Analysis
- max time kernel
148s - max time network
143s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260629-en - resource tags
- submitted
01/07/2026, 04:26
General
- Target boykisser.exe
- Size 3.0MB
- Sample260701-e2mf5sgs7x
- SHA256 b4f66394b20e42b4dcf255aa8c820a9aa0b932cb923caf9346b971f340f9df63
Malware Config
Signatures
- Disables Task Manager via registry modification
- Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Obfuscated Files or Information: Command Obfuscation 1 TTPs
Adversaries may obfuscate content during command execution to impede detection.
- Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
- Modifies registry key 1 TTPs 3 IoCs
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 6 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\boykisser.exe"C:\Users\Admin\AppData\Local\Temp\boykisser.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -EncodedCommand UwB0AGEAcgB0AC0AUAByAG8AYwBlAHMAcwAgAC0AVgBlAHIAYgAgAFIAdQBuAEEAcwAgAC0ARgBpAGwAZQBQAGEAdABoACAAJwBDADoAXABVAHMAZQByAHMAXABBAGQAbQBpAG4AXABBAHAAcABEAGEAdABhAFwATABvAGMAYQBsAFwAVABlAG0AcABcAGIAbwB5AGsAaQBzAHMAZQByAC4AZQB4AGUAJwAgAC0AQQByAGcAdQBtAGUAbgB0AEwAaQBzAHQAIAAnAC0ALQBlAGwAZQB2AGEAdABlAGQAJwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4A2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\boykisser.exe"C:\Users\Admin\AppData\Local\Temp\boykisser.exe" --elevated3⤵
- Writes to the Master Boot Record (MBR)
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\reg.exe"reg" add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f4⤵
- Modifies registry key
-
-
C:\Windows\system32\reg.exe"reg" add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f4⤵
- Modifies registry key
-
-
C:\Windows\system32\cmd.exe"cmd" /c reg delete HKLM\BCD00000000 /f4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\reg.exereg delete HKLM\BCD00000000 /f5⤵
- Modifies registry key
-
-
-
-
Network
MITRE ATT&CK Enterprise v16
Defense Evasion
Modify Registry
1Obfuscated Files or Information
1Command Obfuscation
1Pre-OS Boot
1Bootkit
1Replay Monitor
Loading Replay Monitor...
Downloads
memory/3088-20-0x00007FF6D8C80000-0x00007FF6D91EF000-memory.dmp
memory/3088-19-0x00007FF6D8C80000-0x00007FF6D91EF000-memory.dmp
memory/3088-18-0x00007FF6D8C80000-0x00007FF6D91EF000-memory.dmp
memory/3088-17-0x00007FF6D8C80000-0x00007FF6D91EF000-memory.dmp
memory/5160-0-0x00007FF6D8C80000-0x00007FF6D91EF000-memory.dmp
memory/5160-1-0x00007FF6D8C80000-0x00007FF6D91EF000-memory.dmp
memory/5160-2-0x00007FF6D8C80000-0x00007FF6D91EF000-memory.dmp
memory/6072-10-0x000001F1AB000000-0x000001F1AB022000-memory.dmp
memory/6072-7-0x00007FF9F8750000-0x00007FF9F90F4000-memory.dmp
memory/6072-11-0x00007FF9F8750000-0x00007FF9F90F4000-memory.dmp
memory/6072-12-0x00007FF9F8750000-0x00007FF9F90F4000-memory.dmp
memory/6072-13-0x00007FF9F8750000-0x00007FF9F90F4000-memory.dmp
memory/6072-15-0x00007FF9F8750000-0x00007FF9F90F4000-memory.dmp
memory/6072-16-0x00007FF9F8750000-0x00007FF9F90F4000-memory.dmp
memory/6072-6-0x00007FF9F8750000-0x00007FF9F90F4000-memory.dmp
memory/6072-5-0x00007FF9F8750000-0x00007FF9F90F4000-memory.dmp
memory/6072-4-0x00007FF9F8750000-0x00007FF9F90F4000-memory.dmp
memory/6072-3-0x00007FF9F88DF000-0x00007FF9F88E0000-memory.dmp