Analysis
- max time kernel
136s - max time network
126s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260710-en - resource tags
- submitted
20/07/2026, 14:28
General
- Target 8a017676b8d47aae27ca8f336dcd46915d6d7401681773969bf4bf1b8809c9a0.exe
- Size 8.1MB
- Sample260720-rs7ryac14n
- SHA256 8a017676b8d47aae27ca8f336dcd46915d6d7401681773969bf4bf1b8809c9a0
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
- Loads dropped DLL 18 IoCs
- Adds Run key to start application 2 TTPs 3 IoCs
- Deobfuscate/Decode Files or Information 1 TTPs 2 IoCs
Payload decoded via CertUtil.
- Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 4 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of SetWindowsHookEx 1 IoCs
- Suspicious use of WriteProcessMemory 8 IoCs
- System policy modification 1 TTPs 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\8a017676b8d47aae27ca8f336dcd46915d6d7401681773969bf4bf1b8809c9a0.exe"C:\Users\Admin\AppData\Local\Temp\8a017676b8d47aae27ca8f336dcd46915d6d7401681773969bf4bf1b8809c9a0.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\8a017676b8d47aae27ca8f336dcd46915d6d7401681773969bf4bf1b8809c9a0.exe"C:\Users\Admin\AppData\Local\Temp\8a017676b8d47aae27ca8f336dcd46915d6d7401681773969bf4bf1b8809c9a0.exe"2⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Windows\SYSTEM32\cmd.execmd.exe /c C:\Users\Admin\AppData\Local\Temp\bgm_mp3_deploy.bat3⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\certutil.execertutil -decode "C:\Users\Admin\AppData\Local\Temp\bgm_mp3_deploy.bat" "bgm.mp3"4⤵
- Deobfuscate/Decode Files or Information
-
-
-
C:\Windows\SYSTEM32\cmd.execmd.exe /c C:\Users\Admin\AppData\Local\Temp\bgm_deploy.bat3⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\certutil.execertutil -decode "C:\Users\Admin\AppData\Local\Temp\bgm_deploy.bat" "bgm123.exe"4⤵
- Deobfuscate/Decode Files or Information
-
-
C:\Users\Admin\AppData\Local\Temp\bgm123.exe"bgm123.exe"4⤵
- Executes dropped EXE
- Enumerates connected drives
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- System policy modification
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\8a017676b8d47aae27ca8f336dcd46915d6d7401681773969bf4bf1b8809c9a0.exe"C:\Users\Admin\AppData\Local\Temp\8a017676b8d47aae27ca8f336dcd46915d6d7401681773969bf4bf1b8809c9a0.exe" --phase21⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\8a017676b8d47aae27ca8f336dcd46915d6d7401681773969bf4bf1b8809c9a0.exe"C:\Users\Admin\AppData\Local\Temp\8a017676b8d47aae27ca8f336dcd46915d6d7401681773969bf4bf1b8809c9a0.exe" --phase22⤵
- Loads dropped DLL
- Adds Run key to start application
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\lp.bat"3⤵
- Executes a command shell one-liner
-
C:\Windows\system32\mshta.exemshta vbscript:CreateObject("Shell.Application").ShellExecute("cmd.exe","/c C:\Users\Admin\AppData\Local\Temp\lp.bat ::","","runas",1)(window.close)4⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c C:\Users\Admin\AppData\Local\Temp\lp.bat ::5⤵
- Executes a command shell one-liner
-
C:\Windows\System32\Wbem\WMIC.exewmic process where name="svchost.exe" delete6⤵
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\8a017676b8d47aae27ca8f336dcd46915d6d7401681773969bf4bf1b8809c9a0.exe"C:\Users\Admin\AppData\Local\Temp\8a017676b8d47aae27ca8f336dcd46915d6d7401681773969bf4bf1b8809c9a0.exe" --cleanup1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\8a017676b8d47aae27ca8f336dcd46915d6d7401681773969bf4bf1b8809c9a0.exe"C:\Users\Admin\AppData\Local\Temp\8a017676b8d47aae27ca8f336dcd46915d6d7401681773969bf4bf1b8809c9a0.exe" --cleanup2⤵
- Loads dropped DLL
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
CurrentDatabase_400.wmdb
VCRUNTIME140.dll
_bz2.pyd
_ctypes.pyd
_lzma.pyd
base_library.zip
libffi-8.dll
python313.dll
bgm.mp3
bgm123.exe
bgm_deploy.bat
bgm_mp3_deploy.bat
lp.bat
memory/5392-67-0x0000000008BC0000-0x0000000008BD0000-memory.dmp
memory/5392-64-0x0000000008BC0000-0x0000000008BD0000-memory.dmp
memory/5392-101-0x0000000008BC0000-0x0000000008BD0000-memory.dmp
memory/5392-102-0x0000000008BC0000-0x0000000008BD0000-memory.dmp
memory/5392-66-0x0000000008BC0000-0x0000000008BD0000-memory.dmp
memory/5392-117-0x0000000008BC0000-0x0000000008BD0000-memory.dmp
memory/5392-119-0x0000000008BC0000-0x0000000008BD0000-memory.dmp
memory/5392-118-0x0000000008BC0000-0x0000000008BD0000-memory.dmp
memory/5392-116-0x0000000008BC0000-0x0000000008BD0000-memory.dmp
memory/5392-120-0x0000000008BC0000-0x0000000008BD0000-memory.dmp
memory/5392-121-0x0000000008BC0000-0x0000000008BD0000-memory.dmp
memory/5392-65-0x0000000008BC0000-0x0000000008BD0000-memory.dmp