Overview

overview

3

Static

static

3

BlueCoin_2.3.exe

windows7-x64

1

BlueCoin_2.3.exe

windows10-2004-x64

1

Resubmissions

14/06/2024, 02:03

240614-cgxp9s1eph 3

14/06/2024, 01:57

240614-cdnyys1dle 3

Analysis

  • max time kernel
    149s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240611-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
  • submitted
    14/06/2024, 01:57

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    BlueCoin_2.3.exe

  • Size

    4.5MB

  • MD5

    b723da40e4d5937eee4946c4b248d4ec

  • SHA1

    9a400fa02e1c89ff2f53d97e09b99edefd59ef8b

  • SHA256

    96b7e457aaf8c41338d70fda57907a6ccf3302d3df1e09b98732c82154717d3d

  • SHA512

    f362f6502d13135ef5310670cacfb7a78161a206534ec67c396f1be162b6b0becac322f83b73052b938a0168d28692ab9f68547e6f1557c50ddd7f8f05a244e5

  • SSDEEP

    49152:NECJRjlIGAyh0AyEQB7jphMzEZgXQPQOznOMMcR5EmB17Ore7yzKLmLE7FVniIdy:RAUQPxXB6IzlSKO7

Score
1/10

Malware Config

Signatures

  • Modifies Internet Explorer settings 1 TTPs 4 IoCs
    adwarespyware
  • Modifies registry class 50 IoCs
  • Opens file in notepad (likely ransom note) 1 IoCs
    ransomware
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of SetWindowsHookEx 9 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\BlueCoin_2.3.exe
    "C:\Users\Admin\AppData\Local\Temp\BlueCoin_2.3.exe"
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:3184
    • C:\Windows\explorer.exe
      "explorer.exe" C:\Users\Admin\AppData\Roaming\BlackMarketplace
      2⤵
        PID:452
    • C:\Windows\explorer.exe
      C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
      1⤵
      • Modifies Internet Explorer settings
      • Modifies registry class
      • Suspicious behavior: AddClipboardFormatListener
      • Suspicious use of SetWindowsHookEx
      PID:4116
    • C:\Windows\System32\rundll32.exe
      C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
      1⤵
        PID:692
      • C:\Windows\system32\OpenWith.exe
        C:\Windows\system32\OpenWith.exe -Embedding
        1⤵
        • Modifies registry class
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:5080
        • C:\Windows\system32\NOTEPAD.EXE
          "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Roaming\BlackMarketplace\keys.tsv
          2⤵
          • Opens file in notepad (likely ransom note)
          PID:3224

      Network

      MITRE ATT&CK Enterprise v15

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Users\Admin\AppData\Roaming\BlackMarketplace\keys.tsv
        Filesize

        455KB

        MD5

        353bf374193e6473844781fbe6a6805a

        SHA1

        6f28a63483968498f6c38ff0d3a5dc3d853d4e40

        SHA256

        20e5015a0ed9bd9beeb95b412a5b80725a64fe403a01785d46baf6c1f8e8aade

        SHA512

        76353392ca902d81cc78b2b03a13ac36ad8350f089a4c02a5a9a309584b5cdc281a3b0246e878b755760c1a87423a1a2e4f9412891a8776434d6a94274741c24

        Download Submit

      • C:\Users\Admin\AppData\Roaming\BlackMarketplace\noire.conf
        Filesize

        254B

        MD5

        685db317664976889ba944553b8fc6eb

        SHA1

        834d7e60020a4b28fc9a5d7ab4ee275536389a53

        SHA256

        a610d6c48f935f989958a681e2a59e14da9c3897fde164dc10f116ba29a37a02

        SHA512

        b1eca0504afef0d9518084bd6862db5c969c10ec98f97119b4b9bad31277977119db75a96e7fd612b2200c7c0ad199f6d28bcf690dc9059bdccdaa2c3db6f5de

        Download Submit