Overview
overview
7Static
static
3Boost Bot ... ].zip
windows7-x64
1Boost Bot ... ].zip
windows10-2004-x64
1Boost Bot.exe
windows7-x64
7Boost Bot.exe
windows10-2004-x64
7boosts.json
windows7-x64
3boosts.json
windows10-2004-x64
3config.yaml
windows7-x64
3config.yaml
windows10-2004-x64
3data/faile...s.json
windows7-x64
3data/faile...s.json
windows10-2004-x64
3run.bat
windows7-x64
7run.bat
windows10-2004-x64
7setup_guide.md
windows7-x64
3setup_guide.md
windows10-2004-x64
3Analysis
-
max time kernel
118s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system -
submitted
01-02-2025 23:59
Static task
static1
Behavioral task
behavioral1
Sample
Boost Bot [ v1.9.1 ].zip
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
Boost Bot [ v1.9.1 ].zip
Resource
win10v2004-20250129-en
Behavioral task
behavioral3
Sample
Boost Bot.exe
Resource
win7-20241010-en
Behavioral task
behavioral4
Sample
Boost Bot.exe
Resource
win10v2004-20250129-en
Behavioral task
behavioral5
Sample
boosts.json
Resource
win7-20240903-en
Behavioral task
behavioral6
Sample
boosts.json
Resource
win10v2004-20250129-en
Behavioral task
behavioral7
Sample
config.yaml
Resource
win7-20240903-en
Behavioral task
behavioral8
Sample
config.yaml
Resource
win10v2004-20250129-en
Behavioral task
behavioral9
Sample
data/failed_tokens.json
Resource
win7-20240903-en
Behavioral task
behavioral10
Sample
data/failed_tokens.json
Resource
win10v2004-20241007-en
Behavioral task
behavioral11
Sample
run.bat
Resource
win7-20241010-en
Behavioral task
behavioral12
Sample
run.bat
Resource
win10v2004-20250129-en
Behavioral task
behavioral13
Sample
setup_guide.md
Resource
win7-20240903-en
Behavioral task
behavioral14
Sample
setup_guide.md
Resource
win10v2004-20250129-en
General
-
Target
Boost Bot.exe
-
Size
51.1MB
-
MD5
ba184db9a540813620391efb86f75156
-
SHA1
9c4350e428ccd42f355e1a6a0448205268165948
-
SHA256
17524eb734c8d78c07dc3ddfe6146234aeace53205517bfd01c715a3ca9abfb2
-
SHA512
cfb6bd95c314cbb3690f45bd620a2e511fd347257eadb7b767be4dc79cfe55ce51dd5a7517da60be85881db1dd5b6fc176d0900e8e412bfcf4bc752059efa3a6
-
SSDEEP
786432:/vMPYoaShVVaxycwhWTC/25TzkkDEMvcuLpdGoR81Z9EbFRB97XYxgHY9dY:sBaaVaxoCbTtEfGpwo69EJ5I6C
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 2160 main.exe -
Loads dropped DLL 2 IoCs
pid Process 1972 Boost Bot.exe 2160 main.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 60 IoCs
pid Process 1972 Boost Bot.exe 1972 Boost Bot.exe 1972 Boost Bot.exe 2160 main.exe 2160 main.exe 2160 main.exe 1972 Boost Bot.exe 1972 Boost Bot.exe 1972 Boost Bot.exe 1972 Boost Bot.exe 1972 Boost Bot.exe 1972 Boost Bot.exe 1972 Boost Bot.exe 1972 Boost Bot.exe 1972 Boost Bot.exe 1972 Boost Bot.exe 1972 Boost Bot.exe 1972 Boost Bot.exe 1972 Boost Bot.exe 1972 Boost Bot.exe 1972 Boost Bot.exe 1972 Boost Bot.exe 1972 Boost Bot.exe 1972 Boost Bot.exe 1972 Boost Bot.exe 1972 Boost Bot.exe 1972 Boost Bot.exe 1972 Boost Bot.exe 1972 Boost Bot.exe 1972 Boost Bot.exe 1972 Boost Bot.exe 1972 Boost Bot.exe 1972 Boost Bot.exe 1972 Boost Bot.exe 1972 Boost Bot.exe 1972 Boost Bot.exe 1972 Boost Bot.exe 1972 Boost Bot.exe 1972 Boost Bot.exe 1972 Boost Bot.exe 1972 Boost Bot.exe 1972 Boost Bot.exe 1972 Boost Bot.exe 1972 Boost Bot.exe 1972 Boost Bot.exe 1972 Boost Bot.exe 1972 Boost Bot.exe 1972 Boost Bot.exe 1972 Boost Bot.exe 1972 Boost Bot.exe 1972 Boost Bot.exe 1972 Boost Bot.exe 1972 Boost Bot.exe 1972 Boost Bot.exe 1972 Boost Bot.exe 1972 Boost Bot.exe 1972 Boost Bot.exe 1972 Boost Bot.exe 1972 Boost Bot.exe 1972 Boost Bot.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 1972 wrote to memory of 2160 1972 Boost Bot.exe 31 PID 1972 wrote to memory of 2160 1972 Boost Bot.exe 31 PID 1972 wrote to memory of 2160 1972 Boost Bot.exe 31
Processes
-
C:\Users\Admin\AppData\Local\Temp\Boost Bot.exe"C:\Users\Admin\AppData\Local\Temp\Boost Bot.exe"1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1972 -
C:\Users\Admin\AppData\Local\Temp\onefile_1972_133829280051914000\main.exe"C:\Users\Admin\AppData\Local\Temp\Boost Bot.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
PID:2160
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
41.4MB
MD59413b61bd7383c2640d380097f8f2f8e
SHA15156ac4b1e24a7bf0b7dc21dc63b98d39256f709
SHA256ed69a3a70158667897f575754b44003fccbfb21cad35d15840d95bf66a7f1602
SHA512e5a28f48923ffe63814450322a293a5cb4febad0d833451f7b8b63b42f7613c73fd3b6acb94209816d06377bd8d5181f6af679f8d7e3c423b840ba2e17271742
-
Filesize
4.3MB
MD55fdbe140614b71c20d11cabdfe810319
SHA12b54711b3eb94ddc4c3939d201bed36b23fdc9d9
SHA256f8b2dae29233dfe3a954559740207b3edf46b297ffccaf988d55980bfe92fb7a
SHA51208f193536bae4d3ab081acd25d3e54c5b62b8d28e46e469c1b90d6431de2d6658943afe1d9dd5702d2265694c4967afa1a3c1b10f94d0482bd85a8431bac93bc