Overview
overview
10Static
static
3BoltChecke...V2.exe
windows11-21h2-x64
10BoltChecke...cc.exe
windows11-21h2-x64
3BoltChecke...-2.dll
windows11-21h2-x64
3BoltChecke...es.exe
windows11-21h2-x64
3BoltChecke...c1.exe
windows11-21h2-x64
3BoltChecke...-3.dll
windows11-21h2-x64
3BoltChecke...-3.dll
windows11-21h2-x64
3BoltChecke...-2.dll
windows11-21h2-x64
3BoltChecke...10.dll
windows11-21h2-x64
3BoltChecke...-2.dll
windows11-21h2-x64
3BoltChecke...-1.dll
windows11-21h2-x64
3BoltChecke...tml.js
windows11-21h2-x64
3BoltChecke...heck.o
windows11-21h2-x64
3BoltChecke...-dll.o
windows11-21h2-x64
3BoltChecke...-exe.o
windows11-21h2-x64
3BoltChecke...-log.o
windows11-21h2-x64
3BoltChecke...cc.dll
windows11-21h2-x64
1BoltChecke...cc.exe
windows11-21h2-x64
1BoltChecke...cc.exe
windows11-21h2-x64
1Analysis
-
max time kernel
439s -
max time network
1161s -
platform
windows11-21h2_x64 -
resource
win11-20241007-en -
resource tags
arch:x64arch:x86image:win11-20241007-enlocale:en-usos:windows11-21h2-x64system -
submitted
30-11-2024 16:00
Static task
static1
Behavioral task
behavioral1
Sample
BoltChecker(Forntite Checker)/BoltCheckerV2.exe
Resource
win11-20241007-en
Behavioral task
behavioral2
Sample
BoltChecker(Forntite Checker)/Compilers/MinGW64/bin/gcc.exe
Resource
win11-20241007-en
Behavioral task
behavioral3
Sample
BoltChecker(Forntite Checker)/Compilers/MinGW64/bin/libiconv-2.dll
Resource
win11-20241007-en
Behavioral task
behavioral4
Sample
BoltChecker(Forntite Checker)/Compilers/MinGW64/bin/windres.exe
Resource
win11-20241007-en
Behavioral task
behavioral5
Sample
BoltChecker(Forntite Checker)/Compilers/MinGW64/libexec/gcc/x86_64-w64-mingw32/4.9.2/cc1.exe
Resource
win11-20241023-en
Behavioral task
behavioral6
Sample
BoltChecker(Forntite Checker)/Compilers/MinGW64/libexec/gcc/x86_64-w64-mingw32/4.9.2/libcloog-isl-3.dll
Resource
win11-20241007-en
Behavioral task
behavioral7
Sample
BoltChecker(Forntite Checker)/Compilers/MinGW64/libexec/gcc/x86_64-w64-mingw32/4.9.2/libgmp-3.dll
Resource
win11-20241007-en
Behavioral task
behavioral8
Sample
BoltChecker(Forntite Checker)/Compilers/MinGW64/libexec/gcc/x86_64-w64-mingw32/4.9.2/libiconv-2.dll
Resource
win11-20241007-en
Behavioral task
behavioral9
Sample
BoltChecker(Forntite Checker)/Compilers/MinGW64/libexec/gcc/x86_64-w64-mingw32/4.9.2/libisl-10.dll
Resource
win11-20241007-en
Behavioral task
behavioral10
Sample
BoltChecker(Forntite Checker)/Compilers/MinGW64/libexec/gcc/x86_64-w64-mingw32/4.9.2/libmpc-2.dll
Resource
win11-20241007-en
Behavioral task
behavioral11
Sample
BoltChecker(Forntite Checker)/Compilers/MinGW64/libexec/gcc/x86_64-w64-mingw32/4.9.2/libmpfr-1.dll
Resource
win11-20241007-en
Behavioral task
behavioral12
Sample
BoltChecker(Forntite Checker)/Compilers/tinycc/include/winapi/mshtml.js
Resource
win11-20241007-en
Behavioral task
behavioral13
Sample
BoltChecker(Forntite Checker)/Compilers/tinycc/lib/bcheck.o
Resource
win11-20241007-en
Behavioral task
behavioral14
Sample
BoltChecker(Forntite Checker)/Compilers/tinycc/lib/bt-dll.o
Resource
win11-20241007-en
Behavioral task
behavioral15
Sample
BoltChecker(Forntite Checker)/Compilers/tinycc/lib/bt-exe.o
Resource
win11-20241007-en
Behavioral task
behavioral16
Sample
BoltChecker(Forntite Checker)/Compilers/tinycc/lib/bt-log.o
Resource
win11-20241007-en
Behavioral task
behavioral17
Sample
BoltChecker(Forntite Checker)/Compilers/tinycc/libtcc.dll
Resource
win11-20241007-en
Behavioral task
behavioral18
Sample
BoltChecker(Forntite Checker)/Compilers/tinycc/tcc.exe
Resource
win11-20241007-en
Behavioral task
behavioral19
Sample
BoltChecker(Forntite Checker)/Compilers/tinycc/x86_64-win32-tcc.exe
Resource
win11-20241007-en
General
-
Target
BoltChecker(Forntite Checker)/Compilers/tinycc/lib/bcheck.o
-
Size
263KB
-
MD5
3f5f911e8247e4bbe9c7be4fbe36ac8e
-
SHA1
97f8e07c036582290673a0e922fd0c7ef246d18a
-
SHA256
4579a70ff3531ad43f513feda8b71638ab3c89bbcc23f2fb32af6f2f69af93e1
-
SHA512
d6c3dd13b42f4d45d68ed3b61b0ffe1b06909c43d4ffb70c35e24fc91e3e2293523165868c4fef9d0c2d536e8d765d5a5dd48b077676e5d17911a6d629777aca
-
SSDEEP
6144:Y0Nulcp7m6nQZ+zv1I4WQkd1mogWl2VR:Y0NBpqE1I47kd1moHl2
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry class 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2253712635-4068079004-3870069674-1000_Classes\Local Settings OpenWith.exe Key created \REGISTRY\USER\S-1-5-21-2253712635-4068079004-3870069674-1000_Classes\Local Settings cmd.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 3932 OpenWith.exe
Processes
-
C:\Windows\system32\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\BoltChecker(Forntite Checker)\Compilers\tinycc\lib\bcheck.o"1⤵
- Modifies registry class
PID:2248
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:3932