f368811f3bb071d6ee006731fe819a0b7d8cd7ed5fd8110aeb5cb0da22a3a3a7

General

Target

BLTools-v2.2.exe
Size

4.5MB
MD5

ef5ee302110f10993a991fd9a2350594
SHA1

a3f020240217e95c952a4f17cfe101193db1f478
SHA256

f368811f3bb071d6ee006731fe819a0b7d8cd7ed5fd8110aeb5cb0da22a3a3a7
SHA512

5d5ade7075ba155046381bf1976de2e05bb355f897075930571f09c398ca9fbd28b499ce82cb13dd3139a9490c4f52237a4eba7e36b6b8fb536ce96af156fdc6
SSDEEP

98304:W3AsFVBrtaVHd+A1NTzIHG/4EfZRo6gW0bW+egt8qXLbkse219FdVVN3kzes:1wG9+A1NTzOPKZRo6gWG9egCqXLbN5hO

Score

10^/10

Malware Config

Signatures

Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs

description	pid	Process	procid_target
PID 2008 created 1268	2008	BLTools-v2.2.exe	8

Executes dropped EXE 1 IoCs

pid	Process
1572	BLTools v2.2.exe

Loads dropped DLL 5 IoCs

pid	Process
1108	WerFault.exe
1108	WerFault.exe
1108	WerFault.exe
1108	WerFault.exe
1108	WerFault.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

pid	Process
876	BLTools-v2.2.exe
876	BLTools-v2.2.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2008 set thread context of 876	2008	BLTools-v2.2.exe	28

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1108	1572	WerFault.exe	30

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
876	BLTools-v2.2.exe

Suspicious use of WriteProcessMemory 18 IoCs

description	pid	Process	procid_target
PID 2008 wrote to memory of 876	2008	BLTools-v2.2.exe	28
PID 2008 wrote to memory of 876	2008	BLTools-v2.2.exe	28
PID 2008 wrote to memory of 876	2008	BLTools-v2.2.exe	28
PID 2008 wrote to memory of 876	2008	BLTools-v2.2.exe	28
PID 2008 wrote to memory of 876	2008	BLTools-v2.2.exe	28
PID 2008 wrote to memory of 876	2008	BLTools-v2.2.exe	28
PID 2008 wrote to memory of 876	2008	BLTools-v2.2.exe	28
PID 2008 wrote to memory of 876	2008	BLTools-v2.2.exe	28
PID 2008 wrote to memory of 876	2008	BLTools-v2.2.exe	28
PID 2008 wrote to memory of 876	2008	BLTools-v2.2.exe	28
PID 2008 wrote to memory of 1572	2008	BLTools-v2.2.exe	30
PID 2008 wrote to memory of 1572	2008	BLTools-v2.2.exe	30
PID 2008 wrote to memory of 1572	2008	BLTools-v2.2.exe	30
PID 2008 wrote to memory of 1572	2008	BLTools-v2.2.exe	30
PID 1572 wrote to memory of 1108	1572	BLTools v2.2.exe	31
PID 1572 wrote to memory of 1108	1572	BLTools v2.2.exe	31
PID 1572 wrote to memory of 1108	1572	BLTools v2.2.exe	31
PID 1572 wrote to memory of 1108	1572	BLTools v2.2.exe	31

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:1268
- C:\Users\Admin\AppData\Local\Temp\BLTools-v2.2.exe
  "C:\Users\Admin\AppData\Local\Temp\BLTools-v2.2.exe"
  2⤵
  - Suspicious use of NtCreateUserProcessOtherParentProcess
  - Suspicious use of SetThreadContext
  - Suspicious use of WriteProcessMemory
  PID:2008
- - C:\Users\Admin\AppData\Local\Temp\BLTools v2.2.exe
    "C:\Users\Admin\AppData\Local\Temp\BLTools v2.2.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:1572
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1572 -s 664
      4⤵
      Loads dropped DLL
      Program crash
      PID:1108
- C:\Users\Admin\AppData\Local\Temp\BLTools-v2.2.exe
  "C:\Users\Admin\AppData\Local\Temp\BLTools-v2.2.exe"
  2⤵
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Suspicious behavior: EnumeratesProcesses
  PID:876

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\BLTools v2.2.exe

Filesize
4.6MB

MD5
31b01cdaebe52fe31f74cd083a18fb88

SHA1
2501d0927aafe0e33c3750501f45a2984f6b2fdb

SHA256
120b0dc2fec8495fd608890cee10cf68e8ce2b97561bb044c2ce28990f017716

SHA512
ca8b94efa40c10b059cf885d61e57812eaa21228e744f33891c87db9790d2a1fe034d797a9faa6124a03911865366c9ebb273c0681f6d2329567971598e4b529

Download Submit
C:\Users\Admin\AppData\Local\Temp\BLTools v2.2.exe

Filesize
4.6MB

MD5
31b01cdaebe52fe31f74cd083a18fb88

SHA1
2501d0927aafe0e33c3750501f45a2984f6b2fdb

SHA256
120b0dc2fec8495fd608890cee10cf68e8ce2b97561bb044c2ce28990f017716

SHA512
ca8b94efa40c10b059cf885d61e57812eaa21228e744f33891c87db9790d2a1fe034d797a9faa6124a03911865366c9ebb273c0681f6d2329567971598e4b529

Download Submit
C:\Users\Admin\AppData\Local\Temp\BLTools v2.2.exe

Filesize
4.6MB

MD5
31b01cdaebe52fe31f74cd083a18fb88

SHA1
2501d0927aafe0e33c3750501f45a2984f6b2fdb

SHA256
120b0dc2fec8495fd608890cee10cf68e8ce2b97561bb044c2ce28990f017716

SHA512
ca8b94efa40c10b059cf885d61e57812eaa21228e744f33891c87db9790d2a1fe034d797a9faa6124a03911865366c9ebb273c0681f6d2329567971598e4b529

Download Submit
\Users\Admin\AppData\Local\Temp\BLTools v2.2.exe

Filesize
4.6MB

MD5
31b01cdaebe52fe31f74cd083a18fb88

SHA1
2501d0927aafe0e33c3750501f45a2984f6b2fdb

SHA256
120b0dc2fec8495fd608890cee10cf68e8ce2b97561bb044c2ce28990f017716

SHA512
ca8b94efa40c10b059cf885d61e57812eaa21228e744f33891c87db9790d2a1fe034d797a9faa6124a03911865366c9ebb273c0681f6d2329567971598e4b529

Download Submit
\Users\Admin\AppData\Local\Temp\BLTools v2.2.exe

Filesize
4.6MB

MD5
31b01cdaebe52fe31f74cd083a18fb88

SHA1
2501d0927aafe0e33c3750501f45a2984f6b2fdb

SHA256
120b0dc2fec8495fd608890cee10cf68e8ce2b97561bb044c2ce28990f017716

SHA512
ca8b94efa40c10b059cf885d61e57812eaa21228e744f33891c87db9790d2a1fe034d797a9faa6124a03911865366c9ebb273c0681f6d2329567971598e4b529

Download Submit
\Users\Admin\AppData\Local\Temp\BLTools v2.2.exe

Filesize
4.6MB

MD5
31b01cdaebe52fe31f74cd083a18fb88

SHA1
2501d0927aafe0e33c3750501f45a2984f6b2fdb

SHA256
120b0dc2fec8495fd608890cee10cf68e8ce2b97561bb044c2ce28990f017716

SHA512
ca8b94efa40c10b059cf885d61e57812eaa21228e744f33891c87db9790d2a1fe034d797a9faa6124a03911865366c9ebb273c0681f6d2329567971598e4b529

Download Submit
\Users\Admin\AppData\Local\Temp\BLTools v2.2.exe

Filesize
4.6MB

MD5
31b01cdaebe52fe31f74cd083a18fb88

SHA1
2501d0927aafe0e33c3750501f45a2984f6b2fdb

SHA256
120b0dc2fec8495fd608890cee10cf68e8ce2b97561bb044c2ce28990f017716

SHA512
ca8b94efa40c10b059cf885d61e57812eaa21228e744f33891c87db9790d2a1fe034d797a9faa6124a03911865366c9ebb273c0681f6d2329567971598e4b529

Download Submit
\Users\Admin\AppData\Local\Temp\BLTools v2.2.exe

Filesize
4.6MB

MD5
31b01cdaebe52fe31f74cd083a18fb88

SHA1
2501d0927aafe0e33c3750501f45a2984f6b2fdb

SHA256
120b0dc2fec8495fd608890cee10cf68e8ce2b97561bb044c2ce28990f017716

SHA512
ca8b94efa40c10b059cf885d61e57812eaa21228e744f33891c87db9790d2a1fe034d797a9faa6124a03911865366c9ebb273c0681f6d2329567971598e4b529

Download Submit
memory/876-84-0x0000000140000000-0x0000000140E3A000-memory.dmp

Filesize
14.2MB

Download
memory/876-80-0x0000000140000000-0x0000000140E3A000-memory.dmp

Filesize
14.2MB

Download
memory/876-66-0x0000000140000000-0x0000000140E3A000-memory.dmp

Filesize
14.2MB

Download
memory/876-63-0x0000000140000000-0x0000000140E3A000-memory.dmp

Filesize
14.2MB

Download
memory/876-65-0x0000000140000000-0x0000000140E3A000-memory.dmp

Filesize
14.2MB

Download
memory/876-93-0x000007FFFFBD0000-0x000007FFFFFA1000-memory.dmp

Filesize
3.8MB

Download
memory/876-73-0x0000000140000000-0x0000000140E3A000-memory.dmp

Filesize
14.2MB

Download
memory/876-74-0x0000000140000000-0x0000000140E3A000-memory.dmp

Filesize
14.2MB

Download
memory/876-86-0x0000000140000000-0x0000000140E3A000-memory.dmp

Filesize
14.2MB

Download
memory/876-76-0x0000000140000000-0x0000000140E3A000-memory.dmp

Filesize
14.2MB

Download
memory/876-56-0x0000000140000000-0x0000000140E3A000-memory.dmp

Filesize
14.2MB

Download
memory/876-77-0x0000000140000000-0x0000000140E3A000-memory.dmp

Filesize
14.2MB

Download
memory/876-79-0x0000000140000000-0x0000000140E3A000-memory.dmp

Filesize
14.2MB

Download
memory/876-67-0x000007FFFFBD0000-0x000007FFFFFA1000-memory.dmp

Filesize
3.8MB

Download
memory/876-81-0x0000000140000000-0x0000000140E3A000-memory.dmp

Filesize
14.2MB

Download
memory/876-82-0x0000000140000000-0x0000000140E3A000-memory.dmp

Filesize
14.2MB

Download
memory/876-58-0x0000000140000000-0x0000000140E3A000-memory.dmp

Filesize
14.2MB

Download
memory/876-83-0x0000000001000000-0x0000000001010000-memory.dmp

Filesize
64KB

Download
memory/876-85-0x00000000775A0000-0x00000000775B0000-memory.dmp

Filesize
64KB

Download
memory/876-62-0x0000000140000000-0x0000000140E3A000-memory.dmp

Filesize
14.2MB

Download
memory/876-61-0x0000000140000000-0x0000000140E3A000-memory.dmp

Filesize
14.2MB

Download
memory/1572-78-0x0000000004FD0000-0x0000000005010000-memory.dmp

Filesize
256KB

Download
memory/1572-75-0x0000000000DA0000-0x000000000123A000-memory.dmp

Filesize
4.6MB

Download
memory/1572-95-0x0000000004FD0000-0x0000000005010000-memory.dmp

Filesize
256KB

Download
memory/2008-54-0x0000000001080000-0x00000000014FE000-memory.dmp

Filesize
4.5MB

Download
memory/2008-64-0x000000001CE40000-0x000000001CEC0000-memory.dmp

Filesize
512KB

Download
memory/2008-55-0x000000001C800000-0x000000001CC58000-memory.dmp

Filesize
4.3MB

Download

Analysis

Sharing