992291465f4d87665c0b8e950a75b6564870983f1ae9398b34155b0d983f8904

Analysis

user interaction
yes
max time kernel
150s
max time network
132s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
10/09/2026, 21:33

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
BlazeTriggerbot_patched.exe
Size 633KB
Sample260910-1d548shj4x
SHA256 992291465f4d87665c0b8e950a75b6564870983f1ae9398b34155b0d983f8904
MD5 58a1ffa2523ea26a095a253654381665
SHA1 b0912799e2a41edf6713db6bc4329e6ce56e7c3c
SHA512 da9b4297c632a0400d169d97f4fe53d9b63a2a35706d985c6c50f11ec66906deec67b041322abac58295a561dae007546c1bd6e1cbb7676d84808436841c566e
SSDEEP 6144:WYBhqaWX9vDRkWPcMx/Fq4hv8lHVlF/qKHf+5OuRaxy5xJFyg1beXj6K6Amoau8G:WBj9HxLB8lVlQK/+l+F6DGRg8O
TLSH
T1DCD4CF2DBA2ACF76C3A790BD4E93CD02B2F17A4EB351BBC79E1157B419115C48273249
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery execution

Malware Config

Signatures

Executes dropped EXE 4 IoCs

pid	Process
4384	BlazeTriggerbot.exe
1888	BlazeTriggerbot.exe
5664	BlazeTriggerbot.exe
4404	BlazeTriggerbot.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
5960	cmd.exe

Delays execution with timeout.exe 1 IoCs

defense_evasion

pid	Process
260	timeout.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1148 wrote to memory of 4384	1148	BlazeTriggerbot_patched.exe	89
PID 4384 wrote to memory of 5960	4384	BlazeTriggerbot.exe	91
PID 5960 wrote to memory of 260	5960	cmd.exe	93
PID 5960 wrote to memory of 1888	5960	cmd.exe	94

C:\Users\Admin\AppData\Local\Temp\BlazeTriggerbot_patched.exe
"C:\Users\Admin\AppData\Local\Temp\BlazeTriggerbot_patched.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1148
- C:\Users\Admin\AppData\Roaming\BlazeTriggerbot\BlazeTriggerbot.exe
  "C:\Users\Admin\AppData\Roaming\BlazeTriggerbot\BlazeTriggerbot.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:4384
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\BlazeTriggerbot\update.bat" "
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:5960
  - - C:\Windows\system32\timeout.exe
      timeout /t 2 /nobreak
      4⤵
      Delays execution with timeout.exe
      PID:260
  - - C:\Users\Admin\AppData\Roaming\BlazeTriggerbot\BlazeTriggerbot.exe
      "C:\Users\Admin\AppData\Roaming\BlazeTriggerbot\BlazeTriggerbot.exe"
      4⤵
      Executes dropped EXE
      PID:1888

C:\Users\Admin\AppData\Roaming\BlazeTriggerbot\BlazeTriggerbot.exe
"C:\Users\Admin\AppData\Roaming\BlazeTriggerbot\BlazeTriggerbot.exe"
1⤵
- Executes dropped EXE
PID:5664

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:2652

C:\Users\Admin\AppData\Roaming\BlazeTriggerbot\BlazeTriggerbot.exe
"C:\Users\Admin\AppData\Roaming\BlazeTriggerbot\BlazeTriggerbot.exe"
1⤵
- Executes dropped EXE
PID:4404

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BlazeTriggerbot.exe

Path C:\Users\Admin\AppData\Roaming\BlazeTriggerbot\BlazeTriggerbot.exe
Size 633KB
SHA256 992291465f4d87665c0b8e950a75b6564870983f1ae9398b34155b0d983f8904
MD5 58a1ffa2523ea26a095a253654381665
SHA1 b0912799e2a41edf6713db6bc4329e6ce56e7c3c
SHA512 da9b4297c632a0400d169d97f4fe53d9b63a2a35706d985c6c50f11ec66906deec67b041322abac58295a561dae007546c1bd6e1cbb7676d84808436841c566e
SSDEEP 6144:WYBhqaWX9vDRkWPcMx/Fq4hv8lHVlF/qKHf+5OuRaxy5xJFyg1beXj6K6Amoau8G:WBj9HxLB8lVlQK/+l+F6DGRg8O
TLSH
T1DCD4CF2DBA2ACF76C3A790BD4E93CD02B2F17A4EB351BBC79E1157B419115C48273249
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BlazeTriggerbot_new.exe

Path C:\Users\Admin\AppData\Roaming\BlazeTriggerbot\BlazeTriggerbot_new.exe
Size 641KB
SHA256 502c4e7323008be601864a00c77932614e53e047d6102122701aca7d78fe3e04
MD5 97f77f0dd81d08a18dea1a4664da1f02
SHA1 cecedee1b21160ce8cd1a7fd90ac60aa05d8a420
SHA512 5703b851aa5501cf08c6d5f8b2931709fd901dd57a4a0d5f662f75cadb3d876700d872fa625a66efeb7f4726fd55c8d4183ce54f9386ffb983990d64f73dcf8d
SSDEEP 6144:lFbw5FBUEjlikZhv8lHVlF/qKHf+5OuRaxy5xJFyg1beXj6K6Amoau8ymCb9Jt/3:sLxB8lVlQK/+l+F6DGRg8O
TLSH
T105D4BF1DBA26CB76C3E754BD4E93CE02B2F07A4EB351BBC79E1296B419114C48673389
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

update.bat

Path C:\Users\Admin\AppData\Roaming\BlazeTriggerbot\update.bat
Size 546B
SHA256 82b9a4bb5cf091c07dbfb050bd3aa445b98f40665ba5828c81ae0284d847b945
MD5 5603ab8b39effcf996910b12eaae33fb
SHA1 3a7638e75208dfac12f1c3e4d9b0efd40804d922
SHA512 0402c7af58886559aefb7e3c1a229cb173db321961981f3fb9c88a592bf74b96a3faac4d5d53d24d87bf71a4c97850443f32b34ec4e37d89efbfffdd844ba84a
TLSH
T1B4F01D2316C6AECD742D04FBC6F29249416155ED2EA63EC8C3C084AA7B41F0CF986C1E
MD5 SHA1 SHA512 TLSH

Submit Download

version.dat

Path C:\Users\Admin\AppData\Roaming\BlazeTriggerbot\version.dat
Size 5B
SHA256 d51e6ec94058554a84558a5b402ee6ef5fdf5455e35c902feda61cda8752943a
MD5 3accddf64b1dd03abeb9b0b3e5a7ba44
SHA1 d1b76f3800b4ffa88b1062b60da950bacf4f54b0
SHA512 4106f83d3c1665aea668cb0e8473e2dddc6b3597eeff59bbc266fcfdb8ba9ee1146ec3a0c2788071f5ef53bec776a5984847705ebed757d240d9ec26a69ca5c4
MD5 SHA1 SHA512

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads