Analysis
- user interaction
yes - max time kernel
46s - max time network
32s - platform
windows11-21h2_x64 - resource
win11-20260911-en - resource tags
- submitted
24/10/2026, 19:54
General
- Target boltv2/hwid_checker.exe
- Size 332KB
- Sample261024-ymm9nsdy3p
- SHA256 ca40d8cb06a1084ad3171d12172049aef384cbc9209dca9d59baa6ef03b116e3
Malware Config
Signatures
- Badlisted process makes network request 1 IoCs
Network request originating from process or tool commonly abused by malware.
- Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs
Run Powershell to get system information.
- Hide Artifacts: Ignore Process Interrupts 1 TTPs 1 IoCs
Command interpreters often include specific commands/flags that ignore errors and other hangups.
- Queries registry keys for unique system GUIDs 1 TTPs 1 IoCs
Queries the MachineGuid or HwProfileGuid value from the command line, commonly used to create a unique victim ID.
- Queries system WMI classes for hardware identifiers 2 TTPs 1 IoCs
Uses WMI to read hardware serial numbers or the system UUID, commonly used to fingerprint the victim machine.
- Suspicious behavior: EnumeratesProcesses 4 IoCs
- Suspicious use of AdjustPrivilegeToken 23 IoCs
- Suspicious use of WriteProcessMemory 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\boltv2\hwid_checker.exe"C:\Users\Admin\AppData\Local\Temp\boltv2\hwid_checker.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command "$ErrorActionPreference = 'SilentlyContinue'; try { $u = (Get-CimInstance -ClassName Win32_ComputerSystemProduct).UUID; if ($u -and $u -ne 'FFFFFFFF-FFFF-FFFF-FFFF-FFFFFFFFFFFF') { return $u } } catch {}; try { $m = (Get-ItemProperty -Path 'HKLM:\SOFTWARE\Microsoft\Cryptography').MachineGuid; if ($m) { return $m } } catch {}; try { $w = (wmic csproduct get uuid /format:list 2>$null | Select-String 'UUID=').Line.Split('=')[1].Trim(); if ($w) { return $w } } catch {}; return 'NO_HWID_FOUND'"2⤵
- Command and Scripting Interpreter: PowerShell
- Hide Artifacts: Ignore Process Interrupts
- Queries registry keys for unique system GUIDs
- Queries system WMI classes for hardware identifiers
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command "$apis = @('https://api4.ipify.org', 'https://ipv4.icanhazip.com', 'https://v4.ident.me', 'https://checkip.amazonaws.com'); foreach ($api in $apis) { try { $ip = (Invoke-RestMethod -Uri $api -TimeoutSec 4).Trim(); if ($ip -match '^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}$') { return $ip } } catch {} }; return 'NO_IP_FOUND'"2⤵
- Badlisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
powershell.exe.log
StartupProfileData-NonInteractive
__PSScriptPolicyTest_q1ooyhof.yn1.ps1
memory/2136-35-0x00000299F8AB0000-0x00000299F8C72000-memory.dmp
memory/2136-34-0x00000299F56E0000-0x00000299F56F0000-memory.dmp
memory/2136-26-0x00000299F56E0000-0x00000299F56F0000-memory.dmp
memory/2136-25-0x00000299F56E0000-0x00000299F56F0000-memory.dmp
memory/2140-9-0x00000163FE0B0000-0x00000163FE0C0000-memory.dmp
memory/2140-19-0x00000163E5D20000-0x00000163E5D2A000-memory.dmp
memory/2140-20-0x00000163FDF00000-0x00000163FDF2A000-memory.dmp
memory/2140-21-0x00000163FDF00000-0x00000163FDF24000-memory.dmp
memory/2140-18-0x0000016382570000-0x0000016382623000-memory.dmp
memory/2140-17-0x0000016382530000-0x000001638254C000-memory.dmp
memory/2140-15-0x00007FF452240000-0x00007FF452250000-memory.dmp
memory/2140-1-0x00000163FE0B0000-0x00000163FE0C0000-memory.dmp
memory/2140-2-0x00000163E5E70000-0x00000163E5E92000-memory.dmp
memory/2140-0-0x00000163FE0B0000-0x00000163FE0C0000-memory.dmp
memory/3256-37-0x00007FF689340000-0x00007FF68939A000-memory.dmp
memory/3256-39-0x00007FF689340000-0x00007FF68939A000-memory.dmp