plaguebot | f022ce3c1485ac3b9a41bf522bb247a79e85eae66917dc67fcb499d8f4ecf4ff

General

Target

b2f165d8f2b8e90de7618bbd960e2e73900bc7d191590b89d4d833dab8f5475a.exe
Size

971KB
MD5

7c287d9064703d731bd8abd737129b91
SHA1

ef04b7b7e6e0817ec36d5f7bf96912a1cdd9a5c1
SHA256

b2f165d8f2b8e90de7618bbd960e2e73900bc7d191590b89d4d833dab8f5475a
SHA512

a78555736bac0eccfe199271be92d34ff0c533b88fce950740dc142db18436400d9418c16f5d11b92d3dbc9660c26fe8a133c2fe465ba2cad11152ba3d873be7

Score

10^/10

plaguebot botnet

Malware Config

Signatures

PlagueBot
PlagueBot is an open source Bot written in Pascal.
botnet plaguebot

PlagueBot Executable 2 IoCs

resource	yara_rule
behavioral1/files/0x0004000000013157-65.dat	plaguebot
behavioral1/files/0x0004000000013157-69.dat	plaguebot

Executes dropped EXE 1 IoCs

pid	Process
644	svchost

Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
1212	schtasks.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000_Classes\Local Settings	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\MuiCache	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1432	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
1432	AcroRd32.exe
1432	AcroRd32.exe
1432	AcroRd32.exe

Suspicious use of WriteProcessMemory 23 IoCs

description	pid	Process	procid_target
PID 1076 wrote to memory of 1212	1076	b2f165d8f2b8e90de7618bbd960e2e73900bc7d191590b89d4d833dab8f5475a.exe	26
PID 1076 wrote to memory of 1212	1076	b2f165d8f2b8e90de7618bbd960e2e73900bc7d191590b89d4d833dab8f5475a.exe	26
PID 1076 wrote to memory of 1212	1076	b2f165d8f2b8e90de7618bbd960e2e73900bc7d191590b89d4d833dab8f5475a.exe	26
PID 1076 wrote to memory of 1212	1076	b2f165d8f2b8e90de7618bbd960e2e73900bc7d191590b89d4d833dab8f5475a.exe	26
PID 1076 wrote to memory of 1972	1076	b2f165d8f2b8e90de7618bbd960e2e73900bc7d191590b89d4d833dab8f5475a.exe	28
PID 1076 wrote to memory of 1972	1076	b2f165d8f2b8e90de7618bbd960e2e73900bc7d191590b89d4d833dab8f5475a.exe	28
PID 1076 wrote to memory of 1972	1076	b2f165d8f2b8e90de7618bbd960e2e73900bc7d191590b89d4d833dab8f5475a.exe	28
PID 1076 wrote to memory of 1972	1076	b2f165d8f2b8e90de7618bbd960e2e73900bc7d191590b89d4d833dab8f5475a.exe	28
PID 1076 wrote to memory of 1744	1076	b2f165d8f2b8e90de7618bbd960e2e73900bc7d191590b89d4d833dab8f5475a.exe	30
PID 1076 wrote to memory of 1744	1076	b2f165d8f2b8e90de7618bbd960e2e73900bc7d191590b89d4d833dab8f5475a.exe	30
PID 1076 wrote to memory of 1744	1076	b2f165d8f2b8e90de7618bbd960e2e73900bc7d191590b89d4d833dab8f5475a.exe	30
PID 1076 wrote to memory of 1744	1076	b2f165d8f2b8e90de7618bbd960e2e73900bc7d191590b89d4d833dab8f5475a.exe	30
PID 1076 wrote to memory of 1744	1076	b2f165d8f2b8e90de7618bbd960e2e73900bc7d191590b89d4d833dab8f5475a.exe	30
PID 1076 wrote to memory of 1744	1076	b2f165d8f2b8e90de7618bbd960e2e73900bc7d191590b89d4d833dab8f5475a.exe	30
PID 1076 wrote to memory of 1744	1076	b2f165d8f2b8e90de7618bbd960e2e73900bc7d191590b89d4d833dab8f5475a.exe	30
PID 1744 wrote to memory of 1432	1744	rundll32.exe	34
PID 1744 wrote to memory of 1432	1744	rundll32.exe	34
PID 1744 wrote to memory of 1432	1744	rundll32.exe	34
PID 1744 wrote to memory of 1432	1744	rundll32.exe	34
PID 292 wrote to memory of 644	292	taskeng.exe	36
PID 292 wrote to memory of 644	292	taskeng.exe	36
PID 292 wrote to memory of 644	292	taskeng.exe	36
PID 292 wrote to memory of 644	292	taskeng.exe	36

C:\Users\Admin\AppData\Local\Temp\b2f165d8f2b8e90de7618bbd960e2e73900bc7d191590b89d4d833dab8f5475a.exe
"C:\Users\Admin\AppData\Local\Temp\b2f165d8f2b8e90de7618bbd960e2e73900bc7d191590b89d4d833dab8f5475a.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1076
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /Create /TN "WinManager" /XML "C:\Users\Admin\AppData\Local\Temp\NewTask.xml"
  2⤵
  - Creates scheduled task(s)
  PID:1212
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /Query /FO "LIST" /TN "WinManager"
  2⤵
  PID:1972
- C:\Windows\SysWOW64\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Roaming\Windows\svchost
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:1744
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Roaming\Windows\svchost"
    3⤵
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    PID:1432

C:\Windows\system32\taskeng.exe
taskeng.exe {C00F3297-C888-4D40-866D-C1ADB27F04CD} S-1-5-21-2513283230-931923277-594887482-1000:MRBKYMNO\Admin:Interactive:[1]
1⤵
- Suspicious use of WriteProcessMemory
PID:292
- C:\Users\Admin\AppData\Roaming\Windows\svchost
  C:\Users\Admin\AppData\Roaming\Windows\svchost
  2⤵
  - Executes dropped EXE
  PID:644