Analysis
-
max time kernel
151s -
max time network
121s -
platform
windows10_x64 -
resource
win10-en-20211208 -
submitted
05/01/2022, 14:45
General
-
Target
58eb4a506ed5299ddde9ed4a720796849b1de79fe939cd75feff353557d03b03.exe
-
Size
2.3MB
-
MD5
6e36f2949030dc1dfc452656c453bce9
-
SHA1
2889981168c1b3537cd00c98d49b2b7fc48f8075
-
SHA256
58eb4a506ed5299ddde9ed4a720796849b1de79fe939cd75feff353557d03b03
-
SHA512
2baf28ee9a66f3cf04efc725c8af8a7a858f28d11f23d29627562f0459c12a4fc515b1e69e2c81cbfd62f1fb51b17d092494672b25f6f2299810e8a68250bc84
Score
10/10
Malware Config
Signatures
-
LoaderBot
LoaderBot is a loader written in .NET downloading and executing miners.
-
LoaderBot executable 3 IoCs
-
Executes dropped EXE 1 IoCs
-
Drops startup file 1 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: LoadsDriver 1 IoCs
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 3 IoCs
-
Suspicious use of WriteProcessMemory 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\58eb4a506ed5299ddde9ed4a720796849b1de79fe939cd75feff353557d03b03.exe"C:\Users\Admin\AppData\Local\Temp\58eb4a506ed5299ddde9ed4a720796849b1de79fe939cd75feff353557d03b03.exe"1⤵
- Drops startup file
- Adds Run key to start application
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe"C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe" -o pool.supportxmr.com:3333 -u 88Tr2gg1S3gSbo5pMPCkeZDzr99uKjyu3RmaVqbvnQSzMp215cHmzvTBsofyDqaJ8qCf7wjbpeHigDbUwwaXdbYvAio1Up7 -p x -k -v=0 --donate-level=1 -t 12⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
964KB
-
Filesize
19.3MB
-
Filesize
4.4MB
-
Filesize
4.4MB
-
Filesize
4.4MB
-
Filesize
512KB
-
Filesize
5.5MB
-
Filesize
276KB
-
Filesize
408KB
-
Filesize
4KB
-
Filesize
1.8MB
-
Filesize
4KB
-
Filesize
80KB
-
Filesize
128KB
-
Filesize
128KB