Analysis
- max time kernel
148s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
03/08/2026, 18:14
General
- Target $R0/Uninstall BloxBot.exe
- Size 141KB
- Sample260803-wvs4savepb
- SHA256 ee38d7e2e5ad2cb34e4d96bbc938f57b16364c63d21d41bc74cee50b46af9647
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
- Loads dropped DLL 8 IoCs
- Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs
Using powershell.exe command.
- Hide Artifacts: Ignore Process Interrupts 1 TTPs 1 IoCs
Command interpreters often include specific commands/flags that ignore errors and other hangups.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 5 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: EnumeratesProcesses 8 IoCs
- Suspicious use of AdjustPrivilegeToken 24 IoCs
- Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\$R0\Uninstall BloxBot.exe"C:\Users\Admin\AppData\Local\Temp\$R0\Uninstall BloxBot.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\~nsuA.tmp\Un_A.exe"C:\Users\Admin\AppData\Local\Temp\~nsuA.tmp\Un_A.exe" _?=C:\Users\Admin\AppData\Local\Temp\$R0\2⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe" -C "if (Get-Command Get-CimInstance -ErrorAction SilentlyContinue) { exit 0 } else { exit 1 }"3⤵
- Hide Artifacts: Ignore Process Interrupts
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe" -C "if ((Get-ExecutionPolicy -Scope Process) -eq 'Restricted') { exit 1 } else { exit 0 }"3⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe" -C "if ((Get-CimInstance -ClassName Win32_Process | ? {$_.Path -and $_.Path.StartsWith('C:\Users\Admin\AppData\Local\Temp\$R0', 'CurrentCultureIgnoreCase')}).Count -gt 0) { exit 0 } else { exit 1 }"3⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
StartupProfileData-NonInteractive
StartupProfileData-NonInteractive
__PSScriptPolicyTest_zwckmmco.445.ps1
StdUtils.dll
System.dll
WinShell.dll
nsExec.dll
Un_A.exe
memory/2160-30-0x00000000077A0000-0x0000000007E1C000-memory.dmp
memory/2160-35-0x000000006FBD0000-0x000000006FF2B000-memory.dmp
memory/2160-18-0x00000000059E0000-0x0000000005D3B000-memory.dmp
memory/2160-19-0x0000000005DB0000-0x0000000005DCE000-memory.dmp
memory/2160-20-0x0000000005E00000-0x0000000005E4C000-memory.dmp
memory/2160-21-0x0000000006DB0000-0x0000000006DE6000-memory.dmp
memory/2160-22-0x000000006FA50000-0x000000006FA9C000-memory.dmp
memory/2160-25-0x0000000006D70000-0x0000000006D90000-memory.dmp
memory/2160-26-0x00000000730B0000-0x000000007386C000-memory.dmp
memory/2160-27-0x0000000007070000-0x0000000007113000-memory.dmp
memory/2160-28-0x00000000730B0000-0x000000007386C000-memory.dmp
memory/2160-29-0x00000000730B0000-0x000000007386C000-memory.dmp
memory/2160-14-0x00000000057E0000-0x0000000005846000-memory.dmp
memory/2160-31-0x0000000007120000-0x000000000713A000-memory.dmp
memory/2160-32-0x00000000071B0000-0x00000000071BA000-memory.dmp
memory/2160-33-0x0000000007360000-0x000000000738A000-memory.dmp
memory/2160-34-0x0000000007390000-0x00000000073B4000-memory.dmp
memory/2160-15-0x0000000005850000-0x00000000058B6000-memory.dmp
memory/2160-37-0x00000000730B0000-0x000000007386C000-memory.dmp
memory/2160-13-0x0000000004FF0000-0x0000000005012000-memory.dmp
memory/2160-9-0x00000000730C2000-0x00000000730C3000-memory.dmp
memory/2160-12-0x0000000005190000-0x00000000057DA000-memory.dmp
memory/2160-10-0x0000000002550000-0x0000000002586000-memory.dmp
memory/2160-11-0x00000000730B0000-0x000000007386C000-memory.dmp
memory/2828-49-0x0000000007F60000-0x0000000007F71000-memory.dmp
memory/2828-48-0x0000000007FF0000-0x0000000008086000-memory.dmp
memory/2828-45-0x000000006FA50000-0x000000006FA9C000-memory.dmp
memory/2828-41-0x00000000066A0000-0x00000000069FB000-memory.dmp
memory/6060-59-0x0000000005680000-0x00000000059DB000-memory.dmp
memory/6060-63-0x0000000005E50000-0x0000000005E9C000-memory.dmp
memory/6060-64-0x000000006FA30000-0x000000006FA7C000-memory.dmp
memory/6060-67-0x0000000006EA0000-0x0000000006F43000-memory.dmp
memory/6060-68-0x000000006FC60000-0x000000006FFBB000-memory.dmp