Analysis
- user interaction
yes - max time kernel
24s - max time network
44s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
- submitted
08/09/2026, 19:28
General
- Target BleachBit-6.0.4-setup.exe
- Size 16.4MB
- Sample260908-x6t1wsgn21
- SHA256 c4cd6bb1f4b163dc28b13cef2995423de69e6776f16387f54943dcc6e7267a6d
Malware Config
Signatures
- ACProtect 1.3x - 1.4x DLL software 25 IoCs
Detects file using ACProtect software.
- UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Drops file in Program Files directory 64 IoCs
- Executes dropped EXE 2 IoCs
- Loads dropped DLL 64 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 1 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
- System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Modifies registry class 5 IoCs
- Suspicious use of AdjustPrivilegeToken 3 IoCs
- Suspicious use of SetWindowsHookEx 1 IoCs
- Suspicious use of WriteProcessMemory 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\BleachBit-6.0.4-setup.exe"C:\Users\Admin\AppData\Local\Temp\BleachBit-6.0.4-setup.exe"1⤵
- Drops file in Program Files directory
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\BleachBit\BleachBit.exe"C:\Program Files (x86)\BleachBit\BleachBit.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\BleachBit\gdbus.exe"C:\Program Files (x86)\BleachBit\gdbus.exe" _win32_run_session_bus3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "ver"3⤵
- Executes a command shell one-liner
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
COPYING
VCRUNTIME140.dll
_bz2.pyd
_ctypes.pyd
_decimal.pyd
_hashlib.pyd
_lzma.pyd
_socket.pyd
_ssl.pyd
_uuid.pyd
bleachbit.exe
bz2.dll
ffi-8.dll
libcrypto-3.dll
libexpat.dll
liblzma.dll
library.zip
libssl-3.dll
pyexpat.pyd
python3.DLL
python312.dll
pythoncom312.dll
pywintypes312.dll
select.pyd
bleachbit.png
bleachbit.mo
win32api.pyd
win32clipboard.pyd
win32com.shell.shell.pyd
win32file.pyd
win32gui.pyd
z.dll
LangDLL.dll
System.dll
UAC.dll
UserInfo.dll
modern-wizard.bmp
nsDialogs.dll
memory/368-952-0x0000000074320000-0x000000007432B000-memory.dmp
memory/368-951-0x0000000074300000-0x000000007431E000-memory.dmp
memory/368-950-0x0000000073680000-0x00000000736D1000-memory.dmp
memory/368-963-0x0000000072F20000-0x00000000730A5000-memory.dmp
memory/368-949-0x0000000074330000-0x0000000074465000-memory.dmp
memory/368-1132-0x0000000072F20000-0x00000000730A5000-memory.dmp
memory/368-953-0x0000000073CF0000-0x0000000073D0A000-memory.dmp
memory/368-954-0x0000000073570000-0x000000007367B000-memory.dmp
memory/368-955-0x00000000734E0000-0x000000007356D000-memory.dmp
memory/368-956-0x00000000755A0000-0x00000000755AD000-memory.dmp
memory/2744-907-0x0000000074610000-0x0000000074624000-memory.dmp
memory/2744-938-0x0000000072870000-0x0000000072885000-memory.dmp
memory/2744-872-0x0000000075610000-0x0000000075624000-memory.dmp
memory/2744-871-0x00000000753E0000-0x00000000754A0000-memory.dmp
memory/2744-870-0x00000000754A0000-0x00000000754CC000-memory.dmp
memory/2744-864-0x0000000075630000-0x000000007563D000-memory.dmp
memory/2744-865-0x00000000754D0000-0x00000000754DB000-memory.dmp
memory/2744-878-0x0000000075230000-0x00000000752D3000-memory.dmp
memory/2744-877-0x00000000753B0000-0x00000000753D7000-memory.dmp
memory/2744-854-0x0000000073D10000-0x00000000742BD000-memory.dmp
memory/2744-882-0x00000000755B0000-0x00000000755D0000-memory.dmp
memory/2744-855-0x0000000075580000-0x0000000075592000-memory.dmp
memory/2744-884-0x00000000749A0000-0x00000000749C4000-memory.dmp
memory/2744-856-0x0000000075540000-0x0000000075550000-memory.dmp
memory/2744-893-0x0000000074800000-0x0000000074835000-memory.dmp
memory/2744-892-0x00000000748B0000-0x00000000748D5000-memory.dmp
memory/2744-891-0x0000000075540000-0x0000000075550000-memory.dmp
memory/2744-890-0x00000000748E0000-0x0000000074958000-memory.dmp
memory/2744-857-0x0000000074DB0000-0x0000000075130000-memory.dmp
memory/2744-888-0x0000000074DB0000-0x0000000075130000-memory.dmp
memory/2744-858-0x0000000075550000-0x000000007557A000-memory.dmp
memory/2744-897-0x00000000747F0000-0x00000000747FA000-memory.dmp
memory/2744-842-0x00000000755B0000-0x00000000755D0000-memory.dmp
memory/2744-843-0x00000000755A0000-0x00000000755AD000-memory.dmp
memory/2744-900-0x00000000747E0000-0x00000000747EC000-memory.dmp
memory/2744-905-0x00000000746E0000-0x00000000746F2000-memory.dmp
memory/2744-904-0x00000000747D2000-0x00000000747D3000-memory.dmp
memory/2744-903-0x00000000754A0000-0x00000000754CC000-memory.dmp
memory/2744-902-0x00000000746B0000-0x00000000746D3000-memory.dmp
memory/2744-901-0x00000000747A0000-0x00000000747D3000-memory.dmp
memory/2744-1069-0x0000000070E20000-0x0000000070F03000-memory.dmp
memory/2744-906-0x0000000075230000-0x00000000752D3000-memory.dmp
memory/2744-908-0x00000000745F0000-0x0000000074608000-memory.dmp
memory/2744-916-0x0000000074330000-0x0000000074465000-memory.dmp
memory/2744-915-0x0000000074470000-0x0000000074494000-memory.dmp
memory/2744-914-0x00000000734E0000-0x000000007356D000-memory.dmp
memory/2744-913-0x0000000074300000-0x000000007431E000-memory.dmp
memory/2744-912-0x0000000073570000-0x000000007367B000-memory.dmp
memory/2744-911-0x0000000074320000-0x000000007432B000-memory.dmp
memory/2744-910-0x0000000073680000-0x00000000736D1000-memory.dmp
memory/2744-909-0x00000000744A0000-0x00000000744E1000-memory.dmp
memory/2744-917-0x00000000742E0000-0x00000000742F3000-memory.dmp
memory/2744-918-0x0000000074800000-0x0000000074835000-memory.dmp
memory/2744-919-0x00000000734D0000-0x00000000734DF000-memory.dmp
memory/2744-921-0x00000000733E0000-0x00000000734B7000-memory.dmp
memory/2744-922-0x00000000733D0000-0x00000000733DC000-memory.dmp
memory/2744-929-0x00000000746B0000-0x00000000746D3000-memory.dmp
memory/2744-930-0x0000000072F20000-0x00000000730A5000-memory.dmp
memory/2744-928-0x00000000730B0000-0x00000000730D9000-memory.dmp
memory/2744-932-0x0000000072DF0000-0x0000000072E12000-memory.dmp
memory/2744-941-0x0000000071ED0000-0x0000000071EF7000-memory.dmp
memory/2744-943-0x00000000727C0000-0x00000000727DB000-memory.dmp
memory/2744-942-0x0000000072AF0000-0x0000000072C5E000-memory.dmp
memory/2744-940-0x0000000071F00000-0x000000007255E000-memory.dmp
memory/2744-939-0x0000000072850000-0x0000000072865000-memory.dmp
memory/2744-863-0x0000000075520000-0x0000000075536000-memory.dmp
memory/2744-937-0x00000000729B0000-0x0000000072ABE000-memory.dmp
memory/2744-936-0x0000000072C60000-0x0000000072C89000-memory.dmp
memory/2744-935-0x0000000072C90000-0x0000000072CB2000-memory.dmp
memory/2744-934-0x0000000072CC0000-0x0000000072CD8000-memory.dmp
memory/2744-933-0x0000000072CE0000-0x0000000072DEA000-memory.dmp
memory/2744-931-0x0000000072E20000-0x0000000072E7F000-memory.dmp
memory/2744-944-0x00000000745F0000-0x0000000074608000-memory.dmp
memory/2744-945-0x00000000744A0000-0x00000000744E1000-memory.dmp
memory/2744-830-0x0000000075630000-0x000000007563D000-memory.dmp
memory/2744-962-0x0000000071AF0000-0x0000000071B12000-memory.dmp
memory/2744-967-0x0000000074330000-0x0000000074465000-memory.dmp
memory/2744-966-0x0000000074470000-0x0000000074494000-memory.dmp
memory/2744-961-0x00000000734E0000-0x000000007356D000-memory.dmp
memory/2744-960-0x0000000074300000-0x000000007431E000-memory.dmp
memory/2744-959-0x0000000073570000-0x000000007367B000-memory.dmp
memory/2744-958-0x0000000074320000-0x000000007432B000-memory.dmp
memory/2744-957-0x0000000073680000-0x00000000736D1000-memory.dmp
memory/2744-836-0x0000000075600000-0x000000007560F000-memory.dmp
memory/2744-837-0x00000000755D0000-0x00000000755FF000-memory.dmp
memory/2744-831-0x0000000075610000-0x0000000075624000-memory.dmp
memory/2744-1038-0x0000000073D10000-0x00000000742BD000-memory.dmp
memory/2744-821-0x0000000073D10000-0x00000000742BD000-memory.dmp
memory/2744-822-0x0000000073CF0000-0x0000000073D0A000-memory.dmp
memory/2744-1063-0x0000000072870000-0x0000000072885000-memory.dmp
memory/2744-1064-0x0000000072850000-0x0000000072865000-memory.dmp
memory/2744-948-0x0000000071B20000-0x0000000071C37000-memory.dmp
memory/2744-927-0x00000000730E0000-0x00000000730F2000-memory.dmp
memory/2744-926-0x0000000073100000-0x000000007319C000-memory.dmp
memory/2744-925-0x00000000731A0000-0x00000000731D2000-memory.dmp
memory/2744-924-0x00000000731E0000-0x0000000073276000-memory.dmp
memory/2744-923-0x0000000073280000-0x00000000733C7000-memory.dmp
memory/2744-920-0x00000000734C0000-0x00000000734CA000-memory.dmp
memory/2744-1003-0x00000000754A0000-0x00000000754CC000-memory.dmp
memory/2744-1005-0x00000000753B0000-0x00000000753D7000-memory.dmp
memory/2744-1004-0x00000000753E0000-0x00000000754A0000-memory.dmp
memory/2744-1000-0x0000000074DB0000-0x0000000075130000-memory.dmp
memory/2744-997-0x0000000075580000-0x0000000075592000-memory.dmp
memory/2744-996-0x00000000755A0000-0x00000000755AD000-memory.dmp
memory/2744-989-0x0000000073D10000-0x00000000742BD000-memory.dmp
memory/2744-1021-0x0000000070E10000-0x0000000070E1D000-memory.dmp
memory/2744-995-0x00000000755B0000-0x00000000755D0000-memory.dmp
memory/2744-1049-0x0000000074DB0000-0x0000000075130000-memory.dmp
memory/2744-1065-0x00000000727C0000-0x00000000727DB000-memory.dmp
memory/2744-1073-0x0000000070A30000-0x0000000070A61000-memory.dmp
memory/2744-1072-0x0000000070A70000-0x0000000070D21000-memory.dmp
memory/2744-1071-0x0000000070D30000-0x0000000070D3B000-memory.dmp
memory/2744-1070-0x0000000070E10000-0x0000000070E1D000-memory.dmp
memory/2744-1066-0x0000000071B20000-0x0000000071C37000-memory.dmp
memory/2744-1068-0x0000000070F10000-0x0000000070F2B000-memory.dmp
memory/6016-27-0x0000000000400000-0x000000000047D000-memory.dmp
memory/6016-804-0x0000000000400000-0x000000000047D000-memory.dmp
memory/6016-820-0x0000000000400000-0x000000000047D000-memory.dmp
memory/6016-0-0x0000000000400000-0x000000000047D000-memory.dmp
memory/6016-28-0x0000000000400000-0x000000000047D000-memory.dmp