8c0e799108d8f1686839102cc81ec4cc9008b810e722d2a8dd1401d20e956a08

Analysis

max time kernel
27s
max time network
30s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260617-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260617-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
28/06/2026, 04:31

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Boost bot V2.0.0.exe
Size 6.5MB
Sample260628-e5h8wsfs5n
SHA256 8c0e799108d8f1686839102cc81ec4cc9008b810e722d2a8dd1401d20e956a08
MD5 c754cf71a51c8ac7e121e155ab310dc5
SHA1 a6006efcf466c07d65b1dddc3549fa387b8dd60f
SHA512 adbdf71cedba4742c84de8419178483bae3eb359bf02ac9cd08a93da130ae84e667265f6d39e80c77a7b9b10c96cd26f97f92a0a858ab78c2af12a86028fa0fc
SSDEEP 98304:ytaW5AskzTC6AEjsB/3DNTLQYLTrAS4rAStn3TfV:SchyPhFR4rASd9
TLSH
T17E663321F2CE1C56A75254F8B0FEF6BA917A6D78B4639008F1ED6BA0C01CB0D16F157A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

credential_access discovery persistence spyware stealer upx

Malware Config

Signatures

Credentials from Password Stores: Windows Credential Manager 1 TTPs
Suspicious access to Credentials History.
credential_access stealer

Windows Credential Manager
T1555.004

Executes dropped EXE 3 IoCs

pid	Process
5604	wu_2004.exe
4320	wu.exe
5100	wu_4320.exe

Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3226024100-3888324339-2736661264-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsUpdate = "C:\\Users\\Admin\\AppData\\Roaming\\WindowsUpdate\\wu.exe"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3226024100-3888324339-2736661264-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsUpdate = "C:\\Users\\Admin\\AppData\\Roaming\\WindowsUpdate\\wu.exe"	reg.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

UPX packed file 5 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/2004-0-0x00007FF6823A0000-0x00007FF684BE8000-memory.dmp	upx
behavioral2/memory/2004-7-0x00007FF6823A0000-0x00007FF684BE8000-memory.dmp	upx
behavioral2/files/0x001600000001c456-19.dat	upx
behavioral2/memory/4320-20-0x00007FF7494B0000-0x00007FF74BCF8000-memory.dmp	upx
behavioral2/memory/4320-99-0x00007FF7494B0000-0x00007FF74BCF8000-memory.dmp	upx

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	wu_2004.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	wu_2004.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	wu_2004.exe

Modifies registry key 1 TTPs 2 IoCs

Modify Registry

T1112

pid	Process
5272	reg.exe
3756	reg.exe

Suspicious behavior: EnumeratesProcesses 18 IoCs

pid	Process
748	chrome.exe
748	chrome.exe
748	chrome.exe
748	chrome.exe
5176	msedge.exe
5176	msedge.exe
5604	wu_2004.exe
5604	wu_2004.exe
5604	wu_2004.exe
5604	wu_2004.exe
5604	wu_2004.exe
5604	wu_2004.exe
5604	wu_2004.exe
5604	wu_2004.exe
5604	wu_2004.exe
5604	wu_2004.exe
5604	wu_2004.exe
5604	wu_2004.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2004 wrote to memory of 5272	2004	Boost bot V2.0.0.exe	89
PID 2004 wrote to memory of 5604	2004	Boost bot V2.0.0.exe	91
PID 5604 wrote to memory of 748	5604	wu_2004.exe	93
PID 5604 wrote to memory of 748	5604	wu_2004.exe	93
PID 5604 wrote to memory of 5176	5604	wu_2004.exe	98
PID 5604 wrote to memory of 5176	5604	wu_2004.exe	98
PID 4320 wrote to memory of 3756	4320	wu.exe	99
PID 4320 wrote to memory of 5100	4320	wu.exe	101

C:\Users\Admin\AppData\Local\Temp\Boost bot V2.0.0.exe
"C:\Users\Admin\AppData\Local\Temp\Boost bot V2.0.0.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2004
- C:\Windows\system32\reg.exe
  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v WindowsUpdate /t REG_SZ /d C:\Users\Admin\AppData\Roaming\WindowsUpdate\wu.exe /f
  2⤵
  - Adds Run key to start application
  - Modifies registry key
  PID:5272
- C:\Users\Admin\AppData\Local\Temp\wu_2004.exe
  C:\Users\Admin\AppData\Local\Temp/wu_2004.exe
  2⤵
  - Executes dropped EXE
  - Checks processor information in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:5604
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:748
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:5176

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:4984

C:\Users\Admin\AppData\Roaming\WindowsUpdate\wu.exe
C:\Users\Admin\AppData\Roaming\WindowsUpdate\wu.exe
1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4320
- C:\Windows\system32\reg.exe
  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v WindowsUpdate /t REG_SZ /d C:\Users\Admin\AppData\Roaming\WindowsUpdate\wu.exe /f
  2⤵
  - Adds Run key to start application
  - Modifies registry key
  PID:3756
- C:\Users\Admin\AppData\Local\Temp\wu_4320.exe
  C:\Users\Admin\AppData\Local\Temp/wu_4320.exe
  2⤵
  - Executes dropped EXE
  PID:5100

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:4444

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Windows Credential Manager

T1555.004

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Log.txt

Path C:\Users\Admin\AppData\Local\Temp\Log.txt
Size 2KB
SHA256 9bdf24c01cc60a11c4fed8cb0762e022e3dc88f13643c0945254784cea2d451a
MD5 8f4cd7449f4df222138b26973d9412d8
SHA1 3693c4efc9d84a1ff199e7d2778fd7a5cae54de6
SHA512 ee53978373dafabea436017f16d58428910d48143b8f3643074c8a41c6f4886876e63e1e31f1345408a1ab10a7fe5b52256b832acd1dc2ccf45fc677827c1fbc
TLSH
T106511D4798D6C81E2760E8D3E332E22CDAE088586FCD37115789C88D34C655BF6CA757
MD5 SHA1 SHA512 TLSH

Submit Download

Log.txt

Path C:\Users\Admin\AppData\Local\Temp\Log.txt
Size 254B
SHA256 95b7fc78051d2e91c08c6347f8a8b6865b33718ac95aae9832b21ffcf0ba4f4c
MD5 af0fecd784a923a0b8a531e2193fc402
SHA1 d2f3304e6260322be851c322c13e6f4331f1a854
SHA512 23e4a5bb229caca8144d0dd9bdec6a890532a695f7e268ff3e361e533ad466ccac28195adc071db302305a574ffe74a7dadc595af6620ce4c530a6a670096ae1
TLSH
T167D09712EC82C0CC26A2E4B78300556DDCFF4018AB590303BB86808D14C0B0C9CCB3EA
MD5 SHA1 SHA512 TLSH

Submit Download

Log.txt

Path C:\Users\Admin\AppData\Local\Temp\Log.txt
Size 4KB
SHA256 3db77acf5e59d9520b857272bc9145d5ca6c499a3999204a42da22d7f3199640
MD5 7fb0541c3b117223fcd7d4b70265ab24
SHA1 a53caf5d9309356c46e1cff76c5aaaccec1db6e4
SHA512 299fef2490f910225e134e5eee854010626cc278e55d9b147c4b486c60b81cb038cf86e6370203dbab7e5f0449a7bafe95d6cb7cb1e2d899867c9bd2f0426f05
SSDEEP 96:Y/adB5/q/6G/eG/t/YImO9dj5mvmpGmqmGejldsdSJdjdx4drfidfIfmnf3D6fjN:5v5TE9lz2e7DywI6hFJtar
TLSH
T12391F00699D6CA1E2B90E8D39772E26CD5F188483FC937209B69C88D34C645EF6C6397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Log.txt

Path C:\Users\Admin\AppData\Local\Temp\Log.txt
Size 1017B
SHA256 7ccb577dce2fa4635dec435c09808599992dd1c4a343223d2a93bbeca0134246
MD5 c805811222d82d83553c23a60a2afc24
SHA1 1053a2aba88471c610e6b3a0b723fa11e7978828
SHA512 0880d52f5e9da40b61b7ead94d9c4051be75eaded69710f38c3880e3e8c79e2926a654b695984bbf04e6befb256dbc2a63354e6d7307fce992f244fdc707bc90
TLSH
T1DF117B02BCC5D82E1140E8E39361B66C9CE484049BCE2B429B85D98C75C582EF5CE367
MD5 SHA1 SHA512 TLSH

Submit Download

Log.txt

Path C:\Users\Admin\AppData\Local\Temp\Log.txt
Size 1KB
SHA256 74f8c9648842f8354b7e20dc4d5b62a44f266eeb8b67a2ad98a25ac094aa18b5
MD5 b77eb33a8aecfd48bc589337995b8f48
SHA1 527671956ba22fc174d900ca7e66c8303a42835d
SHA512 ba27dd8e1deaf484d7a1c0812090d24235a5c3f554dae7727e7d17c3d9fd3c3da5b6bfeb667c1fc9e686297bb533a176d914b964d911ec6d55049bfb8d6b145e
TLSH
T15D316C02F9C6D82E2200FCD39355EA6C98E484499BCE3B469B44DC4CB58685EF6DF357
MD5 SHA1 SHA512 TLSH

Submit Download

Log.txt

Path C:\Users\Admin\AppData\Local\Temp\Log.txt
Size 1KB
SHA256 73082a26cffc112cf3ec959234cc5e71c82ab9d3f9f7c47cc7482c11f95b5ee8
MD5 28461bfe72366f1167a56eaebbd12939
SHA1 41869d6652c9a9aff05a8e5d29c36113a1ce40ae
SHA512 0054804f0dcfb4ae93456fa8df649978b844d1c10942b0b41c0bfd4d2dfe3d18d075f489017a1062ff5b34cc8cbe3cea03b243a6630a6b07950561c3c6108b5b
TLSH
T1C3319C02FDC6D82E1100BCD39355E66C98E484489BCE3B429B44DC4C758685EF6CF357
MD5 SHA1 SHA512 TLSH

Submit Download

Log.txt

Path C:\Users\Admin\AppData\Local\Temp\Log.txt
Size 2KB
SHA256 40869b4dedb31bb79faa2aad870452a68f3faa0548a8eda14e4172a55deeacec
MD5 405ddb4dac1b779f0c27563955516800
SHA1 9e9fc76d8290b1d770e920b5abad5350383ba441
SHA512 ad11e9b7c704646de9cc5b5d8fedbb6269a5aa95e03a3f417b5a8fc5a8cdcc51d3018ad5bcf4aca6ccf48100ffc21a877a559e72ac121d1b79d811ea507e940f
TLSH
T1F841EC47E8C6D81E1614B8D3E311E61C99F480989BCE3B025B89C88C34CA52BF7CE767
MD5 SHA1 SHA512 TLSH

Submit Download

Log.txt

Path C:\Users\Admin\AppData\Local\Temp\Log.txt
Size 2KB
SHA256 4ed9ac2c620f4b6e72d38b4e75ce347bdfb4bb206dc16f2751297cea0d96b0af
MD5 bb15b3d89e554de6ca124882adafcfc1
SHA1 c2b495ee2990fb66444aa999c4da366881de38ed
SHA512 4942ca5b167a0fedf8fe5c9142e97bfc526427988617f1445598e7804412c660f7eee61f3a5a7cf1afbf05598049ba50b6d9ae47148a8cf18cb84409103cd281
TLSH
T12F51DC4BE8C6D81E1760A8D3E321E21CDAE484985FCE37115B88D88D34CA56BB6CA757
MD5 SHA1 SHA512 TLSH

Submit Download

wu_2004.exe

Path C:\Users\Admin\AppData\Local\Temp\wu_2004.exe
Size 4.4MB
SHA256 8443b816a7044cddfb02171659631586ce512b8af45df18a188dbd49fe98fa24
MD5 f6fdf939b2a9cae28ededec12d500eee
SHA1 6b7663d594277e4073bf936514d54771204ee1a4
SHA512 8f121994fe4c8876c69dd97865b3e907149e298b1e5ca4e7b4876948bf12ab7578ac4730ed29f9dd7bb9e078ac9e3bb671d11049f6c97225e8b6a8943af516fe
SSDEEP 49152:S2ZWOiJd/WaAeJ8TzXnrDfBuqWRCDLNaLKtnoQ+p7WSv6o08XZ+Hjjrs21T6Je7I:SPWaVJIfDfBz+H6D4Gs2cGiCFSL9yd
TLSH
T16E26B0E6BA5260ACC425C9F0535E935D66E07DB1C054FFAE26308333DA62B89F63B714
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wu.exe

Path C:\Users\Admin\AppData\Roaming\WindowsUpdate\wu.exe
Size 6.5MB
SHA256 8c0e799108d8f1686839102cc81ec4cc9008b810e722d2a8dd1401d20e956a08
MD5 c754cf71a51c8ac7e121e155ab310dc5
SHA1 a6006efcf466c07d65b1dddc3549fa387b8dd60f
SHA512 adbdf71cedba4742c84de8419178483bae3eb359bf02ac9cd08a93da130ae84e667265f6d39e80c77a7b9b10c96cd26f97f92a0a858ab78c2af12a86028fa0fc
SSDEEP 98304:ytaW5AskzTC6AEjsB/3DNTLQYLTrAS4rAStn3TfV:SchyPhFR4rASd9
TLSH
T17E663321F2CE1C56A75254F8B0FEF6BA917A6D78B4639008F1ED6BA0C01CB0D16F157A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2004-0-0x00007FF6823A0000-0x00007FF684BE8000-memory.dmp

Download

memory/2004-7-0x00007FF6823A0000-0x00007FF684BE8000-memory.dmp

Download

memory/4320-20-0x00007FF7494B0000-0x00007FF74BCF8000-memory.dmp

Download

memory/4320-99-0x00007FF7494B0000-0x00007FF74BCF8000-memory.dmp

Download

memory/5100-109-0x00007FF694F30000-0x00007FF696D36000-memory.dmp

Download

memory/5604-129-0x00007FF612BF0000-0x00007FF6149F6000-memory.dmp

Download

memory/5604-178-0x00007FF612BF0000-0x00007FF6149F6000-memory.dmp

Download