ac115db21b8ea336201
SHA512 7a325c6c927e444367aeb918a5dd841e94e26f37f333b37bf0878d59b3410fedb1a92e03ebb0399e4942426fcbd101e8805402167c1e73a509079d20bf55d975
TLSH
T10D31FD9F84134C2C431003DF220ACC6ACAA0F043E9C131A0B1A86B952381E9D0956AAD
MD5 SHA1 SHA512 TLSH

Submit Download

NVIDIASpKVVQzEwLcENTRc.pol

Path C:\Users\Public\NVIDIASpKVVQzEwLcENTRc.pol
Size 32KB
SHA256 fb1c10d2d9e89ae8263faaed9b211bd1585896fc8eb4bc21622942a8a22cee09
MD5 c260608456e573a9d4de3c935648086e
SHA1 eabc6ee5869e011ae01014fdd8a89be3d237dd5b
SHA512 24c5edcf96081705028704ab7529225dd911630be668ca7593cbc7cab107b72a62c000f7cf8adabeca04474e81c474446fe471a3ee9006b377dfcb3bb49f72a2
SSDEEP 768:Nf+Wus4O4cTO2z2BuaVDNgijrrwn2899zud:1GF29aNgyw2szud
TLSH
T1B4E24BC966B804CAE6F782B4C2F9D6A6B970BA53172343EF0161C5740D63FD0DA35B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NVIDIASpKVVQzEwLcENTRc.pol.efi

Path C:\Users\Public\NVIDIASpKVVQzEwLcENTRc.pol.efi
Size 32KB
SHA256 2e6787d43dba3bedda77f0be38003638356aa73fce71f1a5be62cff435dd3e08
MD5 c0d0cf696f374cc544c98acece868d3f
SHA1 7ae87b3344ed4760eb5cba87dcc2bf1559f30bae
SHA512 2c432d0de6b53e32276cdc74bc9a5c5d1f6eeffd14bd68477368e95c1c6bc4822438363dda79245e215277ce322067eb559f171070f6552c5ac22d9ad7ba514a
SSDEEP 768:QuQDTBbL3DHDmYvrf5cWbie4tUtXExgooO0NBgdalc:QugHPGWb14mg0NidaC
TLSH
T15FE2F11019EB63A0F32E87088B6BC66F1EF1375A3E8D2A15805BF3300AD75466CDCAD5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NVIDIAZMQQsNalyQwm.pol

Path C:\Users\Public\NVIDIAZMQQsNalyQwm.pol
Size 17KB
SHA256 671e564fa73da5f33f6591d27eef6d3f02264c94f4cf85328bab1412a7fcb687
MD5 a736339a04448a02b654b8dcf3f7a8de
SHA1 45b324e0045ca76a70ebd3774b300c771b57025d
SHA512 4fb474795237afc8c14c6cf9e90122efa497dcfe014eb689ed9ee1e0ede69001a1d83dc244dcbebaac567bbc3019f8476171f6edb80cc6bfca401fb610c6601f
SSDEEP 192:JgvuYacCCpQIw9l0HKs0zTQxmaYe+PjP4wBjtlAv6YHmVm1OoG:JsuoCCpQIY0HKs0vkmaYPL4OUSYGVm1k
TLSH
T15B826D8B876920AAFAE7C935C2A18677FC30FAD077564AFF4119C1911E81FE05B3D209
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NVIDIAZMQQsNalyQwm.pol.efi

Path C:\Users\Public\NVIDIAZMQQsNalyQwm.pol.efi
Size 17KB
SHA256 e6193eb204fe085e7a982aeb99ca8409c44ab4e675f9149d47ee8dd5a1dd3155
MD5 8b7bd574f4b632516065df24309962c4
SHA1 98b9a5f2b4ad27e61686b6c2ec0ec4200628112f
SHA512 ea99696a55a4326987c7a5e51ca8c077c2ea8a286c6ba234fd4284f83f2fbb06d5d7f15455e1c09b20208c6f07f7849b625ea377c1743cf29248b2d1eea2f2f5
SSDEEP 384:hJMrbrFGnAedVJ2MIEOYxUPbFPHil02qx6yB/T1fqNMd32py:hSxMLoMH+vil0Pxjb1fFd32M
TLSH
T17382E11AD8DDEDF0EA6526054A73A1E2F54E5EDC24AC1E3A0831C7190F059C7DCA3338
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WeBvIew2loADEr.dll

Path C:\Users\Public\NvContainer\ifsgqZ.4855363697671971.SRY\WeBvIew2loADEr.dll
Size 7.6MB
SHA256 cef390edd972288016e1a16764d52c6e55790737b76d0217ad25c38d3b2742a6
MD5 dd055810088693f7405cd80ce199e8b3
SHA1 8cf3d953933c0d285f49c335558f5360cde2d8d2
SHA512 fdb6a67dfb4698577845b0ce5bf457fb9aa7a3dd26108d65ff6df71aca54271c5cfb1c00981c6d5dfdf8f3822ea1c88e5b0504db0251794c9fd28744b92a7c49
SSDEEP 196608:2ha0pUaJEG0r26GdgqkT3KWVLQVyRDBwa5GI+7NAjtVa/u:2b4udg3Ta4DB1+7
TLSH
T10B86CF427DED00B6D4A5D032CA578DAFD3B2BC542A37965F12913B0EAF337518E1A326
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nvcontainer.FvSDKTestClient.exe

Path C:\Users\Public\NvContainer\ifsgqZ.4855363697671971.SRY\nvcontainer.FvSDKTestClient.exe
Size 4.6MB
SHA256 3f813a74c7107af4e8161a3975d8e4e1368d21850efe154a144d106f3b8e1968
MD5 913b8ec5e3d327178d93d0ee74aa7386
SHA1 8371e0f6632f9cfcb4c08dcfa1ab7f7fc851a783
SHA512 ea2e12e20facc2980c55ba02ea0fe3b60d9bd564a78ffb76ef2d48b597c4b597d78ec093c9d79a807b0f4bd74d3ab4321cfca6280f801f707bd643df81586831
SSDEEP 98304:UqjiIn2U7rm0yfujS5zgXMuN54OiZrq1DfPHNADtV6v+k:VjiIn2U7rm0ZS58N54O7NADtV6v+k
TLSH
T11C36AE45BEAC40D8D4AAD079C9175A1BEBB2BC515332479F0164AB9F6F337910E2F322
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1004-3-0x00007FF8DB420000-0x00007FF8DB683000-memory.dmp

Download

memory/1004-35-0x000001F55B840000-0x000001F55B8B0000-memory.dmp

Download

memory/1004-38-0x000001F55B840000-0x000001F55B8B0000-memory.dmp

Download

memory/1004-36-0x000001F55B840000-0x000001F55B8B0000-memory.dmp

Download

memory/1004-42-0x000001F55B840000-0x000001F55B8B0000-memory.dmp

Download

memory/1004-41-0x000001F55B840000-0x000001F55B8B0000-memory.dmp

Download

memory/1196-43-0x00007FF8DB420000-0x00007FF8DB683000-memory.dmp

Download

memory/1212-9-0x0000000000010000-0x0000000000017000-memory.dmp

Download

memory/3456-0-0x00007FF8DB420000-0x00007FF8DB683000-memory.dmp

Download