ca2b787bb72f0bd9d79013aa93800bfd84c73aad74662c48e69425e4adfb549b

General

Target

hv.exe
Size

8.7MB
MD5

480f8cf600f5509595b8418c6534caf2
SHA1

dc13258ebb83bdf956523d751f67e29d6e4cf77e
SHA256

6d8905ec0b1dfdc0a10d1cce40714ddd73205a09ad390b933ddbecdcf06a4cf2
SHA512

f0bd99f68d59e80538fb276945d0f383394cb94a35c6d12ebd3e87061222249f78b9ca75716b33e36b66842b97c71149612111fcb6a8a3bc3a97635b03934aaf
SSDEEP

196608:Ywdj1UbkCchr3rlFE8GCWhKUzGZ3gRTFHnBz58//o:Yw91Ubkxhr3rlFHWhKUzGZ3gRTFhzi/o

Score

5^/10

Malware Config

Signatures

Suspicious use of SetThreadContext 1 IoCs

Processes:

hv.exe

description pid process target process

PID 2332 set thread context of 2248 2332 hv.exe netsh.exe
Executes dropped EXE 1 IoCs

Processes:

hv.exe

pid process

2332 hv.exe
Loads dropped DLL 4 IoCs

Processes:

hv.exehv.exenetsh.exe0x21.pif

pid process

2320 hv.exe
2332 hv.exe
2248 netsh.exe
2544 0x21.pif
Suspicious behavior: EnumeratesProcesses 5 IoCs

Processes:

hv.exehv.exenetsh.exe

pid process

2320 hv.exe
2332 hv.exe
2332 hv.exe
2248 netsh.exe
2248 netsh.exe
Suspicious behavior: MapViewOfSection 2 IoCs

Processes:

hv.exenetsh.exe

pid process

2332 hv.exe
2248 netsh.exe
Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

hv.exehv.exe

pid process

2320 hv.exe
2332 hv.exe

description	pid	process	target process
PID 2332 set thread context of 2248	2332	hv.exe	netsh.exe

pid	process
2332	hv.exe

pid	process
2320	hv.exe
2332	hv.exe
2248	netsh.exe
2544	0x21.pif

pid	process
2320	hv.exe
2332	hv.exe
2332	hv.exe
2248	netsh.exe
2248	netsh.exe

pid	process
2332	hv.exe
2248	netsh.exe

pid	process
2320	hv.exe
2332	hv.exe

Suspicious use of WriteProcessMemory 14 IoCs

Processes:

hv.exehv.exenetsh.exe

description	pid	process	target process
PID 2320 wrote to memory of 2332	2320	hv.exe	hv.exe
PID 2320 wrote to memory of 2332	2320	hv.exe	hv.exe
PID 2320 wrote to memory of 2332	2320	hv.exe	hv.exe
PID 2320 wrote to memory of 2332	2320	hv.exe	hv.exe
PID 2332 wrote to memory of 2248	2332	hv.exe	netsh.exe
PID 2332 wrote to memory of 2248	2332	hv.exe	netsh.exe
PID 2332 wrote to memory of 2248	2332	hv.exe	netsh.exe
PID 2332 wrote to memory of 2248	2332	hv.exe	netsh.exe
PID 2332 wrote to memory of 2248	2332	hv.exe	netsh.exe
PID 2248 wrote to memory of 2544	2248	netsh.exe	0x21.pif
PID 2248 wrote to memory of 2544	2248	netsh.exe	0x21.pif
PID 2248 wrote to memory of 2544	2248	netsh.exe	0x21.pif
PID 2248 wrote to memory of 2544	2248	netsh.exe	0x21.pif
PID 2248 wrote to memory of 2544	2248	netsh.exe	0x21.pif

C:\Users\Admin\AppData\Local\Temp\hv.exe
"C:\Users\Admin\AppData\Local\Temp\hv.exe"
1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2320

C:\Users\Admin\AppData\Roaming\BqDaemon\hv.exe
C:\Users\Admin\AppData\Roaming\BqDaemon\hv.exe
2⤵
- Suspicious use of SetThreadContext
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2332

C:\Windows\SysWOW64\netsh.exe
C:\Windows\SysWOW64\netsh.exe
3⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:2248

C:\Users\Admin\AppData\Local\Temp\0x21.pif
C:\Users\Admin\AppData\Local\Temp\0x21.pif
4⤵
- Loads dropped DLL
PID:2544

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\9fa4c9ef
Filesize
1.1MB

MD5
f1f395751ac822fa8f5ffc0d5d66f7da

SHA1
ffc760a1ac177600eb36a68492f57d234024768d

SHA256
bcd0ef70300c4e0db70f6e08213941191c81daf1c79757aa20753ba1cd8d0f51

SHA512
0692e22b85e9c886d21c93fe39090caedaa45eba20cba1e2ede9d8a393a745d7a79400c6f190f349c35a1b7bdb8b50cd1fd8a6b8fbc2e77ab34c8aeb9a0b2a5b

Download Submit
C:\Users\Admin\AppData\Roaming\BqDaemon\iepdf32.dll
Filesize
4.3MB

MD5
f3f6876d132eb277842e31ddc42aa7fa

SHA1
9c167a2854ed106b74dff55a30bdefc55b140e9a

SHA256
4ba2ddde8a4549d08bfe4441643aa626e84d7653b8ddc6ed61823e78aeb3cdf1

SHA512
38b86c745945b0f97461542f89b2570210ddc3fcfeabfe2243a3b861dd80be6641e4b4181956d73926b7926d7c460db8a908ccb912c5209003ee24427aa135f9

Download Submit
C:\Users\Admin\AppData\Roaming\BqDaemon\rhombohedron.ai
Filesize
59KB

MD5
674dfd74a1bef081bf0da83f893138e5

SHA1
2a254cc02fea4c55bbc3133b99a9e2fd03082ae7

SHA256
67ff95298e395543ea0c9eeec6bfff81688df379bec578aa31c52d214b385180

SHA512
0b2bfbe287a037d46d881a00638a3c272197cf3537bc74169c07c7721cda2bf94927268bfd6cb965ad56e1ac98e3466d809cbc67f2e4d971dd0d7da9568a4cce

Download Submit
C:\Users\Admin\AppData\Roaming\BqDaemon\shovelnose.deb
Filesize
827KB

MD5
90b47672d8134f8cc464d83a5cde8d34

SHA1
69567e6a2dd5569b8cd2876a275f5d9a2ad8743f

SHA256
cc38b5cb522fdf8d2fe5e85c50d72e1b8ac39d36deb157d4bffdda7970c5ba8b

SHA512
7dbeb8d4a5674c088fa904a9fdcddf9cb84d41b2d2c887ba38cfcdd1ac30cf4cd8ae28bc33fc3ee51139e78645f7fb580dfaf57e939c4e144b79d507a1d1d90b

Download Submit
\Users\Admin\AppData\Local\Temp\0x21.pif
Filesize
76KB

MD5
f43c6b629baaaaee1e7fe095a8821631

SHA1
f0e4b84bb1fa6ba985e281f3afc9642afca168b5

SHA256
4196f6776110e75a9670fb5843f373e90e88c0826ead45a30e9578221ff44ae3

SHA512
2b475850705fa37dd0c1b093d31ccce48ffdbcc614215ffb304070b4f31e16ca651d4569af39b36482c848751f1e31b7fd647bd23245718a0a1e877a6417878a

Download Submit
\Users\Admin\AppData\Roaming\BqDaemon\hv.exe
Filesize
8.7MB

MD5
480f8cf600f5509595b8418c6534caf2

SHA1
dc13258ebb83bdf956523d751f67e29d6e4cf77e

SHA256
6d8905ec0b1dfdc0a10d1cce40714ddd73205a09ad390b933ddbecdcf06a4cf2

SHA512
f0bd99f68d59e80538fb276945d0f383394cb94a35c6d12ebd3e87061222249f78b9ca75716b33e36b66842b97c71149612111fcb6a8a3bc3a97635b03934aaf

Download Submit
memory/2248-24-0x00000000006A0000-0x00000000006D5000-memory.dmp

Filesize
212KB

Download
memory/2248-22-0x0000000076D30000-0x0000000076ED9000-memory.dmp

Filesize
1.7MB

Download
memory/2320-1-0x0000000074AC0000-0x0000000074AF5000-memory.dmp

Filesize
212KB

Download
memory/2320-2-0x0000000076D30000-0x0000000076ED9000-memory.dmp

Filesize
1.7MB

Download
memory/2320-11-0x0000000000340000-0x0000000000C16000-memory.dmp

Filesize
8.8MB

Download
memory/2320-0-0x00000000001C0000-0x00000000001C1000-memory.dmp

Filesize
4KB

Download
memory/2332-16-0x0000000074AC0000-0x0000000074AF5000-memory.dmp

Filesize
212KB

Download
memory/2332-20-0x00000000001B0000-0x0000000000A86000-memory.dmp

Filesize
8.8MB

Download
memory/2332-18-0x0000000074AC0000-0x0000000074AF5000-memory.dmp

Filesize
212KB

Download
memory/2332-17-0x0000000076D30000-0x0000000076ED9000-memory.dmp

Filesize
1.7MB

Download
memory/2544-30-0x0000000076D30000-0x0000000076ED9000-memory.dmp

Filesize
1.7MB

Download
memory/2544-31-0x0000000000400000-0x0000000000458000-memory.dmp

Filesize
352KB

Download
memory/2544-32-0x0000000000400000-0x0000000000458000-memory.dmp

Filesize
352KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads