Analysis
-
max time kernel
105s -
max time network
149s -
platform
windows10_x64 -
resource
win10-20220310-en -
submitted
23-03-2022 06:26
Static task
static1
Behavioral task
behavioral1
Sample
e51c910e8f967fc22355da0831a34eb2098de0dfab59e37a8b41f839e61893ed.exe
Resource
win10-20220310-en
windows10_x64
0 signatures
0 seconds
General
-
Target
e51c910e8f967fc22355da0831a34eb2098de0dfab59e37a8b41f839e61893ed.exe
-
Size
4.0MB
-
MD5
5764a0ba65261a254e96b1b9ab512e70
-
SHA1
046230107e56c772044c59c010eca6c7cda61a10
-
SHA256
e51c910e8f967fc22355da0831a34eb2098de0dfab59e37a8b41f839e61893ed
-
SHA512
73d4f6b958c160d9e85f88f0b19af939306a3357739861b205d44907e7e4b656307bb2cd48bafe84dd77527a4092229b8823f7f1f4dadad9c6966ec77df19630
Score
10/10
Malware Config
Signatures
-
LoaderBot executable 1 IoCs
resource yara_rule behavioral1/memory/1604-118-0x0000000000580000-0x000000000097E000-memory.dmp loaderbot -
Executes dropped EXE 1 IoCs
pid Process 3808 Driver.exe -
Drops startup file 1 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Driver.url e51c910e8f967fc22355da0831a34eb2098de0dfab59e37a8b41f839e61893ed.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-370654639-3807403165-1443644579-1000\Software\Microsoft\Windows\CurrentVersion\Run\Driver = "C:\\Users\\Admin\\AppData\\Roaming\\Sysfiles\\e51c910e8f967fc22355da0831a34eb2098de0dfab59e37a8b41f839e61893ed.exe" e51c910e8f967fc22355da0831a34eb2098de0dfab59e37a8b41f839e61893ed.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1604 e51c910e8f967fc22355da0831a34eb2098de0dfab59e37a8b41f839e61893ed.exe 1604 e51c910e8f967fc22355da0831a34eb2098de0dfab59e37a8b41f839e61893ed.exe 1604 e51c910e8f967fc22355da0831a34eb2098de0dfab59e37a8b41f839e61893ed.exe 1604 e51c910e8f967fc22355da0831a34eb2098de0dfab59e37a8b41f839e61893ed.exe 1604 e51c910e8f967fc22355da0831a34eb2098de0dfab59e37a8b41f839e61893ed.exe 1604 e51c910e8f967fc22355da0831a34eb2098de0dfab59e37a8b41f839e61893ed.exe 1604 e51c910e8f967fc22355da0831a34eb2098de0dfab59e37a8b41f839e61893ed.exe 1604 e51c910e8f967fc22355da0831a34eb2098de0dfab59e37a8b41f839e61893ed.exe 1604 e51c910e8f967fc22355da0831a34eb2098de0dfab59e37a8b41f839e61893ed.exe 1604 e51c910e8f967fc22355da0831a34eb2098de0dfab59e37a8b41f839e61893ed.exe 1604 e51c910e8f967fc22355da0831a34eb2098de0dfab59e37a8b41f839e61893ed.exe 1604 e51c910e8f967fc22355da0831a34eb2098de0dfab59e37a8b41f839e61893ed.exe 1604 e51c910e8f967fc22355da0831a34eb2098de0dfab59e37a8b41f839e61893ed.exe 1604 e51c910e8f967fc22355da0831a34eb2098de0dfab59e37a8b41f839e61893ed.exe 1604 e51c910e8f967fc22355da0831a34eb2098de0dfab59e37a8b41f839e61893ed.exe 1604 e51c910e8f967fc22355da0831a34eb2098de0dfab59e37a8b41f839e61893ed.exe 1604 e51c910e8f967fc22355da0831a34eb2098de0dfab59e37a8b41f839e61893ed.exe 1604 e51c910e8f967fc22355da0831a34eb2098de0dfab59e37a8b41f839e61893ed.exe 1604 e51c910e8f967fc22355da0831a34eb2098de0dfab59e37a8b41f839e61893ed.exe 1604 e51c910e8f967fc22355da0831a34eb2098de0dfab59e37a8b41f839e61893ed.exe 1604 e51c910e8f967fc22355da0831a34eb2098de0dfab59e37a8b41f839e61893ed.exe 1604 e51c910e8f967fc22355da0831a34eb2098de0dfab59e37a8b41f839e61893ed.exe 1604 e51c910e8f967fc22355da0831a34eb2098de0dfab59e37a8b41f839e61893ed.exe 1604 e51c910e8f967fc22355da0831a34eb2098de0dfab59e37a8b41f839e61893ed.exe 1604 e51c910e8f967fc22355da0831a34eb2098de0dfab59e37a8b41f839e61893ed.exe 1604 e51c910e8f967fc22355da0831a34eb2098de0dfab59e37a8b41f839e61893ed.exe 1604 e51c910e8f967fc22355da0831a34eb2098de0dfab59e37a8b41f839e61893ed.exe 1604 e51c910e8f967fc22355da0831a34eb2098de0dfab59e37a8b41f839e61893ed.exe 1604 e51c910e8f967fc22355da0831a34eb2098de0dfab59e37a8b41f839e61893ed.exe 1604 e51c910e8f967fc22355da0831a34eb2098de0dfab59e37a8b41f839e61893ed.exe 1604 e51c910e8f967fc22355da0831a34eb2098de0dfab59e37a8b41f839e61893ed.exe 1604 e51c910e8f967fc22355da0831a34eb2098de0dfab59e37a8b41f839e61893ed.exe 1604 e51c910e8f967fc22355da0831a34eb2098de0dfab59e37a8b41f839e61893ed.exe 1604 e51c910e8f967fc22355da0831a34eb2098de0dfab59e37a8b41f839e61893ed.exe 1604 e51c910e8f967fc22355da0831a34eb2098de0dfab59e37a8b41f839e61893ed.exe 1604 e51c910e8f967fc22355da0831a34eb2098de0dfab59e37a8b41f839e61893ed.exe 1604 e51c910e8f967fc22355da0831a34eb2098de0dfab59e37a8b41f839e61893ed.exe 1604 e51c910e8f967fc22355da0831a34eb2098de0dfab59e37a8b41f839e61893ed.exe 1604 e51c910e8f967fc22355da0831a34eb2098de0dfab59e37a8b41f839e61893ed.exe 1604 e51c910e8f967fc22355da0831a34eb2098de0dfab59e37a8b41f839e61893ed.exe 1604 e51c910e8f967fc22355da0831a34eb2098de0dfab59e37a8b41f839e61893ed.exe 1604 e51c910e8f967fc22355da0831a34eb2098de0dfab59e37a8b41f839e61893ed.exe 1604 e51c910e8f967fc22355da0831a34eb2098de0dfab59e37a8b41f839e61893ed.exe 1604 e51c910e8f967fc22355da0831a34eb2098de0dfab59e37a8b41f839e61893ed.exe 1604 e51c910e8f967fc22355da0831a34eb2098de0dfab59e37a8b41f839e61893ed.exe 1604 e51c910e8f967fc22355da0831a34eb2098de0dfab59e37a8b41f839e61893ed.exe 1604 e51c910e8f967fc22355da0831a34eb2098de0dfab59e37a8b41f839e61893ed.exe 1604 e51c910e8f967fc22355da0831a34eb2098de0dfab59e37a8b41f839e61893ed.exe 1604 e51c910e8f967fc22355da0831a34eb2098de0dfab59e37a8b41f839e61893ed.exe 1604 e51c910e8f967fc22355da0831a34eb2098de0dfab59e37a8b41f839e61893ed.exe 1604 e51c910e8f967fc22355da0831a34eb2098de0dfab59e37a8b41f839e61893ed.exe 1604 e51c910e8f967fc22355da0831a34eb2098de0dfab59e37a8b41f839e61893ed.exe 1604 e51c910e8f967fc22355da0831a34eb2098de0dfab59e37a8b41f839e61893ed.exe 1604 e51c910e8f967fc22355da0831a34eb2098de0dfab59e37a8b41f839e61893ed.exe 1604 e51c910e8f967fc22355da0831a34eb2098de0dfab59e37a8b41f839e61893ed.exe 1604 e51c910e8f967fc22355da0831a34eb2098de0dfab59e37a8b41f839e61893ed.exe 1604 e51c910e8f967fc22355da0831a34eb2098de0dfab59e37a8b41f839e61893ed.exe 1604 e51c910e8f967fc22355da0831a34eb2098de0dfab59e37a8b41f839e61893ed.exe 1604 e51c910e8f967fc22355da0831a34eb2098de0dfab59e37a8b41f839e61893ed.exe 1604 e51c910e8f967fc22355da0831a34eb2098de0dfab59e37a8b41f839e61893ed.exe 1604 e51c910e8f967fc22355da0831a34eb2098de0dfab59e37a8b41f839e61893ed.exe 1604 e51c910e8f967fc22355da0831a34eb2098de0dfab59e37a8b41f839e61893ed.exe 1604 e51c910e8f967fc22355da0831a34eb2098de0dfab59e37a8b41f839e61893ed.exe 1604 e51c910e8f967fc22355da0831a34eb2098de0dfab59e37a8b41f839e61893ed.exe -
Suspicious behavior: LoadsDriver 1 IoCs
pid Process 636 Process not Found -
Suspicious behavior: RenamesItself 1 IoCs
pid Process 1604 e51c910e8f967fc22355da0831a34eb2098de0dfab59e37a8b41f839e61893ed.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeDebugPrivilege 1604 e51c910e8f967fc22355da0831a34eb2098de0dfab59e37a8b41f839e61893ed.exe Token: SeLockMemoryPrivilege 3808 Driver.exe Token: SeLockMemoryPrivilege 3808 Driver.exe -
Suspicious use of WriteProcessMemory 2 IoCs
description pid Process procid_target PID 1604 wrote to memory of 3808 1604 e51c910e8f967fc22355da0831a34eb2098de0dfab59e37a8b41f839e61893ed.exe 72 PID 1604 wrote to memory of 3808 1604 e51c910e8f967fc22355da0831a34eb2098de0dfab59e37a8b41f839e61893ed.exe 72
Processes
-
C:\Users\Admin\AppData\Local\Temp\e51c910e8f967fc22355da0831a34eb2098de0dfab59e37a8b41f839e61893ed.exe"C:\Users\Admin\AppData\Local\Temp\e51c910e8f967fc22355da0831a34eb2098de0dfab59e37a8b41f839e61893ed.exe"1⤵
- Drops startup file
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1604 -
C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe"C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe" -o pool.supportxmr.com:3333 -u 43jBZnWZEhj6mKihLj6iKcdpma7ok16T4Kn52V6S2JfFceM2s8ZQmezZDvDVCx4aHdEf3apd6GaYK9zMYnnun8CGHmtmc4z -p x -k -v=0 --donate-level=1 -t 12⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3808
-