Overview

overview

10

Static

static

3

Win11 Only

windows11-21h2-x64

8

Win11 Only

windows11-21h2-x64

7

Win11 Only

windows11-21h2-x64

7

Win11 Only

windows11-21h2-x64

10

Win11 Only

windows11-21h2-x64

7

Win11 Only

windows11-21h2-x64

7

Win11 Only

windows11-21h2-x64

7

Win11 Only

windows11-21h2-x64

7

Analysis

  • max time kernel
    298s
  • max time network
    337s
  • platform
    windows11-21h2_x64
  • resource
    win11-20260911-en
  • resource tags

    arch:x64arch:x86image:win11-20260911-enlocale:en-usos:windows11-21h2-x64systemwindows
  • submitted
    16/09/2026, 14:07

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    BOM147-Tasinabilir-1.2.0.exe
  • Size 54.2MB
  • Sample260916-re76jsbc53
  • SHA256 2a50b207a98c026d4b61dad692fa921a8bf57921c43c8a370c6756bd6dc749d1
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
discovery

Malware Config

Signatures

  • Executes dropped EXE 5 IoCs
  • Loads dropped DLL 12 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies registry class 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 10 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 5 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\BOM147-Tasinabilir-1.2.0.exe
    "C:\Users\Admin\AppData\Local\Temp\BOM147-Tasinabilir-1.2.0.exe"
    1⤵
    • Loads dropped DLL
    • System Location Discovery: System Language Discovery
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2988
    • C:\Users\Admin\AppData\Local\Temp\3IH7u9CHCsnCRtIQFRvzdCTbfYx\BOM 147.exe
      "C:\Users\Admin\AppData\Local\Temp\3IH7u9CHCsnCRtIQFRvzdCTbfYx\BOM 147.exe"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Suspicious use of WriteProcessMemory
      PID:5020
      • C:\Users\Admin\AppData\Local\Temp\3IH7u9CHCsnCRtIQFRvzdCTbfYx\BOM 147.exe
        "C:\Users\Admin\AppData\Local\Temp\3IH7u9CHCsnCRtIQFRvzdCTbfYx\BOM 147.exe" --type=gpu-process --field-trial-handle=1476,5200928124645833873,2565138814337072,131072 --enable-features=WebComponentsV0Enabled --disable-features=SpareRendererForSitePerProcess --no-sandbox --gpu-preferences=MAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAQAAAAAAAAAAAAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAA= --mojo-platform-channel-handle=1480 /prefetch:2
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Modifies registry class
        • Suspicious behavior: EnumeratesProcesses
        PID:2028
      • C:\Users\Admin\AppData\Local\Temp\3IH7u9CHCsnCRtIQFRvzdCTbfYx\BOM 147.exe
        "C:\Users\Admin\AppData\Local\Temp\3IH7u9CHCsnCRtIQFRvzdCTbfYx\BOM 147.exe" --type=utility --field-trial-handle=1476,5200928124645833873,2565138814337072,131072 --enable-features=WebComponentsV0Enabled --disable-features=SpareRendererForSitePerProcess --lang=en-US --service-sandbox-type=network --no-sandbox --mojo-platform-channel-handle=1844 /prefetch:8
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Suspicious behavior: EnumeratesProcesses
        PID:1512
      • C:\Users\Admin\AppData\Local\Temp\3IH7u9CHCsnCRtIQFRvzdCTbfYx\BOM 147.exe
        "C:\Users\Admin\AppData\Local\Temp\3IH7u9CHCsnCRtIQFRvzdCTbfYx\BOM 147.exe" --type=renderer --no-sandbox --force-device-scale-factor=1 --field-trial-handle=1476,5200928124645833873,2565138814337072,131072 --enable-features=WebComponentsV0Enabled --disable-features=SpareRendererForSitePerProcess --lang=en-US --app-path="C:\Users\Admin\AppData\Local\Temp\3IH7u9CHCsnCRtIQFRvzdCTbfYx\resources\app.asar" --enable-plugins --no-sandbox --no-zygote --preload="C:\Users\Admin\AppData\Local\Temp\3IH7u9CHCsnCRtIQFRvzdCTbfYx\resources\app.asar\preload.js" --enable-remote-module --context-isolation --background-color=#0f0c16 --enable-spellcheck --enable-websql --disable-electron-site-instance-overrides --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=3 --mojo-platform-channel-handle=2156 /prefetch:1
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Suspicious behavior: EnumeratesProcesses
        PID:4036
      • C:\Users\Admin\AppData\Local\Temp\3IH7u9CHCsnCRtIQFRvzdCTbfYx\BOM 147.exe
        "C:\Users\Admin\AppData\Local\Temp\3IH7u9CHCsnCRtIQFRvzdCTbfYx\BOM 147.exe" --type=gpu-process --field-trial-handle=1476,5200928124645833873,2565138814337072,131072 --enable-features=WebComponentsV0Enabled --disable-features=SpareRendererForSitePerProcess --disable-gpu-sandbox --use-gl=disabled --no-sandbox --gpu-preferences=MAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAEAAAQAAAAAAAAAAAAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAA= --mojo-platform-channel-handle=1516 /prefetch:2
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Suspicious behavior: EnumeratesProcesses
        PID:1920

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        chrome_100_percent.pak
        • Path C:\Users\Admin\AppData\Local\Temp\3IH7u9CHCsnCRtIQFRvzdCTbfYx\chrome_100_percent.pak
        • Size 175KB
        • SHA256 419cfcc6dc5f38b2e0c970ebd4fad1ef55054579d5c0db2521d7ae494996aac3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_200_percent.pak
        • Path C:\Users\Admin\AppData\Local\Temp\3IH7u9CHCsnCRtIQFRvzdCTbfYx\chrome_200_percent.pak
        • Size 312KB
        • SHA256 edecf8e1ac353bfdae534e42507e5a59973cb4cab76fbb1ff1a470363e725bc4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        d3dcompiler_47.dll
        • Path C:\Users\Admin\AppData\Local\Temp\3IH7u9CHCsnCRtIQFRvzdCTbfYx\d3dcompiler_47.dll
        • Size 4.3MB
        • SHA256 4b074a3976399dc735484f5d43d04b519b7bdee8ac719d9ab8ed6bd4e6be0345
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ffmpeg.dll
        • Path C:\Users\Admin\AppData\Local\Temp\3IH7u9CHCsnCRtIQFRvzdCTbfYx\ffmpeg.dll
        • Size 2.6MB
        • SHA256 d12f0ce401dc6fcf5337f82b4cc7055d893f135ca5ed79978f1801fadaf0a39c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        icudtl.dat
        • Path C:\Users\Admin\AppData\Local\Temp\3IH7u9CHCsnCRtIQFRvzdCTbfYx\icudtl.dat
        • Size 10.0MB
        • SHA256 594637e10b8f5c97157413528f0cbf5bc65b4ab9e79f5fa34fe268092655ec57
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        en-US.pak
        • Path C:\Users\Admin\AppData\Local\Temp\3IH7u9CHCsnCRtIQFRvzdCTbfYx\locales\en-US.pak
        • Size 79KB
        • SHA256 35adc5aeeebfe440e295b88d2a4089360ada33c353843b1f5438f4118501878b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        resources.pak
        • Path C:\Users\Admin\AppData\Local\Temp\3IH7u9CHCsnCRtIQFRvzdCTbfYx\resources.pak
        • Size 4.6MB
        • SHA256 ddc85d749b19cbabae11a0b8f7114daf75900179a2147280dd0f9f8faee7d65c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        app.asar
        • Path C:\Users\Admin\AppData\Local\Temp\3IH7u9CHCsnCRtIQFRvzdCTbfYx\resources\app.asar
        • Size 2.7MB
        • SHA256 afc576ab3888519a07c847d538825aad5c21cfe3e37da6011010a4529893e23d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        libEGL.dll
        • Path C:\Users\Admin\AppData\Local\Temp\3IH7u9CHCsnCRtIQFRvzdCTbfYx\swiftshader\libEGL.dll
        • Size 391KB
        • SHA256 f9e3e49e55f01869be58157fd1f8fc1eca4c8b6b34b14e5e124149e6da1efa9f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        libGLESv2.dll
        • Path C:\Users\Admin\AppData\Local\Temp\3IH7u9CHCsnCRtIQFRvzdCTbfYx\swiftshader\libGLESv2.dll
        • Size 3.6MB
        • SHA256 56767f04b3b101d912c89cd2e7f4fd4209a6de5c462688a6df3fe9ed1892b9db
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        v8_context_snapshot.bin
        • Path C:\Users\Admin\AppData\Local\Temp\3IH7u9CHCsnCRtIQFRvzdCTbfYx\v8_context_snapshot.bin
        • Size 166KB
        • SHA256 a6357699c5ecec9fe34901813fededdf788bc3066a6548c7f868f0acc4caa5a3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        vulkan-1.dll
        • Path C:\Users\Admin\AppData\Local\Temp\3IH7u9CHCsnCRtIQFRvzdCTbfYx\vulkan-1.dll
        • Size 609KB
        • SHA256 29510e4086d0ea57b123f1116dcefc76a4915e0df3f67f683a9738c6537ddd5e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        StdUtils.dll
        • Path C:\Users\Admin\AppData\Local\Temp\nsnAFA0.tmp\StdUtils.dll
        • Size 100KB
        • SHA256 b72e9013a6204e9f01076dc38dabbf30870d44dfc66962adbf73619d4331601e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        System.dll
        • Path C:\Users\Admin\AppData\Local\Temp\nsnAFA0.tmp\System.dll
        • Size 12KB
        • SHA256 3eb38ae99653a7dbc724132ee240f6e5c4af4bfe7c01d31d23faf373f9f2eaca
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        nsis7z.dll
        • Path C:\Users\Admin\AppData\Local\Temp\nsnAFA0.tmp\nsis7z.dll
        • Size 424KB
        • SHA256 b393f05e8ff919ef071181050e1873c9a776e1a0ae8329aefff7007d0cadf592
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Network Persistent State~RFe5adfa3.TMP
        • Path C:\Users\Admin\AppData\Roaming\BOM 147\Network Persistent State~RFe5adfa3.TMP
        • Size 59B
        • SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        c0078e57-4551-41e4-ac0a-68eccf5cca6d.tmp
        • Path C:\Users\Admin\AppData\Roaming\BOM 147\c0078e57-4551-41e4-ac0a-68eccf5cca6d.tmp
        • Size 187B
        • SHA256 fadd70320bf4be1e31268c19fa82fe6e60b1fde0440fb37bda5d1cf50be56bd6
        • MD5 SHA1 SHA512 TLSH
        Submit Download