Overview
overview
8Static
static
37zxa.dll
windows7-x64
37zxa.dll
windows10-2004-x64
3BLOCKBUSTER.dll
windows7-x64
1BLOCKBUSTER.dll
windows10-2004-x64
1BLOCKBUSTER.exe
windows7-x64
8BLOCKBUSTER.exe
windows10-2004-x64
8hcx.dll
windows7-x64
3hcx.dll
windows10-2004-x64
3unrar.dll
windows7-x64
3unrar.dll
windows10-2004-x64
3Analysis
-
max time kernel
148s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
01-11-2024 16:58
Static task
static1
Behavioral task
behavioral1
Sample
7zxa.dll
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
7zxa.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral3
Sample
BLOCKBUSTER.dll
Resource
win7-20241010-en
Behavioral task
behavioral4
Sample
BLOCKBUSTER.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral5
Sample
BLOCKBUSTER.exe
Resource
win7-20241023-en
Behavioral task
behavioral6
Sample
BLOCKBUSTER.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral7
Sample
hcx.dll
Resource
win7-20240708-en
Behavioral task
behavioral8
Sample
hcx.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral9
Sample
unrar.dll
Resource
win7-20241010-en
Behavioral task
behavioral10
Sample
unrar.dll
Resource
win10v2004-20241007-en
General
-
Target
BLOCKBUSTER.exe
-
Size
9.1MB
-
MD5
74d3f521a38b23cd25ed61e4f8d99f16
-
SHA1
c4cd0e519aeca41e94665f2c5ea60a322deb3680
-
SHA256
1d822b3faabb8f65fc30076d32a95757a2c369ccb64ae54572e9f562280ae845
-
SHA512
ec1c8b0eb895fd8947cad6126abc5bca3a712e42475228b9dcb3496098e720abb83d4cba4621edbd8d3ad7f306a5f57ced9c2c98fe2c2d0c8ebbbf99d7faf0f1
-
SSDEEP
196608:bmFQso3Id5AypjCIN325pMKhQaLh6sOo5LZvqy1f:OQseId5AyZIpMKVLhJtJqS
Malware Config
Signatures
-
Modifies Windows Firewall 2 TTPs 1 IoCs
pid Process 400 netsh.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Control Panel\International\Geo\Nation BLOCKBUSTER.exe -
Loads dropped DLL 2 IoCs
pid Process 1004 BLOCKBUSTER.exe 1004 BLOCKBUSTER.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs
Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.
description ioc Process Key value enumerated \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe -
System Location Discovery: System Language Discovery 1 TTPs 8 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language netsh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ipconfig.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BLOCKBUSTER.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SCHTASKS.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe -
Gathers network information 2 TTPs 1 IoCs
Uses commandline utility to view network configuration.
pid Process 3552 ipconfig.exe -
Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 5072 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 32 IoCs
pid Process 1004 BLOCKBUSTER.exe 1004 BLOCKBUSTER.exe 1004 BLOCKBUSTER.exe 1004 BLOCKBUSTER.exe 1004 BLOCKBUSTER.exe 1004 BLOCKBUSTER.exe 1004 BLOCKBUSTER.exe 1004 BLOCKBUSTER.exe 1004 BLOCKBUSTER.exe 1004 BLOCKBUSTER.exe 1004 BLOCKBUSTER.exe 1004 BLOCKBUSTER.exe 1004 BLOCKBUSTER.exe 1004 BLOCKBUSTER.exe 1004 BLOCKBUSTER.exe 1004 BLOCKBUSTER.exe 1004 BLOCKBUSTER.exe 1004 BLOCKBUSTER.exe 1004 BLOCKBUSTER.exe 1004 BLOCKBUSTER.exe 1004 BLOCKBUSTER.exe 1004 BLOCKBUSTER.exe 1004 BLOCKBUSTER.exe 1004 BLOCKBUSTER.exe 1004 BLOCKBUSTER.exe 1004 BLOCKBUSTER.exe 1004 BLOCKBUSTER.exe 1004 BLOCKBUSTER.exe 1004 BLOCKBUSTER.exe 1004 BLOCKBUSTER.exe 1004 BLOCKBUSTER.exe 1004 BLOCKBUSTER.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 1004 BLOCKBUSTER.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1004 BLOCKBUSTER.exe -
Suspicious use of SetWindowsHookEx 8 IoCs
pid Process 1004 BLOCKBUSTER.exe 1004 BLOCKBUSTER.exe 1004 BLOCKBUSTER.exe 1004 BLOCKBUSTER.exe 1004 BLOCKBUSTER.exe 1004 BLOCKBUSTER.exe 1004 BLOCKBUSTER.exe 1004 BLOCKBUSTER.exe -
Suspicious use of WriteProcessMemory 21 IoCs
description pid Process procid_target PID 1004 wrote to memory of 4912 1004 BLOCKBUSTER.exe 85 PID 1004 wrote to memory of 4912 1004 BLOCKBUSTER.exe 85 PID 1004 wrote to memory of 4912 1004 BLOCKBUSTER.exe 85 PID 1004 wrote to memory of 716 1004 BLOCKBUSTER.exe 89 PID 1004 wrote to memory of 716 1004 BLOCKBUSTER.exe 89 PID 1004 wrote to memory of 716 1004 BLOCKBUSTER.exe 89 PID 1004 wrote to memory of 972 1004 BLOCKBUSTER.exe 91 PID 1004 wrote to memory of 972 1004 BLOCKBUSTER.exe 91 PID 1004 wrote to memory of 972 1004 BLOCKBUSTER.exe 91 PID 716 wrote to memory of 5072 716 cmd.exe 95 PID 716 wrote to memory of 5072 716 cmd.exe 95 PID 716 wrote to memory of 5072 716 cmd.exe 95 PID 972 wrote to memory of 400 972 cmd.exe 94 PID 972 wrote to memory of 400 972 cmd.exe 94 PID 972 wrote to memory of 400 972 cmd.exe 94 PID 1004 wrote to memory of 4352 1004 BLOCKBUSTER.exe 101 PID 1004 wrote to memory of 4352 1004 BLOCKBUSTER.exe 101 PID 1004 wrote to memory of 4352 1004 BLOCKBUSTER.exe 101 PID 4352 wrote to memory of 3552 4352 cmd.exe 103 PID 4352 wrote to memory of 3552 4352 cmd.exe 103 PID 4352 wrote to memory of 3552 4352 cmd.exe 103
Processes
-
C:\Users\Admin\AppData\Local\Temp\BLOCKBUSTER.exe"C:\Users\Admin\AppData\Local\Temp\BLOCKBUSTER.exe"1⤵
- Checks computer location settings
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1004 -
C:\Windows\SysWOW64\SCHTASKS.exeSCHTASKS /Query /TN "BLOCKBUSTER"2⤵
- System Location Discovery: System Language Discovery
PID:4912
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C SCHTASKS /Create /F /RL HIGHEST /TN "BLOCKBUSTER" /TR "C:\Users\Admin\AppData\Local\Temp\BLOCKBUSTER.exe" /SC ONLOGON /DELAY 0001:002⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:716 -
C:\Windows\SysWOW64\schtasks.exeSCHTASKS /Create /F /RL HIGHEST /TN "BLOCKBUSTER" /TR "C:\Users\Admin\AppData\Local\Temp\BLOCKBUSTER.exe" /SC ONLOGON /DELAY 0001:003⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
PID:5072
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C netsh advfirewall firewall add rule name="BLOCKBUSTER" dir=in action=allow program="C:\Users\Admin\AppData\Local\Temp\BLOCKBUSTER.exe" enable=yes profile=any2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:972 -
C:\Windows\SysWOW64\netsh.exenetsh advfirewall firewall add rule name="BLOCKBUSTER" dir=in action=allow program="C:\Users\Admin\AppData\Local\Temp\BLOCKBUSTER.exe" enable=yes profile=any3⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
- System Location Discovery: System Language Discovery
PID:400
-
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /c ipconfig /flushdns2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4352 -
C:\Windows\SysWOW64\ipconfig.exeipconfig /flushdns3⤵
- System Location Discovery: System Language Discovery
- Gathers network information
PID:3552
-
-
Network
MITRE ATT&CK Enterprise v15
Execution
Command and Scripting Interpreter
1Scheduled Task/Job
1Scheduled Task
1Persistence
Create or Modify System Process
1Windows Service
1Event Triggered Execution
1Netsh Helper DLL
1Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Create or Modify System Process
1Windows Service
1Event Triggered Execution
1Netsh Helper DLL
1Scheduled Task/Job
1Scheduled Task
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
398KB
MD5287c055b14d6ab41b021486e4fef3708
SHA1d705e8d163d60b39e0265e30a56966c58323bef3
SHA2563976547348f3cd6887ad0bc6a1f1f54010b58ca5cc1a77a937e882def475ab9e
SHA512fbc627c5d06ff4440d67f7fe97ad187bf6b6472ce9f0584e7ad3d1a391e7006db97d81ac6800a80bd8304172959f01a3bc72c55773d421f2332148731a71f0b1
-
Filesize
309B
MD537906ed8ad2f27ac7c5ee75bfd9ef58e
SHA1453af6cfd82ac47bdcb1e8aed0f6be93e57871c3
SHA256a7dccf360d44c2c985f5d8a34ed631d25895dba72c8b87233f1fdade74554d16
SHA5127bf8878a94653e71b34d98dfb21d57e1dc0e90d9fe1ec8f30c7608490cdd5f20e96fbf5dbea7327b14d9465ef5c955f92acc5bc8642843ec853bf9ff005c7365
-
Filesize
184B
MD5b1f998980222af62d90b11306a64525b
SHA12c9f44bc26838f53085bce97010e4cd2974cfb7c
SHA256cc5e921e3e318aa5541f24f5d72cde1f2f022010c8f39eea3fa610ad5ac5c854
SHA51258f75af5641da479d704834c11c45ce88076e7969b05b3849a58ada125ceafef318b3b46d582d8509312737a1264eaa689a36ba9bda3618c021740f5e371dbd6