Resubmissions

10-11-2024 23:02

241110-21c8eawpdx 10

10-11-2024 23:01

241110-2zttrsxbmk 10

Analysis

  • max time kernel
    119s
  • max time network
    125s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    10-11-2024 23:02

General

  • Target

    BLTools v2.9 [PRO].exe

  • Size

    7.1MB

  • MD5

    bef86c9792f7f8bc658ca1d1bce63c60

  • SHA1

    d7d3fe3ae1e950cd4192d46a0bf6505ec3858689

  • SHA256

    2ebfc2838c33ff2fc3547369bf0e8bcdfe41c245ede9241602f44afbf7c3cfdb

  • SHA512

    6ec05fa9bd6ab5c8f1aaa323c81d9f8ae5905a9dba4c511a57c473f568fa551115442ac325547beaecb5c9813446689be37e0485a8fa78f03bf9e82386a93de7

  • SSDEEP

    98304:LinmCgeyQbyt5fTQ7lN7jGb5XQueha05FK7Km53t/VXCRjwsRMJnq2ISUMRlEGy:L0/UVQ7D+b56ha07K7KettcVFcIG

Score
7/10

Malware Config

Signatures

  • VMProtect packed file 3 IoCs

    Detects executables packed with VMProtect commercial packer.

  • Enumerates connected drives 3 TTPs 1 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 7 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\BLTools v2.9 [PRO].exe
    "C:\Users\Admin\AppData\Local\Temp\BLTools v2.9 [PRO].exe"
    1⤵
    • Enumerates connected drives
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    PID:1928

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/1928-0-0x000000013FDD0000-0x0000000140144000-memory.dmp

    Filesize

    3.5MB

  • memory/1928-1-0x00000000771F0000-0x00000000771F2000-memory.dmp

    Filesize

    8KB

  • memory/1928-3-0x00000000771F0000-0x00000000771F2000-memory.dmp

    Filesize

    8KB

  • memory/1928-10-0x0000000077200000-0x0000000077202000-memory.dmp

    Filesize

    8KB

  • memory/1928-8-0x0000000077200000-0x0000000077202000-memory.dmp

    Filesize

    8KB

  • memory/1928-6-0x0000000077200000-0x0000000077202000-memory.dmp

    Filesize

    8KB

  • memory/1928-15-0x000000013F990000-0x0000000140862000-memory.dmp

    Filesize

    14.8MB

  • memory/1928-5-0x00000000771F0000-0x00000000771F2000-memory.dmp

    Filesize

    8KB

  • memory/1928-16-0x000000013F990000-0x0000000140862000-memory.dmp

    Filesize

    14.8MB

  • memory/1928-20-0x000000013F990000-0x0000000140862000-memory.dmp

    Filesize

    14.8MB

  • memory/1928-21-0x000000013FDD0000-0x0000000140144000-memory.dmp

    Filesize

    3.5MB