Overview
overview
10Static
static
10windows.zip
windows11-21h2-x64
8windows/cf...ch.vbs
windows11-21h2-x64
3windows/idc/ida.js
windows11-21h2-x64
3windows/li...le.dll
windows11-21h2-x64
8windows/libclang.dll
windows11-21h2-x64
8windows/libdwarf.dll
windows11-21h2-x64
8windows/li...le.dll
windows11-21h2-x64
8windows/libz3.dll
windows11-21h2-x64
8windows/lo...if.dll
windows11-21h2-x64
3windows/lo...ga.dll
windows11-21h2-x64
3windows/lo...of.dll
windows11-21h2-x64
3windows/lo...ut.dll
windows11-21h2-x64
8windows/lo...tar.py
windows11-21h2-x64
3windows/lo...ip.dll
windows11-21h2-x64
8windows/lo...ldr.py
windows11-21h2-x64
8windows/lo...age.py
windows11-21h2-x64
8windows/lo...rc.dll
windows11-21h2-x64
8windows/lo...ff.dll
windows11-21h2-x64
8windows/lo...x_m.py
windows11-21h2-x64
3windows/lo...ex.dll
windows11-21h2-x64
8windows/lo...os.dll
windows11-21h2-x64
3windows/lo...lod.py
windows11-21h2-x64
3windows/lo...mp.dll
windows11-21h2-x64
8windows/lo...lf.dll
windows11-21h2-x64
8windows/lo...oc.dll
windows11-21h2-x64
windows/lo...esp.py
windows11-21h2-x64
3windows/lo...ad.dll
windows11-21h2-x64
8windows/lo...os.dll
windows11-21h2-x64
8windows/lo...ex.dll
windows11-21h2-x64
8windows/lo...om.dll
windows11-21h2-x64
windows/lo...mf.dll
windows11-21h2-x64
3windows/lo...dr.dll
windows11-21h2-x64
8Analysis
-
max time kernel
506s -
max time network
737s -
platform
windows11-21h2_x64 -
resource
win11-20250207-en -
resource tags
arch:x64arch:x86image:win11-20250207-enlocale:en-usos:windows11-21h2-x64system -
submitted
09/02/2025, 15:25
Behavioral task
behavioral1
Sample
windows.zip
Resource
win11-20250207-en
Behavioral task
behavioral2
Sample
windows/cfg/gdb_arch.vbs
Resource
win11-20250207-en
Behavioral task
behavioral3
Sample
windows/idc/ida.js
Resource
win11-20250207-en
Behavioral task
behavioral4
Sample
windows/libSwiftDemangle.dll
Resource
win11-20250207-en
Behavioral task
behavioral5
Sample
windows/libclang.dll
Resource
win11-20250207-en
Behavioral task
behavioral6
Sample
windows/libdwarf.dll
Resource
win11-20250207-en
Behavioral task
behavioral7
Sample
windows/librustdemangle.dll
Resource
win11-20250207-en
Behavioral task
behavioral8
Sample
windows/libz3.dll
Resource
win11-20250207-en
Behavioral task
behavioral9
Sample
windows/loaders/aif.dll
Resource
win11-20250207-en
Behavioral task
behavioral10
Sample
windows/loaders/amiga.dll
Resource
win11-20250207-en
Behavioral task
behavioral11
Sample
windows/loaders/aof.dll
Resource
win11-20250207-en
Behavioral task
behavioral12
Sample
windows/loaders/aout.dll
Resource
win11-20250207-en
Behavioral task
behavioral13
Sample
windows/loaders/archldr_tar.py
Resource
win11-20250207-en
Behavioral task
behavioral14
Sample
windows/loaders/archldr_zip.dll
Resource
win11-20250207-en
Behavioral task
behavioral15
Sample
windows/loaders/bfltldr.py
Resource
win11-20250207-en
Behavioral task
behavioral16
Sample
windows/loaders/bios_image.py
Resource
win11-20250207-en
Behavioral task
behavioral17
Sample
windows/loaders/bochsrc.dll
Resource
win11-20250207-en
Behavioral task
behavioral18
Sample
windows/loaders/coff.dll
Resource
win11-20250207-en
Behavioral task
behavioral19
Sample
windows/loaders/cortex_m.py
Resource
win11-20250207-en
Behavioral task
behavioral20
Sample
windows/loaders/dex.dll
Resource
win11-20250207-en
Behavioral task
behavioral21
Sample
windows/loaders/dos.dll
Resource
win11-20250207-en
Behavioral task
behavioral22
Sample
windows/loaders/dsp_lod.py
Resource
win11-20250207-en
Behavioral task
behavioral23
Sample
windows/loaders/dump.dll
Resource
win11-20250207-en
Behavioral task
behavioral24
Sample
windows/loaders/elf.dll
Resource
win11-20250207-en
Behavioral task
behavioral25
Sample
windows/loaders/epoc.dll
Resource
win11-20250207-en
Behavioral task
behavioral26
Sample
windows/loaders/esp.py
Resource
win11-20250207-en
Behavioral task
behavioral27
Sample
windows/loaders/expload.dll
Resource
win11-20250207-en
Behavioral task
behavioral28
Sample
windows/loaders/geos.dll
Resource
win11-20250207-en
Behavioral task
behavioral29
Sample
windows/loaders/hex.dll
Resource
win11-20250207-en
Behavioral task
behavioral30
Sample
windows/loaders/hpsom.dll
Resource
win11-20250207-en
Behavioral task
behavioral31
Sample
windows/loaders/intelomf.dll
Resource
win11-20250207-en
Behavioral task
behavioral32
Sample
windows/loaders/javaldr.dll
Resource
win11-20250207-en
General
-
Target
windows/loaders/bfltldr.py
-
Size
7KB
-
MD5
3f48512a8d7dfee6435d2b20272285a7
-
SHA1
dcdb773c4ae50d170be74d471e0c924a93b1e3e0
-
SHA256
0ac8de46ee753db52f2a9433a3431e64642afef1838c95d6745270d93eb3dd40
-
SHA512
ee3fce70b88444ec216b478647eac8c801323f56251598d2819599c11beabffbdbfdc0fe3f56cd23a04ec086c08e2f733947f79d9603ed7e652e454bbf604cc0
-
SSDEEP
96:ZwwmmupkfqCz/vmyZR//ITjmzjKfhfv55gnZECXlkBqInp:BupWTzvHIkjKZfvazlkBqKp
Malware Config
Signatures
-
Downloads MZ/PE file 3 IoCs
flow pid Process 12 1556 Process not Found 24 1556 Process not Found 22 3676 Process not Found -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MicrosoftEdgeUpdate.exe -
System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs
Adversaries may check for Internet connectivity on compromised systems.
pid Process 1212 MicrosoftEdgeUpdate.exe -
Modifies registry class 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3582203-3971487063-2733630963-1000_Classes\Local Settings OpenWith.exe Key created \REGISTRY\USER\S-1-5-21-3582203-3971487063-2733630963-1000_Classes\Local Settings cmd.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 3916 OpenWith.exe
Processes
-
C:\Windows\system32\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\windows\loaders\bfltldr.py1⤵
- Modifies registry class
PID:3252
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:3916
-
C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xOTUuNDMiIHNoZWxsX3ZlcnNpb249IjEuMy4xOTUuNDMiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7NUJDNTA0NTUtMDhCOC00ODI2LTk2QkYtMDEzODgyRjZBMTNEfSIgdXNlcmlkPSJ7MjdDOTZBNTEtQTY5NC00Q0M0LUE1MEEtQzVDM0UyMTAyRUZEfSIgaW5zdGFsbHNvdXJjZT0ibGltaXRlZCIgcmVxdWVzdGlkPSJ7RDUxRURGMDgtMzA4My00ODc4LTk1MzItQjI3MDNGOTM1NEM3fSIgZGVkdXA9ImNyIiBkb21haW5qb2luZWQ9IjAiPjxodyBsb2dpY2FsX2NwdXM9IjIiIHBoeXNtZW1vcnk9IjQiIGRpc2tfdHlwZT0iMiIgc3NlPSIxIiBzc2UyPSIxIiBzc2UzPSIxIiBzc3NlMz0iMSIgc3NlNDE9IjEiIHNzZTQyPSIxIiBhdng9IjEiLz48b3MgcGxhdGZvcm09IndpbiIgdmVyc2lvbj0iMTAuMC4yMjAwMC40OTMiIHNwPSIiIGFyY2g9Ing2NCIgcHJvZHVjdF90eXBlPSI0OCIgaXNfd2lwPSIwIiBpc19pbl9sb2NrZG93bl9tb2RlPSIwIi8-PG9lbSBwcm9kdWN0X21hbnVmYWN0dXJlcj0iIiBwcm9kdWN0X25hbWU9IiIvPjxleHAgZXRhZz0iJnF1b3Q7RSt4YkF6Nlk2c1UxMjg5YlM2cWw0VlJMYmtqZkJVR1RNSnNqckhyNDRpST0mcXVvdDsiLz48YXBwIGFwcGlkPSJ7OEE2OUQzNDUtRDU2NC00NjNjLUFGRjEtQTY5RDlFNTMwRjk2fSIgdmVyc2lvbj0iMTIzLjAuNjMxMi4xMjMiIG5leHR2ZXJzaW9uPSIiIGxhbmc9ImVuIiBicmFuZD0iR0dMUyIgY2xpZW50PSIiIGluc3RhbGxhZ2U9IjEiIGluc3RhbGxkYXRldGltZT0iMTczODk1Njc0OSIgb29iZV9pbnN0YWxsX3RpbWU9IjEzMzgzNDI5MTcwNDQ2MDAwMCI-PGV2ZW50IGV2ZW50dHlwZT0iMzEiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjIxNzk4NjIiIHN5c3RlbV91cHRpbWVfdGlja3M9IjUyNzk4NTI4OTQiLz48L2FwcD48L3JlcXVlc3Q-1⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
PID:1212