Analysis
- user interaction
yes - max time kernel
9s - max time network
13s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
- submitted
09/08/2026, 09:22
General
- Target Boost Bot [ v1.9.6.7.1 ].exe
- Size 41.0MB
- Sample260809-lb9x3sysbw
- SHA256 cc5094c990783a0621140c73b503a52adf7dc5baebb55737082380f2b7d1bdb1
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
- Loads dropped DLL 10 IoCs
- Suspicious use of NtSetInformationThreadHideFromDebugger 15 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious use of WriteProcessMemory 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Boost Bot [ v1.9.6.7.1 ].exe"C:\Users\Admin\AppData\Local\Temp\Boost Bot [ v1.9.6.7.1 ].exe"1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\onefile_1660_134307409832356180\main.exe"C:\Users\Admin\AppData\Local\Temp\Boost Bot [ v1.9.6.7.1 ].exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
VCRUNTIME140_1.dll
_bz2.pyd
_cffi_backend.pyd
_ctypes.pyd
_decimal.pyd
_tkinter.pyd
cacert.pem
_rust.pyd
VCRUNTIME140.dll
_asyncio.pyd
_hashlib.pyd
_lzma.pyd
_overlapped.pyd
_queue.pyd
_socket.pyd
_ssl.pyd
_uuid.pyd
_zoneinfo.pyd
md.pyd
md__mypyc.pyd
_rust.pyd
libcrypto-1_1.dll
libffi-7.dll
libssl-1_1.dll
main.exe
main.exe
_pydantic_core.pyd
python3.dll
python310.dll
pywintypes310.dll
select.pyd
unicodedata.pyd
win32api.pyd
win32event.pyd
win32security.pyd
memory/448-88-0x0000000006440000-0x000000000A6A4000-memory.dmp
memory/448-148-0x0000000140000000-0x0000000141CA0000-memory.dmp
memory/1660-0-0x00007FFACE8A0000-0x00007FFACE8A1000-memory.dmp
memory/1660-13-0x00000000021D0000-0x00000000021D1000-memory.dmp
memory/1660-3-0x0000000002270000-0x0000000002271000-memory.dmp
memory/1660-5-0x0000000002220000-0x0000000002221000-memory.dmp
memory/1660-2-0x00000000022A0000-0x00000000022A1000-memory.dmp
memory/1660-6-0x00000000005B0000-0x00000000005B1000-memory.dmp
memory/1660-80-0x00000000021E0000-0x00000000021E1000-memory.dmp
memory/1660-7-0x00000000005A0000-0x00000000005A1000-memory.dmp
memory/1660-8-0x0000000002290000-0x0000000002291000-memory.dmp
memory/1660-9-0x0000000002190000-0x0000000002191000-memory.dmp
memory/1660-10-0x00000000021A0000-0x00000000021A1000-memory.dmp
memory/1660-82-0x0000000004570000-0x000000000698D000-memory.dmp
memory/1660-79-0x0000000002280000-0x0000000002281000-memory.dmp
memory/1660-11-0x00000000021C0000-0x00000000021C1000-memory.dmp
memory/1660-12-0x00000000021B0000-0x00000000021B1000-memory.dmp
memory/1660-4-0x0000000002260000-0x0000000002261000-memory.dmp
memory/1660-14-0x0000000002250000-0x0000000002251000-memory.dmp
memory/1660-15-0x0000000000580000-0x0000000000581000-memory.dmp
memory/1660-16-0x0000000000590000-0x0000000000591000-memory.dmp
memory/1660-17-0x0000000000500000-0x0000000000501000-memory.dmp
memory/1660-18-0x0000000000560000-0x0000000000561000-memory.dmp
memory/1660-30-0x0000000002240000-0x0000000002241000-memory.dmp
memory/1660-19-0x00000000021F0000-0x00000000021F1000-memory.dmp
memory/1660-20-0x00000000005C0000-0x00000000005C1000-memory.dmp
memory/1660-78-0x0000000000510000-0x0000000000511000-memory.dmp
memory/1660-21-0x0000000002230000-0x0000000002231000-memory.dmp
memory/1660-1-0x0000000004570000-0x000000000698D000-memory.dmp
memory/1660-77-0x0000000002170000-0x0000000002171000-memory.dmp
memory/1660-147-0x0000000140000000-0x000000014290A000-memory.dmp