Overview
overview
10Static
static
8BuhtaClient.vbs
windows7-x64
1BuhtaClient.vbs
windows10-2004-x64
1BuhtaClient.exe
windows7-x64
10BuhtaClient.exe
windows10-2004-x64
10BuhtaDev.chm
windows7-x64
1BuhtaDev.chm
windows10-2004-x64
1BuhtaPivot.xls
windows7-x64
1BuhtaPivot.xls
windows10-2004-x64
1BuhtaServer.exe
windows7-x64
1BuhtaServer.exe
windows10-2004-x64
1PivotInstall.exe
windows7-x64
1PivotInstall.exe
windows10-2004-x64
1dsd.exe
windows7-x64
1dsd.exe
windows10-2004-x64
1eapi.dll
windows7-x64
3eapi.dll
windows10-2004-x64
3quricol32.dll
windows7-x64
1quricol32.dll
windows10-2004-x64
3Analysis
-
max time kernel
13s -
max time network
36s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
04/01/2024, 00:15
Behavioral task
behavioral1
Sample
BuhtaClient.vbs
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
BuhtaClient.vbs
Resource
win10v2004-20231215-en
Behavioral task
behavioral3
Sample
BuhtaClient.exe
Resource
win7-20231215-en
Behavioral task
behavioral4
Sample
BuhtaClient.exe
Resource
win10v2004-20231215-en
Behavioral task
behavioral5
Sample
BuhtaDev.chm
Resource
win7-20231215-en
Behavioral task
behavioral6
Sample
BuhtaDev.chm
Resource
win10v2004-20231215-en
Behavioral task
behavioral7
Sample
BuhtaPivot.xls
Resource
win7-20231215-en
Behavioral task
behavioral8
Sample
BuhtaPivot.xls
Resource
win10v2004-20231215-en
Behavioral task
behavioral9
Sample
BuhtaServer.exe
Resource
win7-20231215-en
Behavioral task
behavioral10
Sample
BuhtaServer.exe
Resource
win10v2004-20231215-en
Behavioral task
behavioral11
Sample
PivotInstall.exe
Resource
win7-20231215-en
Behavioral task
behavioral12
Sample
PivotInstall.exe
Resource
win10v2004-20231222-en
Behavioral task
behavioral13
Sample
dsd.exe
Resource
win7-20231215-en
Behavioral task
behavioral14
Sample
dsd.exe
Resource
win10v2004-20231215-en
Behavioral task
behavioral15
Sample
eapi.dll
Resource
win7-20231129-en
Behavioral task
behavioral16
Sample
eapi.dll
Resource
win10v2004-20231215-en
Behavioral task
behavioral17
Sample
quricol32.dll
Resource
win7-20231215-en
Behavioral task
behavioral18
Sample
quricol32.dll
Resource
win10v2004-20231222-en
General
-
Target
BuhtaDev.chm
-
Size
396KB
-
MD5
2c1e5c9bd8e1a7f5a01d6840b715bcfd
-
SHA1
6261eb9affd394dfc01c8c645ef5fbd3c1b1c981
-
SHA256
2ac5beadb46df69331c214b01e7994415a15698605d04e8e2f87bea40c2d420d
-
SHA512
622192042802bdc90be8d5a96c126252be49ae3d1f51f7e40cd44d95de09110edff79934d50445297d79667d4b20d8da5c68b295f68fe0c50a25169634def0bb
-
SSDEEP
12288:nZVyrEJf+EwUEZ+voA3dCeOty3OuRHgLDpGpEGy6ULe:nurEd+X+v/tCtQ3OuRApGiGCC
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main hh.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2124 hh.exe 2124 hh.exe