Analysis
- max time kernel
20s - max time network
21s - platform
windows10-2004_x64 - resource
win10v2004-20260130-en - resource tags
- submitted
03/05/2026, 14:19
Errors
General
- Target Bindedzz.exe
- Size 5.7MB
- Sample260503-rm3k2abs8w
- SHA256 3de6e1865b2398eb2bffcfbd0bc1942c6302e5076fdc3f2bf3d51ed23d4b1468
Malware Config
Signatures
- Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
- Checks computer location settings 2 TTPs 3 IoCs
Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE 9 IoCs
- Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Delays execution with timeout.exe 1 IoCs
- Suspicious behavior: EnumeratesProcesses 4 IoCs
- Suspicious use of AdjustPrivilegeToken 14 IoCs
- Suspicious use of WriteProcessMemory 9 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
- Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\Bindedzz.exe"C:\Users\Admin\AppData\Local\Temp\Bindedzz.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\DrbawyVirus.com"C:\Users\Admin\AppData\Local\Temp\DrbawyVirus.com"2⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\injection.exe"C:\Users\Admin\AppData\Local\Temp\injection.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\TROLL5يي.exe"C:\Users\Admin\AppData\Local\Temp\TROLL5يي.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\AppData\Local\Temp\MBR.exe"C:\Users\Admin\AppData\Local\Temp\MBR.exe"2⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\AggregatorHost.exe'3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'AggregatorHost.exe'3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmp5C06.tmp.bat""3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\timeout.exetimeout 34⤵
- Delays execution with timeout.exe
-
-
-
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x498 0x2fc1⤵
-
C:\Users\Admin\AppData\Roaming\SearchApp.exeC:\Users\Admin\AppData\Roaming\SearchApp.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Roaming\SearchApp.exeC:\Users\Admin\AppData\Roaming\SearchApp.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Roaming\AggregatorHost.exeC:\Users\Admin\AppData\Roaming\AggregatorHost.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Roaming\AggregatorHost.exeC:\Users\Admin\AppData\Roaming\AggregatorHost.exe1⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\MBR.exe"C:\Users\Admin\AppData\Local\Temp\MBR.exe"2⤵
- Executes dropped EXE
- Writes to the Master Boot Record (MBR)
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
AggregatorHost.exe.log
SearchApp.exe.log
powershell.exe.log
StartupProfileData-NonInteractive
DrbawyVirus.com
MBR.exe
MBR.exe
TROLL5يي.exe
__PSScriptPolicyTest_034qkzdl.wx1.ps1
injection.exe
tmp5C06.tmp.bat
memory/560-87-0x000001FB46F80000-0x000001FB46F8C000-memory.dmp
memory/560-86-0x000001FB453A0000-0x000001FB45541000-memory.dmp
memory/852-96-0x000000001B7A0000-0x000000001BAF5000-memory.dmp
memory/852-98-0x0000000002D60000-0x0000000002D90000-memory.dmp
memory/852-51-0x0000000000D40000-0x0000000000D92000-memory.dmp
memory/852-106-0x0000000002D60000-0x0000000002D90000-memory.dmp
memory/852-104-0x000000001B7A0000-0x000000001BAF5000-memory.dmp
memory/852-105-0x0000000002D00000-0x0000000002D0C000-memory.dmp
memory/852-97-0x0000000002D00000-0x0000000002D0C000-memory.dmp
memory/1732-19-0x00000000002A0000-0x00000000002DE000-memory.dmp
memory/1732-62-0x000000001ADA0000-0x000000001B0F5000-memory.dmp
memory/2428-72-0x0000019656D90000-0x0000019656DB2000-memory.dmp
memory/2428-75-0x0000019656B40000-0x0000019656B4C000-memory.dmp
memory/2924-52-0x000000001B4A0000-0x000000001B7F5000-memory.dmp
memory/2924-53-0x0000000002A50000-0x0000000002A5C000-memory.dmp
memory/2924-1-0x000000001BBE0000-0x000000001BBF0000-memory.dmp
memory/2924-0-0x0000000000470000-0x0000000000A26000-memory.dmp
memory/3556-63-0x00000000026F0000-0x00000000026FE000-memory.dmp
memory/3556-108-0x000000001B120000-0x000000001B475000-memory.dmp
memory/3556-109-0x00000000026C0000-0x00000000026CC000-memory.dmp
memory/3616-93-0x000000001B6C0000-0x000000001BA15000-memory.dmp
memory/4336-35-0x0000000005950000-0x0000000005EF4000-memory.dmp
memory/4336-95-0x0000000006B70000-0x0000000006BAB000-memory.dmp
memory/4336-94-0x0000000005710000-0x00000000057E3000-memory.dmp
memory/4336-54-0x0000000005630000-0x000000000563A000-memory.dmp
memory/4336-39-0x0000000005480000-0x0000000005512000-memory.dmp
memory/4336-34-0x0000000000850000-0x0000000000A8C000-memory.dmp
memory/4372-110-0x0000000001150000-0x0000000001170000-memory.dmp
memory/4432-58-0x000000001AC80000-0x000000001AFD5000-memory.dmp
memory/4992-21-0x000000001B300000-0x000000001B655000-memory.dmp
memory/4992-22-0x0000000002820000-0x000000000282C000-memory.dmp
memory/4992-8-0x0000000000450000-0x000000000074A000-memory.dmp