ca2b787bb72f0bd9d79013aa93800bfd84c73aad74662c48e69425e4adfb549b

General

Target

hv.exe
Size

8.7MB
MD5

480f8cf600f5509595b8418c6534caf2
SHA1

dc13258ebb83bdf956523d751f67e29d6e4cf77e
SHA256

6d8905ec0b1dfdc0a10d1cce40714ddd73205a09ad390b933ddbecdcf06a4cf2
SHA512

f0bd99f68d59e80538fb276945d0f383394cb94a35c6d12ebd3e87061222249f78b9ca75716b33e36b66842b97c71149612111fcb6a8a3bc3a97635b03934aaf
SSDEEP

196608:Ywdj1UbkCchr3rlFE8GCWhKUzGZ3gRTFHnBz58//o:Yw91Ubkxhr3rlFHWhKUzGZ3gRTFhzi/o

Score

5^/10

Malware Config

Signatures

Suspicious use of SetThreadContext 1 IoCs

Processes:

hv.exe

description pid process target process

PID 2888 set thread context of 2904 2888 hv.exe netsh.exe
Executes dropped EXE 1 IoCs

Processes:

hv.exe

pid process

2888 hv.exe
Loads dropped DLL 4 IoCs

Processes:

hv.exehv.exenetsh.exe0x21.pif

pid process

1832 hv.exe
2888 hv.exe
2904 netsh.exe
2788 0x21.pif
Suspicious behavior: EnumeratesProcesses 5 IoCs

Processes:

hv.exehv.exenetsh.exe

pid process

1832 hv.exe
2888 hv.exe
2888 hv.exe
2904 netsh.exe
2904 netsh.exe
Suspicious behavior: MapViewOfSection 2 IoCs

Processes:

hv.exenetsh.exe

pid process

2888 hv.exe
2904 netsh.exe
Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

hv.exehv.exe

pid process

1832 hv.exe
2888 hv.exe

description	pid	process	target process
PID 2888 set thread context of 2904	2888	hv.exe	netsh.exe

pid	process
2888	hv.exe

pid	process
1832	hv.exe
2888	hv.exe
2904	netsh.exe
2788	0x21.pif

pid	process
1832	hv.exe
2888	hv.exe
2888	hv.exe
2904	netsh.exe
2904	netsh.exe

pid	process
2888	hv.exe
2904	netsh.exe

pid	process
1832	hv.exe
2888	hv.exe

Suspicious use of WriteProcessMemory 14 IoCs

Processes:

hv.exehv.exenetsh.exe

description	pid	process	target process
PID 1832 wrote to memory of 2888	1832	hv.exe	hv.exe
PID 1832 wrote to memory of 2888	1832	hv.exe	hv.exe
PID 1832 wrote to memory of 2888	1832	hv.exe	hv.exe
PID 1832 wrote to memory of 2888	1832	hv.exe	hv.exe
PID 2888 wrote to memory of 2904	2888	hv.exe	netsh.exe
PID 2888 wrote to memory of 2904	2888	hv.exe	netsh.exe
PID 2888 wrote to memory of 2904	2888	hv.exe	netsh.exe
PID 2888 wrote to memory of 2904	2888	hv.exe	netsh.exe
PID 2888 wrote to memory of 2904	2888	hv.exe	netsh.exe
PID 2904 wrote to memory of 2788	2904	netsh.exe	0x21.pif
PID 2904 wrote to memory of 2788	2904	netsh.exe	0x21.pif
PID 2904 wrote to memory of 2788	2904	netsh.exe	0x21.pif
PID 2904 wrote to memory of 2788	2904	netsh.exe	0x21.pif
PID 2904 wrote to memory of 2788	2904	netsh.exe	0x21.pif

C:\Users\Admin\AppData\Local\Temp\hv.exe
"C:\Users\Admin\AppData\Local\Temp\hv.exe"
1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1832

C:\Users\Admin\AppData\Roaming\BqDaemon\hv.exe
C:\Users\Admin\AppData\Roaming\BqDaemon\hv.exe
2⤵
- Suspicious use of SetThreadContext
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2888

C:\Windows\SysWOW64\netsh.exe
C:\Windows\SysWOW64\netsh.exe
3⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:2904

C:\Users\Admin\AppData\Local\Temp\0x21.pif
C:\Users\Admin\AppData\Local\Temp\0x21.pif
4⤵
- Loads dropped DLL
PID:2788

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\9fdea3f9
Filesize
1.1MB

MD5
0e9682f3b39761fd6f587be8cf4377f9

SHA1
350ebdb517b13852dcc4b798713ed4d908cb063b

SHA256
922c11f3665612139570288f6b9a115ee3f59638aceb10552f2fa37aae9d526b

SHA512
35f9f6901afdef8cdf348acd235d7a03df170e1b180e055a185a159008906d2fb2ecc290723801e8436e7640dd2bbe48d75e16de5d968f398b47a3fba9ccee23

Download Submit
C:\Users\Admin\AppData\Roaming\BqDaemon\iepdf32.dll
Filesize
4.3MB

MD5
f3f6876d132eb277842e31ddc42aa7fa

SHA1
9c167a2854ed106b74dff55a30bdefc55b140e9a

SHA256
4ba2ddde8a4549d08bfe4441643aa626e84d7653b8ddc6ed61823e78aeb3cdf1

SHA512
38b86c745945b0f97461542f89b2570210ddc3fcfeabfe2243a3b861dd80be6641e4b4181956d73926b7926d7c460db8a908ccb912c5209003ee24427aa135f9

Download Submit
C:\Users\Admin\AppData\Roaming\BqDaemon\rhombohedron.ai
Filesize
59KB

MD5
674dfd74a1bef081bf0da83f893138e5

SHA1
2a254cc02fea4c55bbc3133b99a9e2fd03082ae7

SHA256
67ff95298e395543ea0c9eeec6bfff81688df379bec578aa31c52d214b385180

SHA512
0b2bfbe287a037d46d881a00638a3c272197cf3537bc74169c07c7721cda2bf94927268bfd6cb965ad56e1ac98e3466d809cbc67f2e4d971dd0d7da9568a4cce

Download Submit
C:\Users\Admin\AppData\Roaming\BqDaemon\shovelnose.deb
Filesize
827KB

MD5
90b47672d8134f8cc464d83a5cde8d34

SHA1
69567e6a2dd5569b8cd2876a275f5d9a2ad8743f

SHA256
cc38b5cb522fdf8d2fe5e85c50d72e1b8ac39d36deb157d4bffdda7970c5ba8b

SHA512
7dbeb8d4a5674c088fa904a9fdcddf9cb84d41b2d2c887ba38cfcdd1ac30cf4cd8ae28bc33fc3ee51139e78645f7fb580dfaf57e939c4e144b79d507a1d1d90b

Download Submit
\Users\Admin\AppData\Local\Temp\0x21.pif
Filesize
76KB

MD5
f43c6b629baaaaee1e7fe095a8821631

SHA1
f0e4b84bb1fa6ba985e281f3afc9642afca168b5

SHA256
4196f6776110e75a9670fb5843f373e90e88c0826ead45a30e9578221ff44ae3

SHA512
2b475850705fa37dd0c1b093d31ccce48ffdbcc614215ffb304070b4f31e16ca651d4569af39b36482c848751f1e31b7fd647bd23245718a0a1e877a6417878a

Download Submit
\Users\Admin\AppData\Roaming\BqDaemon\hv.exe
Filesize
8.7MB

MD5
480f8cf600f5509595b8418c6534caf2

SHA1
dc13258ebb83bdf956523d751f67e29d6e4cf77e

SHA256
6d8905ec0b1dfdc0a10d1cce40714ddd73205a09ad390b933ddbecdcf06a4cf2

SHA512
f0bd99f68d59e80538fb276945d0f383394cb94a35c6d12ebd3e87061222249f78b9ca75716b33e36b66842b97c71149612111fcb6a8a3bc3a97635b03934aaf

Download Submit
memory/1832-0-0x0000000000150000-0x0000000000151000-memory.dmp

Filesize
4KB

Download
memory/1832-2-0x0000000077B80000-0x0000000077D29000-memory.dmp

Filesize
1.7MB

Download
memory/1832-11-0x00000000009C0000-0x0000000001296000-memory.dmp

Filesize
8.8MB

Download
memory/1832-1-0x0000000077920000-0x0000000077955000-memory.dmp

Filesize
212KB

Download
memory/2788-32-0x0000000000400000-0x0000000000458000-memory.dmp

Filesize
352KB

Download
memory/2788-31-0x0000000000400000-0x0000000000458000-memory.dmp

Filesize
352KB

Download
memory/2788-30-0x0000000077B80000-0x0000000077D29000-memory.dmp

Filesize
1.7MB

Download
memory/2888-18-0x0000000077920000-0x0000000077955000-memory.dmp

Filesize
212KB

Download
memory/2888-20-0x0000000000AF0000-0x00000000013C6000-memory.dmp

Filesize
8.8MB

Download
memory/2888-17-0x0000000077B80000-0x0000000077D29000-memory.dmp

Filesize
1.7MB

Download
memory/2888-16-0x0000000077920000-0x0000000077955000-memory.dmp

Filesize
212KB

Download
memory/2904-24-0x00000000009F0000-0x0000000000A25000-memory.dmp

Filesize
212KB

Download
memory/2904-22-0x0000000077B80000-0x0000000077D29000-memory.dmp

Filesize
1.7MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads