Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows10_x64 -
resource
win10-20220223-en -
submitted
12-04-2022 07:45
General
-
Target
c8da163b0c84637e8e40fb15add10d77ef3853af773f88bec56ff5a03c40e5ad.exe
-
Size
3.8MB
-
MD5
bcaaf37e0beb6717d01b175e6bc78c44
-
SHA1
6ed8bd63cca483dd9e8bd742fd79d76bc87beccc
-
SHA256
c8da163b0c84637e8e40fb15add10d77ef3853af773f88bec56ff5a03c40e5ad
-
SHA512
481fd0295bb83951efac8b6c67d94ef5bee0255258855f16b103f6b846813f27ef697cddde12b3fc5b2b956de94cdb6dbba10a525fa617c6ef91180f0b690b9f
Malware Config
Signatures
-
LoaderBot
LoaderBot is a loader written in .NET downloading and executing miners.
-
LoaderBot executable 3 IoCs
-
Downloads MZ/PE file
-
Executes dropped EXE 2 IoCs
-
Drops startup file 1 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: LoadsDriver 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 4 IoCs
-
Suspicious use of WriteProcessMemory 5 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\c8da163b0c84637e8e40fb15add10d77ef3853af773f88bec56ff5a03c40e5ad.exe"C:\Users\Admin\AppData\Local\Temp\c8da163b0c84637e8e40fb15add10d77ef3853af773f88bec56ff5a03c40e5ad.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\ProgramData\MinerFull.exe"C:\ProgramData\MinerFull.exe"2⤵
- Executes dropped EXE
- Drops startup file
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe"C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe" -o pool.supportxmr.com:3333 -u 45XQiu9A9vmVd5Cy6X35M12NocUr2Hx69X4ZNNu2BsKJYkdksefg2gXJyvBUeEJyDWTfLD6GWmAu4Tab1w4tycfcFMqy8yH -p x -k -v=0 --donate-level=1 -t 13⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4.0MB
MD55c7bc4cc56f6e6acb801210bc6eda798
SHA1541b6f50091fdc17c2bc8d596c0e202b854fb991
SHA25648f66e13c00038bb2ec12a58bd34cb79f2cf616230c25224c68b81d6c3d7ebf9
SHA51266558bf8679c264c507a1fb8da2fd81347b339d3786487895f902330d63bf9b44be5a136061b0848801b768fea3e525b934d1b04c2cef959cc878b421c6cbd5d
-
Filesize
4.0MB
MD55c7bc4cc56f6e6acb801210bc6eda798
SHA1541b6f50091fdc17c2bc8d596c0e202b854fb991
SHA25648f66e13c00038bb2ec12a58bd34cb79f2cf616230c25224c68b81d6c3d7ebf9
SHA51266558bf8679c264c507a1fb8da2fd81347b339d3786487895f902330d63bf9b44be5a136061b0848801b768fea3e525b934d1b04c2cef959cc878b421c6cbd5d
-
Filesize
3.9MB
MD502569a7a91a71133d4a1023bf32aa6f4
SHA10f16bcb3f3f085d3d3be912195558e9f9680d574
SHA2568d6abba9b216172cfc64b8802db0d20a1c634c96e1049f451eddba2363966bf0
SHA512534be1fe93ee556a14cfd8fad5377f57fb056ab4cd2bca14e4f376f4a25d3d4d270917d68a90b3c40d8a8daaeba6f592fa095ecff478332ba23405d1df728322
-
Filesize
3.9MB
MD502569a7a91a71133d4a1023bf32aa6f4
SHA10f16bcb3f3f085d3d3be912195558e9f9680d574
SHA2568d6abba9b216172cfc64b8802db0d20a1c634c96e1049f451eddba2363966bf0
SHA512534be1fe93ee556a14cfd8fad5377f57fb056ab4cd2bca14e4f376f4a25d3d4d270917d68a90b3c40d8a8daaeba6f592fa095ecff478332ba23405d1df728322
-
Filesize
4.0MB
-
Filesize
408KB
-
Filesize
392KB
-
Filesize
8KB
-
Filesize
80KB
-
Filesize
256.0MB