Analysis
- max time kernel
150s - max time network
151s - platform
windows10-2004_x64 - resource
win10v2004-20241007-en - resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system - submitted
02/11/2024, 17:29
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
blops.exe
Resource
win7-20240903-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
blops.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral3
Sample
bsod fix.bat
Resource
win7-20240903-en
windows7-x64
2 signatures
150 seconds
Behavioral task
behavioral4
Sample
bsod fix.bat
Resource
win10v2004-20241007-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral5
Sample
w11 fix.bat
Resource
win7-20240729-en
windows7-x64
8 signatures
150 seconds
Behavioral task
behavioral6
Sample
w11 fix.bat
Resource
win10v2004-20241007-en
windows10-2004-x64
13 signatures
150 seconds
General
- Target blops.exe
- Size 5.8MB
- Sample241102-v21lrs1djm
- SHA256 1ed90eee9ccffebe87adb8799d6c4fdb946d48bf95ef9ce2e5f37307ebd9f938
- MD5 c2d8ef9af7a8028d05c77feebb9f166b
- SHA1 1d4efe941178fd9b73f245c36e3ddb819e1f5ddf
- SHA512 8786a66fa0a1e8e5fa480e3458ced621c923a1dfa6bb7600c3f5c6fcf719d2d0104539a331383dda158413ff0fb14f54dd168f93885df1b2e7f258059cf21bea
- SSDEEP 98304:8Bt52Ag52MjEPwH3trXQy6Nc0mxfmno7cHQOvrhye/iLK6uK7ovc7gmO:8BtXg5Eq3GyDxz7RUnKfuK8E7g
- MD5 SHA1 SHA512 SSDEEP
Score
5/10
Malware Config
Signatures
- Suspicious use of NtSetInformationThreadHideFromDebugger 4 IoCs
pid Process 2248 blops.exe 2248 blops.exe 2248 blops.exe 2248 blops.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2248 blops.exe 2248 blops.exe 2248 blops.exe 2248 blops.exe 2248 blops.exe 2248 blops.exe 2248 blops.exe 2248 blops.exe 2248 blops.exe 2248 blops.exe 2248 blops.exe 2248 blops.exe 2248 blops.exe 2248 blops.exe 2248 blops.exe 2248 blops.exe 2248 blops.exe 2248 blops.exe 2248 blops.exe 2248 blops.exe 2248 blops.exe 2248 blops.exe 2248 blops.exe 2248 blops.exe 2248 blops.exe 2248 blops.exe 2248 blops.exe 2248 blops.exe 2248 blops.exe 2248 blops.exe 2248 blops.exe 2248 blops.exe 2248 blops.exe 2248 blops.exe 2248 blops.exe 2248 blops.exe 2248 blops.exe 2248 blops.exe 2248 blops.exe 2248 blops.exe 2248 blops.exe 2248 blops.exe 2248 blops.exe 2248 blops.exe 2248 blops.exe 2248 blops.exe 2248 blops.exe 2248 blops.exe 2248 blops.exe 2248 blops.exe 2248 blops.exe 2248 blops.exe 2248 blops.exe 2248 blops.exe 2248 blops.exe 2248 blops.exe 2248 blops.exe 2248 blops.exe 2248 blops.exe 2248 blops.exe 2248 blops.exe 2248 blops.exe 2248 blops.exe 2248 blops.exe - Suspicious use of WriteProcessMemory 10 IoCs
description pid Process procid_target PID 2248 wrote to memory of 4564 2248 blops.exe 85 PID 2248 wrote to memory of 4564 2248 blops.exe 85 PID 4564 wrote to memory of 1968 4564 cmd.exe 86 PID 4564 wrote to memory of 1968 4564 cmd.exe 86 PID 4564 wrote to memory of 4536 4564 cmd.exe 87 PID 4564 wrote to memory of 4536 4564 cmd.exe 87 PID 4564 wrote to memory of 4344 4564 cmd.exe 88 PID 4564 wrote to memory of 4344 4564 cmd.exe 88 PID 2248 wrote to memory of 5060 2248 blops.exe 92 PID 2248 wrote to memory of 5060 2248 blops.exe 92
Processes
-
C:\Users\Admin\AppData\Local\Temp\blops.exe"C:\Users\Admin\AppData\Local\Temp\blops.exe"1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2248 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c certutil -hashfile "C:\Users\Admin\AppData\Local\Temp\blops.exe" MD5 | find /i /v "md5" | find /i /v "certutil"2⤵
- Suspicious use of WriteProcessMemory
PID:4564 -
C:\Windows\system32\certutil.execertutil -hashfile "C:\Users\Admin\AppData\Local\Temp\blops.exe" MD53⤵PID:1968
-
-
C:\Windows\system32\find.exefind /i /v "md5"3⤵PID:4536
-
-
C:\Windows\system32\find.exefind /i /v "certutil"3⤵PID:4344
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c CLS2⤵PID:5060
-