ca2b787bb72f0bd9d79013aa93800bfd84c73aad74662c48e69425e4adfb549b

General

Target

hv.exe
Size

8.7MB
MD5

480f8cf600f5509595b8418c6534caf2
SHA1

dc13258ebb83bdf956523d751f67e29d6e4cf77e
SHA256

6d8905ec0b1dfdc0a10d1cce40714ddd73205a09ad390b933ddbecdcf06a4cf2
SHA512

f0bd99f68d59e80538fb276945d0f383394cb94a35c6d12ebd3e87061222249f78b9ca75716b33e36b66842b97c71149612111fcb6a8a3bc3a97635b03934aaf
SSDEEP

196608:Ywdj1UbkCchr3rlFE8GCWhKUzGZ3gRTFHnBz58//o:Yw91Ubkxhr3rlFHWhKUzGZ3gRTFhzi/o

Score

5^/10

Malware Config

Signatures

Suspicious use of SetThreadContext 1 IoCs

Processes:

hv.exe

description pid process target process

PID 2740 set thread context of 2584 2740 hv.exe netsh.exe
Executes dropped EXE 1 IoCs

Processes:

hv.exe

pid process

2740 hv.exe
Loads dropped DLL 4 IoCs

Processes:

hv.exehv.exenetsh.exe0x21.pif

pid process

1856 hv.exe
2740 hv.exe
2584 netsh.exe
2496 0x21.pif
Suspicious behavior: EnumeratesProcesses 5 IoCs

Processes:

hv.exehv.exenetsh.exe

pid process

1856 hv.exe
2740 hv.exe
2740 hv.exe
2584 netsh.exe
2584 netsh.exe
Suspicious behavior: MapViewOfSection 2 IoCs

Processes:

hv.exenetsh.exe

pid process

2740 hv.exe
2584 netsh.exe
Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

hv.exehv.exe

pid process

1856 hv.exe
2740 hv.exe

description	pid	process	target process
PID 2740 set thread context of 2584	2740	hv.exe	netsh.exe

pid	process
2740	hv.exe

pid	process
1856	hv.exe
2740	hv.exe
2584	netsh.exe
2496	0x21.pif

pid	process
1856	hv.exe
2740	hv.exe
2740	hv.exe
2584	netsh.exe
2584	netsh.exe

pid	process
2740	hv.exe
2584	netsh.exe

pid	process
1856	hv.exe
2740	hv.exe

Suspicious use of WriteProcessMemory 14 IoCs

Processes:

hv.exehv.exenetsh.exe

description	pid	process	target process
PID 1856 wrote to memory of 2740	1856	hv.exe	hv.exe
PID 1856 wrote to memory of 2740	1856	hv.exe	hv.exe
PID 1856 wrote to memory of 2740	1856	hv.exe	hv.exe
PID 1856 wrote to memory of 2740	1856	hv.exe	hv.exe
PID 2740 wrote to memory of 2584	2740	hv.exe	netsh.exe
PID 2740 wrote to memory of 2584	2740	hv.exe	netsh.exe
PID 2740 wrote to memory of 2584	2740	hv.exe	netsh.exe
PID 2740 wrote to memory of 2584	2740	hv.exe	netsh.exe
PID 2740 wrote to memory of 2584	2740	hv.exe	netsh.exe
PID 2584 wrote to memory of 2496	2584	netsh.exe	0x21.pif
PID 2584 wrote to memory of 2496	2584	netsh.exe	0x21.pif
PID 2584 wrote to memory of 2496	2584	netsh.exe	0x21.pif
PID 2584 wrote to memory of 2496	2584	netsh.exe	0x21.pif
PID 2584 wrote to memory of 2496	2584	netsh.exe	0x21.pif

C:\Users\Admin\AppData\Local\Temp\hv.exe
"C:\Users\Admin\AppData\Local\Temp\hv.exe"
1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1856

C:\Users\Admin\AppData\Roaming\BqDaemon\hv.exe
C:\Users\Admin\AppData\Roaming\BqDaemon\hv.exe
2⤵
- Suspicious use of SetThreadContext
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2740

C:\Windows\SysWOW64\netsh.exe
C:\Windows\SysWOW64\netsh.exe
3⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:2584

C:\Users\Admin\AppData\Local\Temp\0x21.pif
C:\Users\Admin\AppData\Local\Temp\0x21.pif
4⤵
- Loads dropped DLL
PID:2496

C:\Windows\explorer.exe
"C:\Windows\explorer.exe"
1⤵
PID:2700

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\bc297207
Filesize
1.1MB

MD5
0f0901fa6effd1493b95ded8bef91895

SHA1
607284a1d5afc24dfd1e01f6b5a787c9c7e33664

SHA256
7fb0eb1d01a3326a757a43f82b97a39b4ad38f4d0d1b8ab60a324bd5f3f08e31

SHA512
8ef0faf6526c097ec327f42e795c89077a85bd7a6f78f711e3201f5295fc703ccea468372b1b8305089c06829bf659dd82d394cfe0467d9245928d46a308d172

Download Submit
C:\Users\Admin\AppData\Roaming\BqDaemon\hv.exe
Filesize
8.7MB

MD5
480f8cf600f5509595b8418c6534caf2

SHA1
dc13258ebb83bdf956523d751f67e29d6e4cf77e

SHA256
6d8905ec0b1dfdc0a10d1cce40714ddd73205a09ad390b933ddbecdcf06a4cf2

SHA512
f0bd99f68d59e80538fb276945d0f383394cb94a35c6d12ebd3e87061222249f78b9ca75716b33e36b66842b97c71149612111fcb6a8a3bc3a97635b03934aaf

Download Submit
C:\Users\Admin\AppData\Roaming\BqDaemon\iepdf32.dll
Filesize
4.3MB

MD5
f3f6876d132eb277842e31ddc42aa7fa

SHA1
9c167a2854ed106b74dff55a30bdefc55b140e9a

SHA256
4ba2ddde8a4549d08bfe4441643aa626e84d7653b8ddc6ed61823e78aeb3cdf1

SHA512
38b86c745945b0f97461542f89b2570210ddc3fcfeabfe2243a3b861dd80be6641e4b4181956d73926b7926d7c460db8a908ccb912c5209003ee24427aa135f9

Download Submit
C:\Users\Admin\AppData\Roaming\BqDaemon\rhombohedron.ai
Filesize
59KB

MD5
674dfd74a1bef081bf0da83f893138e5

SHA1
2a254cc02fea4c55bbc3133b99a9e2fd03082ae7

SHA256
67ff95298e395543ea0c9eeec6bfff81688df379bec578aa31c52d214b385180

SHA512
0b2bfbe287a037d46d881a00638a3c272197cf3537bc74169c07c7721cda2bf94927268bfd6cb965ad56e1ac98e3466d809cbc67f2e4d971dd0d7da9568a4cce

Download Submit
C:\Users\Admin\AppData\Roaming\BqDaemon\shovelnose.deb
Filesize
827KB

MD5
90b47672d8134f8cc464d83a5cde8d34

SHA1
69567e6a2dd5569b8cd2876a275f5d9a2ad8743f

SHA256
cc38b5cb522fdf8d2fe5e85c50d72e1b8ac39d36deb157d4bffdda7970c5ba8b

SHA512
7dbeb8d4a5674c088fa904a9fdcddf9cb84d41b2d2c887ba38cfcdd1ac30cf4cd8ae28bc33fc3ee51139e78645f7fb580dfaf57e939c4e144b79d507a1d1d90b

Download Submit
\Users\Admin\AppData\Local\Temp\0x21.pif
Filesize
76KB

MD5
f43c6b629baaaaee1e7fe095a8821631

SHA1
f0e4b84bb1fa6ba985e281f3afc9642afca168b5

SHA256
4196f6776110e75a9670fb5843f373e90e88c0826ead45a30e9578221ff44ae3

SHA512
2b475850705fa37dd0c1b093d31ccce48ffdbcc614215ffb304070b4f31e16ca651d4569af39b36482c848751f1e31b7fd647bd23245718a0a1e877a6417878a

Download Submit
memory/1856-11-0x0000000000D40000-0x0000000001616000-memory.dmp

Filesize
8.8MB

Download
memory/1856-0-0x0000000000130000-0x0000000000131000-memory.dmp

Filesize
4KB

Download
memory/1856-2-0x0000000077A60000-0x0000000077C09000-memory.dmp

Filesize
1.7MB

Download
memory/1856-1-0x0000000075B30000-0x0000000075B65000-memory.dmp

Filesize
212KB

Download
memory/2496-30-0x0000000077A60000-0x0000000077C09000-memory.dmp

Filesize
1.7MB

Download
memory/2496-31-0x0000000000400000-0x0000000000458000-memory.dmp

Filesize
352KB

Download
memory/2496-32-0x0000000000400000-0x0000000000458000-memory.dmp

Filesize
352KB

Download
memory/2584-22-0x0000000077A60000-0x0000000077C09000-memory.dmp

Filesize
1.7MB

Download
memory/2584-24-0x0000000001EF0000-0x0000000001F25000-memory.dmp

Filesize
212KB

Download
memory/2740-17-0x0000000077A60000-0x0000000077C09000-memory.dmp

Filesize
1.7MB

Download
memory/2740-16-0x0000000075B30000-0x0000000075B65000-memory.dmp

Filesize
212KB

Download
memory/2740-18-0x0000000075B30000-0x0000000075B65000-memory.dmp

Filesize
212KB

Download
memory/2740-20-0x0000000001290000-0x0000000001B66000-memory.dmp

Filesize
8.8MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads