| File name: | BLTools v2.9 PRO.exe |
| Full analysis: | https://app.any.run/tasks/4624e000-ee67-4b29-ab76-9421eb8b40d7 |
| Verdict: | Malicious activity |
| Analysis date: | November 21, 2024, 09:57:03 |
| OS: | Windows 10 Professional (build: 19045, 64 bit) |
| Tags: | |
| Indicators: | |
| MIME: | application/vnd.microsoft.portable-executable |
| File info: | PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows, 3 sections |
| MD5: | 9C4FA57A0D02A2E71EF4DCAC942C08D8 |
| SHA1: | 9E6BC8DA3463B3DCA5B3BB0BCB87E946674767C5 |
| SHA256: | 16EC1D273039535A660AC22CE026B37E989E2D011FC0EAD57F9C60DC7E96355F |
| SSDEEP: | 98304:Ub8wDJFqFvCpetDLTfemxb3ksfhkHHmWwjZuN7JZ6iI0RZA+GSayy4Q7r3BxiMTo:3f8s+hvIp652ub |
MALICIOUS
No malicious indicators.SUSPICIOUS
The process executes VB scripts
- BLTools v2.9 PRO.exe (PID: 5400)
Likely accesses (executes) a file from the Public directory
- wscript.exe (PID: 4992)
- cmd.exe (PID: 5288)
- csrs.exe (PID: 6268)
- BLToolsv2.9.exe (PID: 6300)
Executable content was dropped or overwritten
- BLTools v2.9 PRO.exe (PID: 5400)
- s.exe (PID: 6188)
Executing commands from a ".bat" file
- wscript.exe (PID: 4992)
Starts CMD.EXE for commands execution
- wscript.exe (PID: 4992)
Process drops legitimate windows executable
- BLTools v2.9 PRO.exe (PID: 5400)
INFO
Checks supported languages
- BLTools v2.9 PRO.exe (PID: 5400)
Reads the computer name
- BLTools v2.9 PRO.exe (PID: 5400)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
TRiD
| .exe | | | Generic CIL Executable (.NET, Mono, etc.) (82.9) |
|---|---|---|
| .dll | | | Win32 Dynamic Link Library (generic) (7.4) |
| .exe | | | Win32 Executable (generic) (5.1) |
| .exe | | | Generic Win/DOS Executable (2.2) |
| .exe | | | DOS Executable Generic (2.2) |
EXIF
EXE
| MachineType: | Intel 386 or later, and compatibles |
|---|---|
| TimeStamp: | 2090:05:09 08:18:44+00:00 |
| ImageFileCharacteristics: | Executable, Large address aware |
| PEType: | PE32 |
| LinkerVersion: | 48 |
| CodeSize: | 6472192 |
| InitializedDataSize: | 70144 |
| UninitializedDataSize: | - |
| EntryPoint: | 0x62e1de |
| OSVersion: | 4 |
| ImageVersion: | - |
| SubsystemVersion: | 6 |
| Subsystem: | Windows GUI |
| FileVersionNumber: | 1.0.0.0 |
| ProductVersionNumber: | 1.0.0.0 |
| FileFlagsMask: | 0x003f |
| FileFlags: | (none) |
| FileOS: | Win32 |
| ObjectFileType: | Executable application |
| FileSubtype: | - |
| LanguageCode: | Neutral |
| CharacterSet: | Unicode |
| Comments: | - |
| CompanyName: | - |
| FileDescription: | app |
| FileVersion: | 1.0.0.0 |
| InternalName: | app.exe |
| LegalCopyright: | Copyright © 2024 |
| LegalTrademarks: | - |
| OriginalFileName: | app.exe |
| ProductName: | app |
| ProductVersion: | 1.0.0.0 |
| AssemblyVersion: | 1.0.0.0 |
Total processes
120
Monitored processes
7
Malicious processes
0
Suspicious processes
1
Behavior graph
Click at the process to see the details
Process information
PID | CMD | Path | Indicators | Parent process | |||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 4992 | "C:\WINDOWS\System32\WScript.exe" "C:\Users\Public\MicrosoftEdgeUpdates\ps.vbs" | C:\Windows\SysWOW64\wscript.exe | — | BLTools v2.9 PRO.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Microsoft ® Windows Based Script Host Exit code: 0 Version: 5.812.10240.16384 Modules
| |||||||||||||||
| 5288 | C:\WINDOWS\system32\cmd.exe /c ""C:\Users\Public\MicrosoftEdgeUpdates\pss.bat" " | C:\Windows\SysWOW64\cmd.exe | — | wscript.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows Command Processor Exit code: 0 Version: 10.0.19041.3636 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 5400 | "C:\Users\admin\AppData\Local\Temp\BLTools v2.9 PRO.exe" | C:\Users\admin\AppData\Local\Temp\BLTools v2.9 PRO.exe | explorer.exe | ||||||||||||
User: admin Integrity Level: MEDIUM Description: app Version: 1.0.0.0 Modules
| |||||||||||||||
| 6120 | \??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1 | C:\Windows\System32\conhost.exe | — | cmd.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Console Window Host Exit code: 0 Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 6188 | s.exe -pC#X#niM5N$nXf$FbKnDEm | C:\Users\Public\MicrosoftEdgeUpdates\s.exe | cmd.exe | ||||||||||||
User: admin Company: Oleg N. Scherbakov Integrity Level: MEDIUM Description: 7z Setup SFX (x86) Version: 1.6.0.2712 Modules
| |||||||||||||||
| 6268 | "C:\Users\Public\MicrosoftEdgeUpdates\csrs.exe" | C:\Users\Public\MicrosoftEdgeUpdates\csrs.exe | — | s.exe | |||||||||||
User: admin Company: Maël Hörz Integrity Level: MEDIUM Description: HxD Hex Editor Version: 2.5.0.0 Modules
| |||||||||||||||
| 6300 | "C:\Users\Public\BLToolsv2.9\BLToolsv2.9.exe" | C:\Users\Public\BLToolsv2.9\BLToolsv2.9.exe | — | BLTools v2.9 PRO.exe | |||||||||||
User: admin Integrity Level: MEDIUM Description: BLTools Cookies Checker Version: 2.9.0.0 Modules
| |||||||||||||||
Total events
3 864
Read events
3 863
Write events
1
Delete events
0
Modification events
| (PID) Process: | (5400) BLTools v2.9 PRO.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.vbs\OpenWithProgids |
| Operation: | write | Name: | VBSFile |
Value: | |||
Executable files
10
Suspicious files
2
Text files
4
Unknown types
1
Dropped files
PID | Process | Filename | Type | |
|---|---|---|---|---|
| 5400 | BLTools v2.9 PRO.exe | C:\Users\Public\BLToolsv2.9\AlphaFS.dll | executable | |
MD5:F2F6F6798D306D6D7DF4267434B5C5F9 | SHA256:837F2CEAB6BBD9BC4BF076F1CB90B3158191888C3055DD2B78A1E23F1C3AAFDD | |||
| 6268 | csrs.exe | C:\Users\admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\EdgeUpdate.lnk | lnk | |
MD5:F52E1A9269CE18806862B19883CCAEBC | SHA256:B499BD7A02EBB9A52197E16724A8A9B37F5E38B26E63B6F4E985A0A3BDE9C282 | |||
| 5400 | BLTools v2.9 PRO.exe | C:\Users\Public\MicrosoftEdgeUpdates.zip | compressed | |
MD5:A79529A072F3FB2C037188C3AD57C45A | SHA256:D1DFA0D9EA037EF780D16A542DC8BD7AD19CE84CC5E702B7EC9B6101DA8274B3 | |||
| 5400 | BLTools v2.9 PRO.exe | C:\Users\Public\MicrosoftEdgeUpdates\pss.bat | text | |
MD5:C6131F38EDC71935BD8B905D7B4D3BE4 | SHA256:20527233BDFA61A7BFF4B830451C33C53B2AEFF917F2884DF8ACE58BAAADC77A | |||
| 5400 | BLTools v2.9 PRO.exe | C:\Users\Public\MicrosoftEdgeUpdates\s.exe | executable | |
MD5:EA0C431D39020ADF9188B15731A4C6A1 | SHA256:44719C936FBA5283A48388094691CA4472CF9E5980D583FECA8D5BBC0D1D4ACD | |||
| 5400 | BLTools v2.9 PRO.exe | C:\Users\Public\BLToolsv2.9\BLToolsv2.9.exe | executable | |
MD5:8C949C1A3189FC8845F22295EE72A150 | SHA256:53B6B47C5DBFBB8EA17990309E9549ACC44D8B5D4B1C9E76EC754653F5D31870 | |||
| 5400 | BLTools v2.9 PRO.exe | C:\Users\Public\BLToolsv2.9\Extreme.Net.dll | executable | |
MD5:F79F0E3A0361CAC000E2D3553753CD68 | SHA256:8A6518AB7419FBEC3AC9875BAA3AFB410AD1398C7AA622A09CD9084EC6CADFCD | |||
| 5400 | BLTools v2.9 PRO.exe | C:\Users\Public\BLToolsv2.9\CookiesCreator.exe | executable | |
MD5:E42B6AA3255C2A75AD2E05CD40FE7063 | SHA256:A0B162A146BCF19634559A88877C21FABB512FBED11834F82D2FA60E56F0FAA6 | |||
| 5400 | BLTools v2.9 PRO.exe | C:\Users\Public\BLToolsv2.9.zip | compressed | |
MD5:A1150833D239AFFBE607681119BA613F | SHA256:C9A92D871ECDB4B285D3522640B4D400955A2E4D2EAE2A13C5039AF135035993 | |||
| 6188 | s.exe | C:\Users\Public\MicrosoftEdgeUpdates\csrs.exe | executable | |
MD5:8BEF98A1E9BA9DE4174BE7090A2ADFD6 | SHA256:4CEE7F031DBD67E23D4783D610CDA67F3BBDBC1C975F3288B64FA801F07D0576 | |||
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
7
TCP/UDP connections
32
DNS requests
17
Threats
0
HTTP requests
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
|---|---|---|---|---|---|---|---|---|---|
4712 | MoUsoCoreWorker.exe | GET | 200 | 2.23.181.156:80 | http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl | unknown | — | — | whitelisted |
4712 | MoUsoCoreWorker.exe | GET | 200 | 23.53.40.178:80 | http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl | unknown | — | — | whitelisted |
5064 | SearchApp.exe | GET | 200 | 192.229.221.95:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAI5PUjXAkJafLQcAAsO18o%3D | unknown | — | — | whitelisted |
6484 | SIHClient.exe | GET | 200 | 2.23.181.156:80 | http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl | unknown | — | — | whitelisted |
6484 | SIHClient.exe | GET | 200 | 2.23.181.156:80 | http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl | unknown | — | — | whitelisted |
1176 | svchost.exe | GET | 200 | 192.229.221.95:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D | unknown | — | — | whitelisted |
2536 | backgroundTaskHost.exe | GET | 200 | 192.229.221.95:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0%3D | unknown | — | — | whitelisted |
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
Connections
PID | Process | IP | Domain | ASN | CN | Reputation |
|---|---|---|---|---|---|---|
4 | System | 192.168.100.255:137 | — | — | — | whitelisted |
5560 | RUXIMICS.exe | 20.73.194.208:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | NL | whitelisted |
— | — | 20.73.194.208:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | NL | whitelisted |
4712 | MoUsoCoreWorker.exe | 23.53.40.178:80 | crl.microsoft.com | Akamai International B.V. | DE | whitelisted |
4712 | MoUsoCoreWorker.exe | 2.23.181.156:80 | www.microsoft.com | AKAMAI-AS | DE | whitelisted |
5064 | SearchApp.exe | 2.16.204.161:443 | www.bing.com | Akamai International B.V. | DE | whitelisted |
4 | System | 192.168.100.255:138 | — | — | — | whitelisted |
— | — | 51.104.136.2:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | IE | whitelisted |
5064 | SearchApp.exe | 192.229.221.95:80 | ocsp.digicert.com | EDGECAST | US | whitelisted |
1176 | svchost.exe | 20.190.160.17:443 | login.live.com | MICROSOFT-CORP-MSN-AS-BLOCK | NL | whitelisted |
DNS requests
Domain | IP | Reputation |
|---|---|---|
crl.microsoft.com |
| whitelisted |
www.microsoft.com |
| whitelisted |
google.com |
| whitelisted |
www.bing.com |
| whitelisted |
settings-win.data.microsoft.com |
| whitelisted |
ocsp.digicert.com |
| whitelisted |
login.live.com |
| whitelisted |
go.microsoft.com |
| whitelisted |
slscr.update.microsoft.com |
| whitelisted |
fe3cr.delivery.mp.microsoft.com |
| whitelisted |