aafde59bd18e2ea55967da235f68985cbd0e17cd39ae625fd5fae8ce001a4c4b

Resubmissions

07-01-2025 15:01

250107-sd8alaxqdq 7

06-01-2025 07:51

250106-jptrxa1kav 10

06-01-2025 07:48

250106-jnl1ns1jgv 5

08-09-2024 17:12

240908-vqwtfazere 7

Analysis

max time kernel
46s
max time network
49s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
08-09-2024 17:12

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Btools v2.7 [PRO].exe
Size

3.4MB
MD5

127e32da28efb59592ccb7349022b889
SHA1

f29034dccae28f7f5d17731270e46a9bccedea9e
SHA256

1851d8d4e6eb5b55a5405e14124a36cb93414e29b9350e54ab998b55578aa744
SHA512

fffe633962caa18b7899961f2384b7ffa9cabb61e2dd04ec0b311cd8336c89d39169b0d3153ec39208767b7fb5167d2cbf0bd2495a71477bea3c455b24cfc456
SSDEEP

98304:B2cPK8CMX8XU4KmfzF/W/ALM3JJRWxiW:YCKyX8k4lfzoILWs

Score

7^/10

discovery

Malware Config

Signatures

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\Control Panel\International\Geo\Nation	Btools v2.7 [PRO].exe
Key value queried	\REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\Control Panel\International\Geo\Nation	Btools v2.7 [PRO].exe

Executes dropped EXE 4 IoCs

pid	Process
1760	btools pro.exe
844	main.exe
4300	btools pro.exe
3424	main.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 2 IoCs

pid	pid_target	Process	procid_target
404	1760	WerFault.exe	86
4996	4300	WerFault.exe	104

System Location Discovery: System Language Discovery 1 TTPs 7 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	main.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CookiesCreator.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Btools v2.7 [PRO].exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	btools pro.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	main.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Btools v2.7 [PRO].exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	btools pro.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 2928 wrote to memory of 1760	2928	Btools v2.7 [PRO].exe	86
PID 2928 wrote to memory of 1760	2928	Btools v2.7 [PRO].exe	86
PID 2928 wrote to memory of 1760	2928	Btools v2.7 [PRO].exe	86
PID 2928 wrote to memory of 844	2928	Btools v2.7 [PRO].exe	88
PID 2928 wrote to memory of 844	2928	Btools v2.7 [PRO].exe	88
PID 2928 wrote to memory of 844	2928	Btools v2.7 [PRO].exe	88
PID 1412 wrote to memory of 4300	1412	Btools v2.7 [PRO].exe	104
PID 1412 wrote to memory of 4300	1412	Btools v2.7 [PRO].exe	104
PID 1412 wrote to memory of 4300	1412	Btools v2.7 [PRO].exe	104
PID 1412 wrote to memory of 3424	1412	Btools v2.7 [PRO].exe	105
PID 1412 wrote to memory of 3424	1412	Btools v2.7 [PRO].exe	105
PID 1412 wrote to memory of 3424	1412	Btools v2.7 [PRO].exe	105

C:\Users\Admin\AppData\Local\Temp\Btools v2.7 [PRO].exe
"C:\Users\Admin\AppData\Local\Temp\Btools v2.7 [PRO].exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2928
- C:\Users\Admin\AppData\Roaming\Z44894709\btools pro.exe
  "C:\Users\Admin\AppData\Roaming\Z44894709\btools pro.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:1760
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1760 -s 1064
    3⤵
    - Program crash
    PID:404
- C:\Users\Admin\AppData\Roaming\Z44894709\main.exe
  "C:\Users\Admin\AppData\Roaming\Z44894709\main.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:844

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1760 -ip 1760
1⤵
PID:1720

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:5052

C:\Users\Admin\AppData\Local\Temp\Btools v2.7 [PRO].exe
"C:\Users\Admin\AppData\Local\Temp\Btools v2.7 [PRO].exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1412
- C:\Users\Admin\AppData\Roaming\Z44894709\btools pro.exe
  "C:\Users\Admin\AppData\Roaming\Z44894709\btools pro.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4300
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4300 -s 1064
    3⤵
    - Program crash
    PID:4996
- C:\Users\Admin\AppData\Roaming\Z44894709\main.exe
  "C:\Users\Admin\AppData\Roaming\Z44894709\main.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:3424

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 464 -p 4300 -ip 4300
1⤵
PID:220

C:\Users\Admin\AppData\Local\Temp\CookiesCreator.exe
"C:\Users\Admin\AppData\Local\Temp\CookiesCreator.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:4412

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Z44894709\btools pro.exe

Filesize
3.2MB

MD5
a3adf6adf0c9fc625ef1f18fd25a61bb

SHA1
cd0bf308f87a1b8a1e73a61007837f98e32221f2

SHA256
e3ac3980c01336b88e97c13760aa8d95600118f2e58ba542966efe4fd8442fff

SHA512
65e2c0a7afa1a51a1308bf1b0ac6bd927eac2ab52abbcb65770cd933cfc2fd3a1d4d29ad7d8d58ac66eadfebf6441077386216dd64dcf586bc38075ed1707b66

Download Submit
C:\Users\Admin\AppData\Roaming\Z44894709\main.exe

Filesize
1.4MB

MD5
15176b6a17d369c09ab6b1f4564aaaaf

SHA1
e82e873539641d574e480098087a68d8fd6cc298

SHA256
8364c15317b1a87bb9c5313a97fcf0f54be14fa669ba5fb33bd82b311708b804

SHA512
8a4cea143edd8797cc318ef8b209318eb68b281fcb88e3829e05681ee7d0420d6b7f91144da4e86c41525f2e86149d94ea97196745da82c3d0245e5f243ffaa3

Download Submit
memory/1760-22-0x000000007377E000-0x000000007377F000-memory.dmp

Filesize
4KB

Download
memory/1760-31-0x0000000000690000-0x00000000009D4000-memory.dmp

Filesize
3.3MB

Download
memory/1760-32-0x0000000073770000-0x0000000073F20000-memory.dmp

Filesize
7.7MB

Download
memory/1760-33-0x0000000073770000-0x0000000073F20000-memory.dmp

Filesize
7.7MB

Download
memory/4412-53-0x0000000000F00000-0x00000000017F2000-memory.dmp

Filesize
8.9MB

Download
memory/4412-54-0x00000000065E0000-0x0000000006B84000-memory.dmp

Filesize
5.6MB

Download
memory/4412-55-0x00000000060D0000-0x0000000006162000-memory.dmp

Filesize
584KB

Download
memory/4412-56-0x00000000060C0000-0x00000000060CA000-memory.dmp

Filesize
40KB

Download