Overview
overview
7Static
static
3Boost bot ...LT.rar
windows11-21h2-x64
3BoostBotSe...ll.bat
windows11-21h2-x64
1BoostBotSell/main.exe
windows11-21h2-x64
7main.pyc
windows11-21h2-x64
3BoostBotSe...t__.py
windows11-21h2-x64
3BoostBotSe...39.pyc
windows11-21h2-x64
3BoostBotSe...rm.dll
windows11-21h2-x64
1BoostBotSe...me.txt
windows11-21h2-x64
3BoostBotSe...ts.txt
windows11-21h2-x64
3BoostBotSe...s.json
windows11-21h2-x64
3BoostBotSe...rt.txt
windows11-21h2-x64
3BoostBotSe...d.json
windows11-21h2-x64
3Resubmissions
Analysis
-
max time kernel
454s -
max time network
460s -
platform
windows11-21h2_x64 -
resource
win11-20240508-en -
resource tags
arch:x64arch:x86image:win11-20240508-enlocale:en-usos:windows11-21h2-x64system -
submitted
04-06-2024 08:39
Behavioral task
behavioral1
Sample
Boost bot leaked by LT.rar
Resource
win11-20240508-en
Behavioral task
behavioral2
Sample
BoostBotSell/install.bat
Resource
win11-20240426-en
Behavioral task
behavioral3
Sample
BoostBotSell/main.exe
Resource
win11-20240426-en
Behavioral task
behavioral4
Sample
main.pyc
Resource
win11-20240508-en
Behavioral task
behavioral5
Sample
BoostBotSell/pytransform/__init__.py
Resource
win11-20240426-en
Behavioral task
behavioral6
Sample
BoostBotSell/pytransform/__pycache__/__init__.cpython-39.pyc
Resource
win11-20240426-en
Behavioral task
behavioral7
Sample
BoostBotSell/pytransform/_pytransform.dll
Resource
win11-20240426-en
Behavioral task
behavioral8
Sample
BoostBotSell/readme.txt
Resource
win11-20240508-en
Behavioral task
behavioral9
Sample
BoostBotSell/requirements.txt
Resource
win11-20240508-en
Behavioral task
behavioral10
Sample
BoostBotSell/settings.json
Resource
win11-20240508-en
Behavioral task
behavioral11
Sample
BoostBotSell/todobeforestart.txt
Resource
win11-20240419-en
Behavioral task
behavioral12
Sample
BoostBotSell/used.json
Resource
win11-20240426-en
General
-
Target
Boost bot leaked by LT.rar
-
Size
16.4MB
-
MD5
21ef1e69b71dc155a733431adc931d22
-
SHA1
48969bf6461ddd459a8a80ce853ef430fb39cf23
-
SHA256
33dc853be9571e4fddcb07ab14fb1d1364394b8904eff403a04129a0efc49c81
-
SHA512
d57ecf799f6b23d64437a7cbfce007b7c14cda47dda22a5e5ac341bd0bf658d2f5f975462039e59934f1212a45c5846df9db8e2378284121822afb3ea4588135
-
SSDEEP
393216:kj8ZbX6ERnGrk2Du+ilETd9ieVljRzai27nyMilUxgFa81oU1:kSVcrfy7lid97LJaiAR38H1
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry class 2 IoCs
Processes:
cmd.exeOpenWith.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-3001105534-2705918504-2956618779-1000_Classes\Local Settings cmd.exe Key created \REGISTRY\USER\S-1-5-21-3001105534-2705918504-2956618779-1000_Classes\Local Settings OpenWith.exe -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
Processes:
vlc.exepid process 2292 vlc.exe -
Suspicious behavior: GetForegroundWindowSpam 2 IoCs
Processes:
OpenWith.exevlc.exepid process 4676 OpenWith.exe 2292 vlc.exe -
Suspicious use of FindShellTrayWindow 10 IoCs
Processes:
vlc.exepid process 2292 vlc.exe 2292 vlc.exe 2292 vlc.exe 2292 vlc.exe 2292 vlc.exe 2292 vlc.exe 2292 vlc.exe 2292 vlc.exe 2292 vlc.exe 2292 vlc.exe -
Suspicious use of SendNotifyMessage 9 IoCs
Processes:
vlc.exepid process 2292 vlc.exe 2292 vlc.exe 2292 vlc.exe 2292 vlc.exe 2292 vlc.exe 2292 vlc.exe 2292 vlc.exe 2292 vlc.exe 2292 vlc.exe -
Suspicious use of SetWindowsHookEx 12 IoCs
Processes:
OpenWith.exevlc.exepid process 4676 OpenWith.exe 4676 OpenWith.exe 4676 OpenWith.exe 4676 OpenWith.exe 4676 OpenWith.exe 4676 OpenWith.exe 4676 OpenWith.exe 4676 OpenWith.exe 4676 OpenWith.exe 4676 OpenWith.exe 4676 OpenWith.exe 2292 vlc.exe -
Suspicious use of WriteProcessMemory 2 IoCs
Processes:
OpenWith.exedescription pid process target process PID 4676 wrote to memory of 2292 4676 OpenWith.exe vlc.exe PID 4676 wrote to memory of 2292 4676 OpenWith.exe vlc.exe
Processes
-
C:\Windows\system32\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\Boost bot leaked by LT.rar"1⤵
- Modifies registry class
PID:4120
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4676 -
C:\Program Files\VideoLAN\VLC\vlc.exe"C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\AppData\Local\Temp\Boost bot leaked by LT.rar"2⤵
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:2292
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/2292-13-0x00007FFFCFF70000-0x00007FFFCFFA4000-memory.dmpFilesize
208KB
-
memory/2292-12-0x00007FF68E090000-0x00007FF68E188000-memory.dmpFilesize
992KB
-
memory/2292-14-0x00007FFFCBE80000-0x00007FFFCC136000-memory.dmpFilesize
2.7MB
-
memory/2292-15-0x00007FFFB9F80000-0x00007FFFBB030000-memory.dmpFilesize
16.7MB