Analysis
-
max time kernel
119s -
max time network
125s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
10-11-2024 23:02
Behavioral task
behavioral1
Sample
BLTools v2.9 [PRO].exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
BLTools v2.9 [PRO].exe
Resource
win10v2004-20241007-en
General
-
Target
BLTools v2.9 [PRO].exe
-
Size
7.1MB
-
MD5
bef86c9792f7f8bc658ca1d1bce63c60
-
SHA1
d7d3fe3ae1e950cd4192d46a0bf6505ec3858689
-
SHA256
2ebfc2838c33ff2fc3547369bf0e8bcdfe41c245ede9241602f44afbf7c3cfdb
-
SHA512
6ec05fa9bd6ab5c8f1aaa323c81d9f8ae5905a9dba4c511a57c473f568fa551115442ac325547beaecb5c9813446689be37e0485a8fa78f03bf9e82386a93de7
-
SSDEEP
98304:LinmCgeyQbyt5fTQ7lN7jGb5XQueha05FK7Km53t/VXCRjwsRMJnq2ISUMRlEGy:L0/UVQ7D+b56ha07K7KettcVFcIG
Malware Config
Signatures
-
Processes:
resource yara_rule behavioral1/memory/1928-15-0x000000013F990000-0x0000000140862000-memory.dmp vmprotect behavioral1/memory/1928-16-0x000000013F990000-0x0000000140862000-memory.dmp vmprotect behavioral1/memory/1928-20-0x000000013F990000-0x0000000140862000-memory.dmp vmprotect -
Enumerates connected drives 3 TTPs 1 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
BLTools v2.9 [PRO].exedescription ioc process File opened (read-only) \??\F: BLTools v2.9 [PRO].exe -
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 9 ip-api.com -
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
Processes:
BLTools v2.9 [PRO].exepid process 1928 BLTools v2.9 [PRO].exe -
Suspicious behavior: EnumeratesProcesses 7 IoCs
Processes:
BLTools v2.9 [PRO].exepid process 1928 BLTools v2.9 [PRO].exe 1928 BLTools v2.9 [PRO].exe 1928 BLTools v2.9 [PRO].exe 1928 BLTools v2.9 [PRO].exe 1928 BLTools v2.9 [PRO].exe 1928 BLTools v2.9 [PRO].exe 1928 BLTools v2.9 [PRO].exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
BLTools v2.9 [PRO].exedescription pid process Token: SeShutdownPrivilege 1928 BLTools v2.9 [PRO].exe