loaderbot | ae250ad99101e7ab0de7cc7b6f163571f4774a6c7e1c89eaa5f23321728d6f7e

General

Target

ae250ad99101e7ab0de7cc7b6f163571f4774a6c7e1c89eaa5f23321728d6f7e.exe
Size

4.7MB
MD5

80e7f3b3141de3958293e950eb893c20
SHA1

a505d8e3e03030c163cb1287e02be2b7e46933aa
SHA256

ae250ad99101e7ab0de7cc7b6f163571f4774a6c7e1c89eaa5f23321728d6f7e
SHA512

bf2d5e31306830ae86eda1b1a99b655896e039893018d97af639342e247562f63675ce602c971fb796326eaaddd768e1fa95a028e01d60439b28bf2153a735ad

Score

10^/10

loaderbot loader miner persistence

Malware Config

Signatures

LoaderBot
LoaderBot is a loader written in .NET downloading and executing miners.
loader miner loaderbot

LoaderBot executable 1 IoCs

resource	yara_rule
behavioral2/memory/2912-130-0x00000000007E0000-0x0000000000C90000-memory.dmp	loaderbot

Drops startup file 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Driver.url	ae250ad99101e7ab0de7cc7b6f163571f4774a6c7e1c89eaa5f23321728d6f7e.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Driver = "C:\\Users\\Admin\\AppData\\Roaming\\Sysfiles\\ae250ad99101e7ab0de7cc7b6f163571f4774a6c7e1c89eaa5f23321728d6f7e.exe"	ae250ad99101e7ab0de7cc7b6f163571f4774a6c7e1c89eaa5f23321728d6f7e.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 5 IoCs

pid	Process
2912	ae250ad99101e7ab0de7cc7b6f163571f4774a6c7e1c89eaa5f23321728d6f7e.exe
2912	ae250ad99101e7ab0de7cc7b6f163571f4774a6c7e1c89eaa5f23321728d6f7e.exe
2912	ae250ad99101e7ab0de7cc7b6f163571f4774a6c7e1c89eaa5f23321728d6f7e.exe
2912	ae250ad99101e7ab0de7cc7b6f163571f4774a6c7e1c89eaa5f23321728d6f7e.exe
2912	ae250ad99101e7ab0de7cc7b6f163571f4774a6c7e1c89eaa5f23321728d6f7e.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
2912	ae250ad99101e7ab0de7cc7b6f163571f4774a6c7e1c89eaa5f23321728d6f7e.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2912	ae250ad99101e7ab0de7cc7b6f163571f4774a6c7e1c89eaa5f23321728d6f7e.exe

C:\Users\Admin\AppData\Local\Temp\ae250ad99101e7ab0de7cc7b6f163571f4774a6c7e1c89eaa5f23321728d6f7e.exe
"C:\Users\Admin\AppData\Local\Temp\ae250ad99101e7ab0de7cc7b6f163571f4774a6c7e1c89eaa5f23321728d6f7e.exe"
1⤵
- Drops startup file
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of AdjustPrivilegeToken
PID:2912
- C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe
  "C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe" -o 194.87.238.198:77 -u -p x -k -v=0 --donate-level=1 -t 1
  2⤵
  PID:4292

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe

Filesize
20KB

MD5
0abdbb0ea120de0af54c53506b74f5f1

SHA1
e7712b49dc93efdb21d7d4cb76b37b7dc51d56f7

SHA256
006eb42234129f17f25b53ae53a981ca95520a8f8fd05767614e4fb546bf557a

SHA512
20fc058d0e879e3b07ba5868d5005f8c336b01bf94ff65b263a3b066685dd5660b678dd971783999a38c8ee6abf057a2a258589f18670b425f884145941e3b5d

Download Submit
C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe

Filesize
20KB

MD5
e9515a5b3c4495ce81310ee581fd3540

SHA1
f3bf2fc9b89cfbe14fdb765147cc66c7d4250fed

SHA256
73aabff47b5b559dfa4fb45769f379db22ea22bbb35b44dd0aeba2f7f0675577

SHA512
3a192fccd15b37db9df94b8797b19853ab9d8160ba9b9302de929a84ffbfc905bae366dd6bf625adc6898e81d0f49760c789fe8c535c4f2fdeba0ac9d4f1c11a

Download Submit
memory/2912-130-0x00000000007E0000-0x0000000000C90000-memory.dmp

Filesize
4.7MB

Download
memory/2912-131-0x0000000005960000-0x00000000059C6000-memory.dmp

Filesize
408KB

Download
memory/4292-135-0x00000000001D0000-0x00000000001E0000-memory.dmp

Filesize
64KB

Download

Analysis

Sharing