Analysis
- max time kernel
148s - max time network
112s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
13/07/2026, 03:58
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
BGI.exe
Resource
win10v2004-20260513-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
BGI.exe
Resource
win11ltsc2024-20260709-en
3 signatures
150 seconds
General
- Target BGI.exe
- Size 1.3MB
- Sample260713-ej1aaadx2t
- SHA256 7c9483ece6db674fa8519b306b46966c5c5300662b8838b00f045627184f63ec
- MD5 2390db2e0db80784ef2b925ed1558892
- SHA1 75d5e6d2ca591da47dac07ee578d801c4e62c9c5
- SHA512 ef5797aa2fbede90468476a6539830fbdba902682685d56caf69e45989639672739fe397c94e21dac683d4466188c3c1ab9b31f66bea3dbdab3be0e66efe16f9
- SSDEEP 24576:AVbhNObP5qQooy6OWk8F1RcRDfKhw9D2fdaxGjbC71blSHZL:guqQov8ZaKhCYasjbC7vSHt
- TLSH T18D556D21B582D13AE8D100B18AFD7A6BE57D9E38077868E363D43DBE5870DC22E36157
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
6/10
Malware Config
Signatures
- Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\N: BGI.exe File opened (read-only) \??\O: BGI.exe File opened (read-only) \??\Q: BGI.exe File opened (read-only) \??\T: BGI.exe File opened (read-only) \??\U: BGI.exe File opened (read-only) \??\P: BGI.exe File opened (read-only) \??\V: BGI.exe File opened (read-only) \??\D: BGI.exe File opened (read-only) \??\G: BGI.exe File opened (read-only) \??\I: BGI.exe File opened (read-only) \??\K: BGI.exe File opened (read-only) \??\X: BGI.exe File opened (read-only) \??\Y: BGI.exe File opened (read-only) \??\B: BGI.exe File opened (read-only) \??\H: BGI.exe File opened (read-only) \??\M: BGI.exe File opened (read-only) \??\R: BGI.exe File opened (read-only) \??\S: BGI.exe File opened (read-only) \??\W: BGI.exe File opened (read-only) \??\Z: BGI.exe File opened (read-only) \??\A: BGI.exe File opened (read-only) \??\J: BGI.exe File opened (read-only) \??\L: BGI.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BGI.exe - Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 4844 BGI.exe