Analysis
-
max time kernel
122s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
11-01-2025 13:54
Behavioral task
behavioral1
Sample
boosttool.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
boosttool.exe
Resource
win10v2004-20241007-en
General
-
Target
boosttool.exe
-
Size
11.7MB
-
MD5
90045011e1557ff4adbaf640141fa0ac
-
SHA1
36f09f173fc4085be0b44b22072c099b2483655a
-
SHA256
604a35d33379d4256269f0a2fe6c60819b696001d221515be8688b5b72d9b665
-
SHA512
c4dba2dfbdb3e618eade81f17f339767a0c465e0bf5d50b9dece22b5e1c5a7f453392517486c4be5d2eff49dd975ccece7fdf64619cbd06d065ad20cdcb55b74
-
SSDEEP
196608:HHYShEJ5vi5HuUYBDfWgtlA5RsO5ne0COshoKMuIkhVastRL5Di3uV1DVi:nYSyG5cSgtS7OOshouIkPftRL54u3i
Malware Config
Signatures
-
Loads dropped DLL 1 IoCs
pid Process 2448 boosttool.exe -
resource yara_rule behavioral1/files/0x0005000000019617-22.dat upx behavioral1/memory/2448-24-0x000007FEF66E0000-0x000007FEF6CC9000-memory.dmp upx -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 2936 wrote to memory of 2448 2936 boosttool.exe 30 PID 2936 wrote to memory of 2448 2936 boosttool.exe 30 PID 2936 wrote to memory of 2448 2936 boosttool.exe 30
Processes
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.6MB
MD55f6fd64ec2d7d73ae49c34dd12cedb23
SHA1c6e0385a868f3153a6e8879527749db52dce4125
SHA256ff9f102264d1944fbfae2ba70e7a71435f51a3e8c677fd970b621c4c9ea71967
SHA512c4be2d042c6e4d22e46eacfd550f61b8f55814bfe41d216a4df48382247df70bc63151068513855aa78f9b3d2f10ba6a824312948324c92de6dd0f6af414e8ab