Overview

overview

8

Static

static

1

bitdefende...ee.exe

windows10-2004-x64

8

bitdefende...ee.exe

windows11-ltsc_2024-x64

4

Analysis

  • geolocation tags

    eueuropelondonukunited-kingdom
  • max time kernel
    900s
  • max time network
    876s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    28/08/2026, 23:53

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    bitdefender_avfree.exe
  • Size 21.5MB
  • Sample260828-3xccdatzav
  • SHA256 0e63740f65b1252e6d78be553b51b2f245b8cf6dfa1e6eece70773806554ace8
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
4/10
discovery

Malware Config

Signatures

  • Executes dropped EXE 4 IoCs
  • Loads dropped DLL 6 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\bitdefender_avfree.exe
    "C:\Users\Admin\AppData\Local\Temp\bitdefender_avfree.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:4324
    • C:\Users\Admin\AppData\Local\Temp\RarSFX0\agent_launcher.exe
      "C:\Users\Admin\AppData\Local\Temp\RarSFX0\agent_launcher.exe"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:5268
      • C:\Users\Admin\AppData\Local\Temp\RarSFX0\bddeploy.exe
        "C:\Users\Admin\AppData\Local\Temp\RarSFX0\bddeploy.exe"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:5852
        • C:\Users\Admin\AppData\Local\Temp\RarSFX0\packages\setuppackage.exe
          "C:\Users\Admin\AppData\Local\Temp\RarSFX0\packages\setuppackage.exe"
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:5404
        • C:\Users\Admin\AppData\Local\Temp\RarSFX0\packages\installer.exe
          "C:\Users\Admin\AppData\Local\Temp\RarSFX0\packages\installer.exe"
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • System Location Discovery: System Language Discovery
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of SetWindowsHookEx
          PID:2320
  • C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k GPSvcGroup
    1⤵
      PID:4520
    • C:\Windows\System32\SecurityHealthHost.exe
      \\?\C:\Windows\System32\SecurityHealthHost.exe {08728914-3F57-4D52-9E31-49DAECA5A80A} -Embedding
      1⤵
        PID:3516

      Network

            MITRE ATT&CK Enterprise v16

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            agent_launcher.exe
            • Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\agent_launcher.exe
            • Size 249KB
            • SHA256 3a4a6a025d62786a34e2447f945f6951aa094d669f2f17361bde1e2867716dab
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            bddeploy.exe
            • Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\bddeploy.exe
            • Size 406KB
            • SHA256 19c917d00bbcbf50b83711b4ed568c9ed7c63d8bca92dc0c1e4c358707e4c531
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            deploy.dll
            • Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\deploy.dll
            • Size 20KB
            • SHA256 c3f8ce31731a9b71f5fb715e02b02fc0868d43a94ea0019962e4d110c21615f9
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            additional.dll
            • Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\packages\additional.dll
            • Size 1.6MB
            • SHA256 50a1b9e21981da1d18197e58c6a67539b713d77d5cad9e12b8fff6e469394b7b
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            agentpackage.exe
            • Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\packages\agentpackage.exe
            • Size 15.5MB
            • SHA256 9a6a2a4a4ce02e48c1e3132b7401dc476988afe9b3fea61ede287d29f9af8d9a
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            agentpackage.exe.md5
            • Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\packages\agentpackage.exe.md5
            • Size 32B
            • SHA256 13985e63efb067f57e48281554456e7f70e0d6680860fd0aaf0eca45c61f9f25
            • MD5 SHA1 SHA512
            Submit Download

            bdnc.json
            • Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\packages\bdnc.json
            • Size 154B
            • SHA256 fbd4d9075feb0e2678a9c9df0dc2860c4468968c176876cb0271ca8676347aa6
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            params.json
            • Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\packages\data\params.json
            • Size 86B
            • SHA256 c9128459dbcebc819dde6ea43d243420497fcf5a10b403cf708299a50e5d35f1
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            installer.exe
            • Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\packages\installer.exe
            • Size 823KB
            • SHA256 22df283ebc5f0bb42a3916c9deeecd31ec05a46a66a1fe29fac4408c963b86f3
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            en-US.txtui
            • Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\packages\lang\en-US.txtui
            • Size 10KB
            • SHA256 1868b43eab031374a3a65d6b82d853cd2371ed9ad6e043cdb53780baf3cc80b3
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            resources.dll
            • Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\packages\lang\ltr\resources.dll
            • Size 113KB
            • SHA256 cd58eb2fcff1205d76eb92ec0239c2895646e5c65af273c2b1de88fffd9aa7f9
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            productagentdp.dll
            • Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\packages\productagentdp.dll
            • Size 600KB
            • SHA256 bfc2a1d592b227edae25d98f26c6e2396841b57a62536a0ae38f4a395c0d5fb2
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            sciter.dll
            • Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\packages\sciter.dll
            • Size 4.6MB
            • SHA256 feea7b949c8cd085099642b920718e9c6a9074c6a75885f8e85b87206a42985c
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            setuppackage.exe
            • Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\packages\setuppackage.exe
            • Size 6.2MB
            • SHA256 eeece4bd5dfa9ce29e12790c4cbbf6860d936cb558b0f31f7496833ead7fd723
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            setuppackage.exe.md5
            • Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\packages\setuppackage.exe.md5
            • Size 32B
            • SHA256 98de8cef1876effbf6eb2190c87dce4bad932435cc40341f02b945a759c6f799
            • MD5 SHA1 SHA512
            Submit Download

            unrar.dll
            • Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\packages\unrar.dll
            • Size 278KB
            • SHA256 f5f8fa128893c3b7b641045fe097b9015c54c301657b7ea69130dc27baee96a5
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download