Analysis
- max time kernel
30s - max time network
34s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
06/08/2026, 21:37
General
- Target BD2.Net Injector.exe
- Size 7.5MB
- Sample260806-1gpawsar6v
- SHA256 21ea64da3022d6b44c8f101d271250227f35fda6dd2ac6335e760c748e81d77c
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
- Checks for VirtualBox DLLs, possible anti-VM trick 1 TTPs 1 IoCs
Certain files are specific to VirtualBox VMs and can be used to detect execution in a VM.
- System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Enumerates system info in registry 2 TTPs 3 IoCs
- Suspicious use of AdjustPrivilegeToken 3 IoCs
- Suspicious use of WriteProcessMemory 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\BD2.Net Injector.exe"C:\Users\Admin\AppData\Local\Temp\BD2.Net Injector.exe"1⤵
- Checks for VirtualBox DLLs, possible anti-VM trick
- Enumerates system info in registry
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\0066140113526633.exe"C:\Users\Admin\AppData\Local\Temp\0066140113526633.exe" --binder-child2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exedw20.exe -x -s 8283⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
0066140113526633.exe
memory/3448-5-0x0000000074732000-0x0000000074734000-memory.dmp
memory/3448-4-0x00000000008D0000-0x00000000008E0000-memory.dmp
memory/4536-7-0x00000107BFFF0000-0x00000107BFFF1000-memory.dmp
memory/4536-8-0x00000107BFFF0000-0x00000107BFFF1000-memory.dmp