ca2b787bb72f0bd9d79013aa93800bfd84c73aad74662c48e69425e4adfb549b

General

Target

hv.exe
Size

8.7MB
MD5

480f8cf600f5509595b8418c6534caf2
SHA1

dc13258ebb83bdf956523d751f67e29d6e4cf77e
SHA256

6d8905ec0b1dfdc0a10d1cce40714ddd73205a09ad390b933ddbecdcf06a4cf2
SHA512

f0bd99f68d59e80538fb276945d0f383394cb94a35c6d12ebd3e87061222249f78b9ca75716b33e36b66842b97c71149612111fcb6a8a3bc3a97635b03934aaf
SSDEEP

196608:Ywdj1UbkCchr3rlFE8GCWhKUzGZ3gRTFHnBz58//o:Yw91Ubkxhr3rlFHWhKUzGZ3gRTFhzi/o

Score

5^/10

Malware Config

Signatures

Suspicious use of SetThreadContext 1 IoCs

Processes:

hv.exe

description pid process target process

PID 1152 set thread context of 2688 1152 hv.exe netsh.exe
Executes dropped EXE 1 IoCs

Processes:

hv.exe

pid process

1152 hv.exe
Loads dropped DLL 2 IoCs

Processes:

hv.exe0x21.pif

pid process

1152 hv.exe
4960 0x21.pif
Suspicious behavior: EnumeratesProcesses 5 IoCs

Processes:

hv.exehv.exenetsh.exe

pid process

4844 hv.exe
1152 hv.exe
1152 hv.exe
2688 netsh.exe
2688 netsh.exe
Suspicious behavior: MapViewOfSection 2 IoCs

Processes:

hv.exenetsh.exe

pid process

1152 hv.exe
2688 netsh.exe
Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

hv.exehv.exe

pid process

4844 hv.exe
1152 hv.exe

description	pid	process	target process
PID 1152 set thread context of 2688	1152	hv.exe	netsh.exe

pid	process
1152	hv.exe

pid	process
1152	hv.exe
4960	0x21.pif

pid	process
4844	hv.exe
1152	hv.exe
1152	hv.exe
2688	netsh.exe
2688	netsh.exe

pid	process
1152	hv.exe
2688	netsh.exe

pid	process
4844	hv.exe
1152	hv.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

hv.exehv.exenetsh.exe

description	pid	process	target process
PID 4844 wrote to memory of 1152	4844	hv.exe	hv.exe
PID 4844 wrote to memory of 1152	4844	hv.exe	hv.exe
PID 4844 wrote to memory of 1152	4844	hv.exe	hv.exe
PID 1152 wrote to memory of 2688	1152	hv.exe	netsh.exe
PID 1152 wrote to memory of 2688	1152	hv.exe	netsh.exe
PID 1152 wrote to memory of 2688	1152	hv.exe	netsh.exe
PID 1152 wrote to memory of 2688	1152	hv.exe	netsh.exe
PID 2688 wrote to memory of 4960	2688	netsh.exe	0x21.pif
PID 2688 wrote to memory of 4960	2688	netsh.exe	0x21.pif
PID 2688 wrote to memory of 4960	2688	netsh.exe	0x21.pif
PID 2688 wrote to memory of 4960	2688	netsh.exe	0x21.pif

C:\Users\Admin\AppData\Local\Temp\hv.exe
"C:\Users\Admin\AppData\Local\Temp\hv.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4844

C:\Users\Admin\AppData\Roaming\BqDaemon\hv.exe
C:\Users\Admin\AppData\Roaming\BqDaemon\hv.exe
2⤵
- Suspicious use of SetThreadContext
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1152

C:\Windows\SysWOW64\netsh.exe
C:\Windows\SysWOW64\netsh.exe
3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:2688

C:\Users\Admin\AppData\Local\Temp\0x21.pif
C:\Users\Admin\AppData\Local\Temp\0x21.pif
4⤵
- Loads dropped DLL
PID:4960

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\0x21.pif
Filesize
76KB

MD5
f43c6b629baaaaee1e7fe095a8821631

SHA1
f0e4b84bb1fa6ba985e281f3afc9642afca168b5

SHA256
4196f6776110e75a9670fb5843f373e90e88c0826ead45a30e9578221ff44ae3

SHA512
2b475850705fa37dd0c1b093d31ccce48ffdbcc614215ffb304070b4f31e16ca651d4569af39b36482c848751f1e31b7fd647bd23245718a0a1e877a6417878a

Download Submit
C:\Users\Admin\AppData\Local\Temp\b3de8a52
Filesize
1.1MB

MD5
f22a771a2f3aac87cb1a866cde3e90ce

SHA1
2754bb111447e0434b8863beadda95b6ca9e93ac

SHA256
92d71bcb2e41b06d9493604aee9ae9bbaf6b2ff537b919b2c62a42282af8363a

SHA512
dface20a94a6090743f56e2934844103be00ae03d87ee1d807ea328408cfea5631927718a272dfa21518f46e000596b385d20cfede27d2fe99b0c239358a7d25

Download Submit
C:\Users\Admin\AppData\Roaming\BqDaemon\hv.exe
Filesize
8.7MB

MD5
480f8cf600f5509595b8418c6534caf2

SHA1
dc13258ebb83bdf956523d751f67e29d6e4cf77e

SHA256
6d8905ec0b1dfdc0a10d1cce40714ddd73205a09ad390b933ddbecdcf06a4cf2

SHA512
f0bd99f68d59e80538fb276945d0f383394cb94a35c6d12ebd3e87061222249f78b9ca75716b33e36b66842b97c71149612111fcb6a8a3bc3a97635b03934aaf

Download Submit
C:\Users\Admin\AppData\Roaming\BqDaemon\iepdf32.dll
Filesize
4.3MB

MD5
f3f6876d132eb277842e31ddc42aa7fa

SHA1
9c167a2854ed106b74dff55a30bdefc55b140e9a

SHA256
4ba2ddde8a4549d08bfe4441643aa626e84d7653b8ddc6ed61823e78aeb3cdf1

SHA512
38b86c745945b0f97461542f89b2570210ddc3fcfeabfe2243a3b861dd80be6641e4b4181956d73926b7926d7c460db8a908ccb912c5209003ee24427aa135f9

Download Submit
C:\Users\Admin\AppData\Roaming\BqDaemon\rhombohedron.ai
Filesize
59KB

MD5
674dfd74a1bef081bf0da83f893138e5

SHA1
2a254cc02fea4c55bbc3133b99a9e2fd03082ae7

SHA256
67ff95298e395543ea0c9eeec6bfff81688df379bec578aa31c52d214b385180

SHA512
0b2bfbe287a037d46d881a00638a3c272197cf3537bc74169c07c7721cda2bf94927268bfd6cb965ad56e1ac98e3466d809cbc67f2e4d971dd0d7da9568a4cce

Download Submit
C:\Users\Admin\AppData\Roaming\BqDaemon\shovelnose.deb
Filesize
827KB

MD5
90b47672d8134f8cc464d83a5cde8d34

SHA1
69567e6a2dd5569b8cd2876a275f5d9a2ad8743f

SHA256
cc38b5cb522fdf8d2fe5e85c50d72e1b8ac39d36deb157d4bffdda7970c5ba8b

SHA512
7dbeb8d4a5674c088fa904a9fdcddf9cb84d41b2d2c887ba38cfcdd1ac30cf4cd8ae28bc33fc3ee51139e78645f7fb580dfaf57e939c4e144b79d507a1d1d90b

Download Submit
memory/1152-17-0x0000000075CF2000-0x0000000075CF4000-memory.dmp

Filesize
8KB

Download
memory/1152-10-0x0000000001660000-0x0000000001661000-memory.dmp

Filesize
4KB

Download
memory/1152-15-0x0000000075CE0000-0x0000000075D43000-memory.dmp

Filesize
396KB

Download
memory/1152-16-0x00007FFC28E70000-0x00007FFC29065000-memory.dmp

Filesize
2.0MB

Download
memory/1152-18-0x0000000075CE0000-0x0000000075D43000-memory.dmp

Filesize
396KB

Download
memory/1152-19-0x0000000075CE0000-0x0000000075D43000-memory.dmp

Filesize
396KB

Download
memory/1152-21-0x0000000000C90000-0x0000000001566000-memory.dmp

Filesize
8.8MB

Download
memory/2688-23-0x00007FFC28E70000-0x00007FFC29065000-memory.dmp

Filesize
2.0MB

Download
memory/2688-32-0x0000000075CE0000-0x0000000075D43000-memory.dmp

Filesize
396KB

Download
memory/2688-26-0x0000000075CE0000-0x0000000075D43000-memory.dmp

Filesize
396KB

Download
memory/4844-2-0x00007FFC28E70000-0x00007FFC29065000-memory.dmp

Filesize
2.0MB

Download
memory/4844-9-0x0000000000E30000-0x0000000001706000-memory.dmp

Filesize
8.8MB

Download
memory/4844-1-0x0000000075CE0000-0x0000000075D43000-memory.dmp

Filesize
396KB

Download
memory/4844-0-0x0000000003690000-0x0000000003691000-memory.dmp

Filesize
4KB

Download
memory/4960-29-0x00007FFC28E70000-0x00007FFC29065000-memory.dmp

Filesize
2.0MB

Download
memory/4960-30-0x0000000000B60000-0x0000000000BB8000-memory.dmp

Filesize
352KB

Download
memory/4960-31-0x0000000000B60000-0x0000000000BB8000-memory.dmp

Filesize
352KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads