Analysis
- max time kernel
103s - max time network
152s - platform
windows10-2004_x64 - resource
win10v2004-20250610-en - resource tags
- submitted
17/09/2025, 15:03
General
- Target Boostrabpller.exe
- Size 2.6MB
- Sample250917-sfbdmsyk13
- SHA256 984f14e5ffd9a1a2c5f6c1015b8b42cf2eab941e1bcccb2b176736b7ac8bebbb
Malware Config
Signatures
- Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs
- Suspicious behavior: EnumeratesProcesses 4 IoCs
- Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Windows\system32\sihost.exesihost.exe1⤵
-
C:\Windows\system32\openwith.exe"C:\Windows\system32\openwith.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Users\Admin\AppData\Local\Temp\Boostrabpller.exe"C:\Users\Admin\AppData\Local\Temp\Boostrabpller.exe"1⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/2348-10-0x0000023031FD0000-0x00000230323D0000-memory.dmp
memory/2348-16-0x0000023031FD0000-0x00000230323D0000-memory.dmp
memory/2348-14-0x00007FFF57B20000-0x00007FFF57BDE000-memory.dmp
memory/2348-13-0x00007FFF58150000-0x00007FFF58345000-memory.dmp
memory/2348-15-0x00007FFF55DA0000-0x00007FFF56069000-memory.dmp
memory/2348-12-0x0000023031FD0000-0x00000230323D0000-memory.dmp
memory/2348-11-0x0000023031FD0000-0x00000230323D0000-memory.dmp
memory/2348-8-0x0000023030550000-0x000002303055A000-memory.dmp
memory/4228-5-0x000001CCF9160000-0x000001CCF9560000-memory.dmp
memory/4228-7-0x00007FFF55DA0000-0x00007FFF56069000-memory.dmp
memory/4228-6-0x00007FFF57B20000-0x00007FFF57BDE000-memory.dmp
memory/4228-4-0x00007FFF58150000-0x00007FFF58345000-memory.dmp
memory/4228-0-0x0000000140000000-0x00000001400A6000-memory.dmp
memory/4228-3-0x000001CCF9160000-0x000001CCF9560000-memory.dmp
memory/4228-2-0x000001CCF9160000-0x000001CCF9560000-memory.dmp
memory/4228-1-0x000001CCF9160000-0x000001CCF9560000-memory.dmp
memory/4228-17-0x0000000140000000-0x00000001400A6000-memory.dmp
memory/4228-18-0x000001CCF9160000-0x000001CCF9560000-memory.dmp