Overview
overview
10Static
static
10bluewing T...er.exe
windows7-x64
10bluewing T...er.exe
windows10-2004-x64
10bluewing T...er.exe
windows7-x64
1bluewing T...er.exe
windows10-2004-x64
7bluewing T...ss.exe
windows7-x64
1bluewing T...ss.exe
windows10-2004-x64
1bluewing T...er.exe
windows7-x64
1bluewing T...er.exe
windows10-2004-x64
1bluewing TS/rust.exe
windows7-x64
1bluewing TS/rust.exe
windows10-2004-x64
6bluewing T...sp.exe
windows7-x64
5bluewing T...sp.exe
windows10-2004-x64
5bluewing T...ll.exe
windows7-x64
5bluewing T...ll.exe
windows10-2004-x64
5Analysis
- max time kernel
63s - max time network
65s - platform
windows10-2004_x64 - resource
win10v2004-20250217-en - resource tags
arch:x64arch:x86image:win10v2004-20250217-enlocale:en-usos:windows10-2004-x64system - submitted
21/02/2025, 14:59
Behavioral task
behavioral1
Sample
bluewing TS/BlueWing Cleaner.exe
Resource
win7-20241010-en
windows7-x64
Behavioral task
behavioral2
Sample
bluewing TS/BlueWing Cleaner.exe
Resource
win10v2004-20250217-en
windows10-2004-x64
Behavioral task
behavioral3
Sample
bluewing TS/Loader.exe
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral4
Sample
bluewing TS/Loader.exe
Resource
win10v2004-20250217-en
windows10-2004-x64
Behavioral task
behavioral5
Sample
bluewing TS/bluewing bypass.exe
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral6
Sample
bluewing TS/bluewing bypass.exe
Resource
win10v2004-20250217-en
windows10-2004-x64
Behavioral task
behavioral7
Sample
bluewing TS/bluewing woofer.exe
Resource
win7-20240729-en
windows7-x64
Behavioral task
behavioral8
Sample
bluewing TS/bluewing woofer.exe
Resource
win10v2004-20250217-en
windows10-2004-x64
Behavioral task
behavioral9
Sample
bluewing TS/rust.exe
Resource
win7-20241023-en
windows7-x64
Behavioral task
behavioral10
Sample
bluewing TS/rust.exe
Resource
win10v2004-20250217-en
windows10-2004-x64
Behavioral task
behavioral11
Sample
bluewing TS/valorant esp.exe
Resource
win7-20241010-en
windows7-x64
Behavioral task
behavioral12
Sample
bluewing TS/valorant esp.exe
Resource
win10v2004-20250217-en
windows10-2004-x64
Behavioral task
behavioral13
Sample
bluewing TS/valorant full.exe
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral14
Sample
bluewing TS/valorant full.exe
Resource
win10v2004-20250217-en
windows10-2004-x64
General
- Target bluewing TS/valorant full.exe
- Size 910KB
- Sample250221-sc4wsawks7
- SHA256 54abc7b31f3167221eb186cf5a1ab9dc7b4945e9da4a241b46b7fbeb932fe3c7
- MD5 a4589be07699d55f1e84de98fb8e14dc
- SHA1 409e3df648fcd2bd70d5569ba9e39faa4b6eefb3
- SHA512 313d34b55a8ffe68c208b800f77610b1cd2740f1b56939d1b95b8793b7c643da767237649c5534ea9eb39bd60e2776c2542fb38326bd817d728d8984b8fdcda6
- SSDEEP 24576:lKg+vBX4JpuCUX0Qpuvgdx/y5RL90q+wRw:z+Zupu/kqFdxENAwRw
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Signatures
- Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
pid Process 3668 valorant full.exe -
resource yara_rule behavioral14/memory/3668-0-0x00007FF614DF0000-0x00007FF614FDC000-memory.dmp upx behavioral14/memory/3668-8-0x00007FF614DF0000-0x00007FF614FDC000-memory.dmp upx behavioral14/memory/3668-9-0x00007FF614DF0000-0x00007FF614FDC000-memory.dmp upx behavioral14/memory/3668-15-0x00007FF614DF0000-0x00007FF614FDC000-memory.dmp upx behavioral14/memory/3668-20-0x00007FF614DF0000-0x00007FF614FDC000-memory.dmp upx behavioral14/memory/3668-25-0x00007FF614DF0000-0x00007FF614FDC000-memory.dmp upx behavioral14/memory/3668-31-0x00007FF614DF0000-0x00007FF614FDC000-memory.dmp upx behavioral14/memory/3668-37-0x00007FF614DF0000-0x00007FF614FDC000-memory.dmp upx - Suspicious behavior: EnumeratesProcesses 52 IoCs
pid Process 3668 valorant full.exe 3668 valorant full.exe 3668 valorant full.exe 3668 valorant full.exe 3668 valorant full.exe 3668 valorant full.exe 3668 valorant full.exe 3668 valorant full.exe 3668 valorant full.exe 3668 valorant full.exe 3668 valorant full.exe 3668 valorant full.exe 3668 valorant full.exe 3668 valorant full.exe 3668 valorant full.exe 3668 valorant full.exe 3668 valorant full.exe 3668 valorant full.exe 3668 valorant full.exe 3668 valorant full.exe 3668 valorant full.exe 3668 valorant full.exe 3668 valorant full.exe 3668 valorant full.exe 3668 valorant full.exe 3668 valorant full.exe 3668 valorant full.exe 3668 valorant full.exe 3668 valorant full.exe 3668 valorant full.exe 3668 valorant full.exe 3668 valorant full.exe 3668 valorant full.exe 3668 valorant full.exe 3668 valorant full.exe 3668 valorant full.exe 3668 valorant full.exe 3668 valorant full.exe 3668 valorant full.exe 3668 valorant full.exe 3668 valorant full.exe 3668 valorant full.exe 3668 valorant full.exe 3668 valorant full.exe 3668 valorant full.exe 3668 valorant full.exe 3668 valorant full.exe 3668 valorant full.exe 3668 valorant full.exe 3668 valorant full.exe 3668 valorant full.exe 3668 valorant full.exe - Suspicious use of WriteProcessMemory 16 IoCs
description pid Process procid_target PID 3668 wrote to memory of 368 3668 valorant full.exe 86 PID 3668 wrote to memory of 368 3668 valorant full.exe 86 PID 368 wrote to memory of 2204 368 cmd.exe 87 PID 368 wrote to memory of 2204 368 cmd.exe 87 PID 368 wrote to memory of 1952 368 cmd.exe 88 PID 368 wrote to memory of 1952 368 cmd.exe 88 PID 368 wrote to memory of 3060 368 cmd.exe 89 PID 368 wrote to memory of 3060 368 cmd.exe 89 PID 3668 wrote to memory of 4140 3668 valorant full.exe 90 PID 3668 wrote to memory of 4140 3668 valorant full.exe 90 PID 3668 wrote to memory of 464 3668 valorant full.exe 91 PID 3668 wrote to memory of 464 3668 valorant full.exe 91 PID 464 wrote to memory of 4936 464 cmd.exe 92 PID 464 wrote to memory of 4936 464 cmd.exe 92 PID 3668 wrote to memory of 3852 3668 valorant full.exe 97 PID 3668 wrote to memory of 3852 3668 valorant full.exe 97
Processes
-
C:\Users\Admin\AppData\Local\Temp\bluewing TS\valorant full.exe"C:\Users\Admin\AppData\Local\Temp\bluewing TS\valorant full.exe"1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3668 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c certutil -hashfile "C:\Users\Admin\AppData\Local\Temp\bluewing TS\valorant full.exe" MD5 | find /i /v "md5" | find /i /v "certutil"2⤵
- Suspicious use of WriteProcessMemory
PID:368 -
C:\Windows\system32\certutil.execertutil -hashfile "C:\Users\Admin\AppData\Local\Temp\bluewing TS\valorant full.exe" MD53⤵PID:2204
-
-
C:\Windows\system32\find.exefind /i /v "md5"3⤵PID:1952
-
-
C:\Windows\system32\find.exefind /i /v "certutil"3⤵PID:3060
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cls2⤵PID:4140
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c curl -s -o C:\VG-Config\control.txt http://www.eccheats.store/control.txt2⤵
- Suspicious use of WriteProcessMemory
PID:464 -
C:\Windows\system32\curl.execurl -s -o C:\VG-Config\control.txt http://www.eccheats.store/control.txt3⤵PID:4936
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cls2⤵PID:3852
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\ProgramData\KeyAuth\Debug\valorant full\02-21-2025.txt
- Size 6KB
- SHA256 ca1b3d66712a962699d431bf1492b3b8496ff476e43323984e25c312c64fc1c6
- MD5 676dfda2df4986cf701e8fc6b420fb85
- SHA1 988193cf78f0783c6c4339702350169daa2dcfd1
- SHA512 fa25e1f66067336fb6ec9d74ac059f3b0b0794c2dbb54a730fd24d23ceef69c7171d6be4588fb707dc6f56ae196f73b6e4cbf28c637790b26ae1d930d8a6bbd2
- SSDEEP 96:4M9FCqqonbw7EoUJ0RQRUioPiuoCXoGnoH7HmboGTcLoHELvJo/k/9oo9XoCJvsT:N9FC2bwaSQztNDzQr
- MD5 SHA1 SHA512 SSDEEP
- Path C:\VG-Config\control.txt
- Size 3B
- SHA256 00d60e31a4e6b8344d4201f25a6a7dee770713107f6d097abb01559d32b17f26
- MD5 c5301693c4e792bcd5a479ef38fb8f8d
- SHA1 b1b392607deaf29a7e81453e069b7c07a32a6b18
- SHA512 2a25cdbf38d8390e5f91a0da0c4352e53c4d2ff002c83410ddbfcaf71919f6dee74bd37f597c30225c8fa9e88854605faac5c8d6efbda0e50b2715b7d31d94b5
- MD5 SHA1 SHA512