Analysis
- user interaction
yes - max time kernel
5s - max time network
7s - platform
windows10-2004_x64 - resource
win10v2004-20260911-en - resource tags
- submitted
29/10/2026, 21:50
Errors
General
- Target BOYKA.exe
- Size 6.1MB
- Sample261029-1py53ae18s
- SHA256 a84020f7f5c158085d49388b3f77d1b7b958864dc1701ea24724c532973e3ce0
Malware Config
Signatures
- Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE 4 IoCs
- Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
- ConfuserEx .NET packer 1 IoCs
Detects ConfuserEx .NET packer.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 2 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
- Program crash 1 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\BOYKA.exe"C:\Users\Admin\AppData\Local\Temp\BOYKA.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\SC2RS.exe"C:\Users\Admin\AppData\Roaming\SC2RS.exe"2⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\k.exe"C:\Users\Admin\AppData\Roaming\k.exe"3⤵
- Executes dropped EXE
- Writes to the Master Boot Record (MBR)
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k reg delete HKCR /f4⤵
- Executes a command shell one-liner
-
C:\Windows\system32\reg.exereg delete HKCR /f5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\nasm.exe"nasm.exe" -f bin mbr_temp.asm -o mbr_temp.bin4⤵
-
-
-
C:\Users\Admin\AppData\Roaming\Virus NahSmi.exe"C:\Users\Admin\AppData\Roaming\Virus NahSmi.exe"3⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Roaming\Naيببشمي.exe"C:\Users\Admin\AppData\Roaming\Naيببشمي.exe"4⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k reg delete HKCR /f5⤵
- Executes a command shell one-liner
-
C:\Windows\system32\reg.exereg delete HKCR /f6⤵
-
-
-
-
C:\Users\Admin\AppData\Roaming\Viurs ByDRX1 ALHB Group.exe"C:\Users\Admin\AppData\Roaming\Viurs ByDRX1 ALHB Group.exe"4⤵
-
C:\Users\Admin\AppData\Local\Temp\Viurs DRX1.exe"C:\Users\Admin\AppData\Local\Temp\Viurs DRX1.exe"5⤵
-
-
-
C:\Users\Admin\AppData\Roaming\Virus.exe"C:\Users\Admin\AppData\Roaming\Virus.exe"4⤵
-
C:\Users\Admin\AppData\Local\Temp\Virus REvi DRX1.exe"C:\Users\Admin\AppData\Local\Temp\Virus REvi DRX1.exe"5⤵
-
C:\Users\Admin\AppData\Local\Temp\Virus REvi DRX1.exe"C:\Users\Admin\AppData\Local\Temp\Virus REvi DRX1.exe"6⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2176 -s 13327⤵
- Program crash
-
-
-
-
-
-
-
C:\Users\Admin\AppData\Roaming\Virus SCARS.exe"C:\Users\Admin\AppData\Roaming\Virus SCARS.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x470 0x4281⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 496 -p 2176 -ip 21761⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
Viurs ByDRX1 ALHB Group.exe.log
Virus REvi DRX1.exe.log
sByte.dll
Virus REvi DRX1.exe
Viurs DRX1.exe
mbr_temp.asm
mbr_temp.bin
nasm.exe
Naيببشمي.exe
SC2RS.exe
Virus NahSmi.exe
Virus SCARS.exe
Virus.exe
Viurs ByDRX1 ALHB Group.exe
k.exe
memory/1392-29-0x0000000005E40000-0x00000000063E4000-memory.dmp
memory/1392-55-0x00000000057F0000-0x00000000057FA000-memory.dmp
memory/1392-28-0x0000000000BE0000-0x0000000000EEE000-memory.dmp
memory/1392-30-0x0000000005890000-0x0000000005922000-memory.dmp
memory/1748-154-0x000000001BE50000-0x000000001BFF9000-memory.dmp
memory/1748-146-0x000000001BE50000-0x000000001BFF9000-memory.dmp
memory/1748-79-0x0000000000B90000-0x0000000000B9A000-memory.dmp
memory/1824-121-0x0000000000FF0000-0x0000000000FFA000-memory.dmp
memory/1996-94-0x0000000000770000-0x00000000007B6000-memory.dmp
memory/2176-151-0x0000000000400000-0x0000000000430000-memory.dmp
memory/2248-143-0x00000000001A0000-0x0000000000242000-memory.dmp
memory/2308-54-0x0000000000790000-0x00000000008E6000-memory.dmp
memory/2672-49-0x00000000007C0000-0x0000000000B02000-memory.dmp
memory/2672-153-0x000000001CF60000-0x000000001D109000-memory.dmp
memory/2672-145-0x000000001CF60000-0x000000001D109000-memory.dmp
memory/3836-106-0x000000001B440000-0x000000001B4E2000-memory.dmp
memory/3836-96-0x0000000000670000-0x000000000075C000-memory.dmp
memory/3836-97-0x00000000026A0000-0x00000000026AC000-memory.dmp
memory/3952-23-0x0000000000D20000-0x00000000011D6000-memory.dmp
memory/4300-2-0x000000001C170000-0x000000001C180000-memory.dmp
memory/4300-1-0x000000001C180000-0x000000001C93C000-memory.dmp
memory/4300-0-0x0000000000E60000-0x0000000001474000-memory.dmp
memory/4484-128-0x0000000000400000-0x0000000000539000-memory.dmp