Overview

overview

10

Static

static

10

0f3c812083...25.exe

windows7_x64

10

0f3c812083...25.exe

windows10-2004_x64

10

Analysis

  • max time kernel
    154s
  • max time network
    157s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220414-en
  • submitted
    04/06/2022, 16:16 UTC

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    0f3c8120834e15002d21e58a743eca4a9475367604fd0b570b9980d719135225.exe

  • Size

    16KB

  • MD5

    4bb1908985f7e7187d48135f7134640d

  • SHA1

    c3de2eb8ae7a6799af8690122c2d9e7b2bf9614e

  • SHA256

    0f3c8120834e15002d21e58a743eca4a9475367604fd0b570b9980d719135225

  • SHA512

    4171ec388da7b40bc1dce787cd13b86f4caa7a84db80e19e3b064c170a3bfb6dfa5e7991da82cf42dc4a765301d13e1186d3ab8eb0db7c1401c8087403cd9017

Score
10/10
loaderbotloaderminerpersistencesuricata

Malware Config

Signatures

  • LoaderBot

    LoaderBot is a loader written in .NET downloading and executing miners.

    loaderminerloaderbot
  • suricata: ET MALWARE Possible Zeus GameOver/FluBot Related DGA NXDOMAIN Responses

    suricata: ET MALWARE Possible Zeus GameOver/FluBot Related DGA NXDOMAIN Responses

    suricata
  • LoaderBot executable 1 IoCs
  • Drops startup file 1 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistence
  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious behavior: RenamesItself 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 6 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\0f3c8120834e15002d21e58a743eca4a9475367604fd0b570b9980d719135225.exe
    "C:\Users\Admin\AppData\Local\Temp\0f3c8120834e15002d21e58a743eca4a9475367604fd0b570b9980d719135225.exe"
    1⤵
    • Drops startup file
    • Adds Run key to start application
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: RenamesItself
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:4532
    • C:\Windows\SysWOW64\cmd.exe
      "cmd" /C schtasks /create /tn \System\SecurityServiceUpdate /tr %userprofile%\AppData\Roaming\Windows\0f3c8120834e15002d21e58a743eca4a9475367604fd0b570b9980d719135225.exe /st 00:00 /du 9999:59 /sc daily /ri 5 /f
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:456
      • C:\Windows\SysWOW64\schtasks.exe
        schtasks /create /tn \System\SecurityServiceUpdate /tr C:\Users\Admin\AppData\Roaming\Windows\0f3c8120834e15002d21e58a743eca4a9475367604fd0b570b9980d719135225.exe /st 00:00 /du 9999:59 /sc daily /ri 5 /f
        3⤵
        • Creates scheduled task(s)
        PID:5036

Network

  • flag-us
    DNS
    moneyhustling.ru
    0f3c8120834e15002d21e58a743eca4a9475367604fd0b570b9980d719135225.exe
    Remote address:
    8.8.8.8:53
    Request
    moneyhustling.ru
    IN A
    Response
  • flag-us
    DNS
    moneyhustling.ru
    0f3c8120834e15002d21e58a743eca4a9475367604fd0b570b9980d719135225.exe
    Remote address:
    8.8.8.8:53
    Request
    moneyhustling.ru
    IN A
    Response
  • flag-us
    DNS
    moneyhustling.ru
    0f3c8120834e15002d21e58a743eca4a9475367604fd0b570b9980d719135225.exe
    Remote address:
    8.8.8.8:53
    Request
    moneyhustling.ru
    IN A
    Response
  • flag-us
    DNS
    moneyhustling.ru
    0f3c8120834e15002d21e58a743eca4a9475367604fd0b570b9980d719135225.exe
    Remote address:
    8.8.8.8:53
    Request
    moneyhustling.ru
    IN A
    Response
  • flag-us
    DNS
    moneyhustling.ru
    0f3c8120834e15002d21e58a743eca4a9475367604fd0b570b9980d719135225.exe
    Remote address:
    8.8.8.8:53
    Request
    moneyhustling.ru
    IN A
    Response
  • flag-us
    DNS
    moneyhustling.ru
    0f3c8120834e15002d21e58a743eca4a9475367604fd0b570b9980d719135225.exe
    Remote address:
    8.8.8.8:53
    Request
    moneyhustling.ru
    IN A
    Response
  • flag-us
    DNS
    moneyhustling.ru
    0f3c8120834e15002d21e58a743eca4a9475367604fd0b570b9980d719135225.exe
    Remote address:
    8.8.8.8:53
    Request
    moneyhustling.ru
    IN A
    Response
  • flag-us
    DNS
    moneyhustling.ru
    0f3c8120834e15002d21e58a743eca4a9475367604fd0b570b9980d719135225.exe
    Remote address:
    8.8.8.8:53
    Request
    moneyhustling.ru
    IN A
    Response
  • flag-us
    DNS
    moneyhustling.ru
    0f3c8120834e15002d21e58a743eca4a9475367604fd0b570b9980d719135225.exe
    Remote address:
    8.8.8.8:53
    Request
    moneyhustling.ru
    IN A
    Response
  • flag-us
    DNS
    moneyhustling.ru
    0f3c8120834e15002d21e58a743eca4a9475367604fd0b570b9980d719135225.exe
    Remote address:
    8.8.8.8:53
    Request
    moneyhustling.ru
    IN A
    Response
  • flag-us
    DNS
    moneyhustling.ru
    0f3c8120834e15002d21e58a743eca4a9475367604fd0b570b9980d719135225.exe
    Remote address:
    8.8.8.8:53
    Request
    moneyhustling.ru
    IN A
    Response
  • flag-us
    DNS
    moneyhustling.ru
    0f3c8120834e15002d21e58a743eca4a9475367604fd0b570b9980d719135225.exe
    Remote address:
    8.8.8.8:53
    Request
    moneyhustling.ru
    IN A
    Response
  • flag-us
    DNS
    moneyhustling.ru
    0f3c8120834e15002d21e58a743eca4a9475367604fd0b570b9980d719135225.exe
    Remote address:
    8.8.8.8:53
    Request
    moneyhustling.ru
    IN A
    Response
  • flag-us
    DNS
    moneyhustling.ru
    0f3c8120834e15002d21e58a743eca4a9475367604fd0b570b9980d719135225.exe
    Remote address:
    8.8.8.8:53
    Request
    moneyhustling.ru
    IN A
    Response
  • flag-us
    DNS
    moneyhustling.ru
    0f3c8120834e15002d21e58a743eca4a9475367604fd0b570b9980d719135225.exe
    Remote address:
    8.8.8.8:53
    Request
    moneyhustling.ru
    IN A
    Response
  • flag-us
    DNS
    moneyhustling.ru
    0f3c8120834e15002d21e58a743eca4a9475367604fd0b570b9980d719135225.exe
    Remote address:
    8.8.8.8:53
    Request
    moneyhustling.ru
    IN A
    Response
  • flag-us
    DNS
    moneyhustling.ru
    0f3c8120834e15002d21e58a743eca4a9475367604fd0b570b9980d719135225.exe
    Remote address:
    8.8.8.8:53
    Request
    moneyhustling.ru
    IN A
    Response
  • flag-us
    DNS
    moneyhustling.ru
    0f3c8120834e15002d21e58a743eca4a9475367604fd0b570b9980d719135225.exe
    Remote address:
    8.8.8.8:53
    Request
    moneyhustling.ru
    IN A
    Response
  • flag-us
    DNS
    moneyhustling.ru
    0f3c8120834e15002d21e58a743eca4a9475367604fd0b570b9980d719135225.exe
    Remote address:
    8.8.8.8:53
    Request
    moneyhustling.ru
    IN A
    Response
  • flag-us
    DNS
    moneyhustling.ru
    0f3c8120834e15002d21e58a743eca4a9475367604fd0b570b9980d719135225.exe
    Remote address:
    8.8.8.8:53
    Request
    moneyhustling.ru
    IN A
    Response
  • flag-us
    DNS
    moneyhustling.ru
    0f3c8120834e15002d21e58a743eca4a9475367604fd0b570b9980d719135225.exe
    Remote address:
    8.8.8.8:53
    Request
    moneyhustling.ru
    IN A
    Response
  • flag-us
    DNS
    moneyhustling.ru
    0f3c8120834e15002d21e58a743eca4a9475367604fd0b570b9980d719135225.exe
    Remote address:
    8.8.8.8:53
    Request
    moneyhustling.ru
    IN A
    Response
  • flag-us
    DNS
    moneyhustling.ru
    0f3c8120834e15002d21e58a743eca4a9475367604fd0b570b9980d719135225.exe
    Remote address:
    8.8.8.8:53
    Request
    moneyhustling.ru
    IN A
    Response
  • flag-us
    DNS
    moneyhustling.ru
    0f3c8120834e15002d21e58a743eca4a9475367604fd0b570b9980d719135225.exe
    Remote address:
    8.8.8.8:53
    Request
    moneyhustling.ru
    IN A
    Response
  • flag-us
    DNS
    moneyhustling.ru
    0f3c8120834e15002d21e58a743eca4a9475367604fd0b570b9980d719135225.exe
    Remote address:
    8.8.8.8:53
    Request
    moneyhustling.ru
    IN A
    Response
  • flag-us
    DNS
    moneyhustling.ru
    0f3c8120834e15002d21e58a743eca4a9475367604fd0b570b9980d719135225.exe
    Remote address:
    8.8.8.8:53
    Request
    moneyhustling.ru
    IN A
    Response
  • flag-us
    DNS
    moneyhustling.ru
    0f3c8120834e15002d21e58a743eca4a9475367604fd0b570b9980d719135225.exe
    Remote address:
    8.8.8.8:53
    Request
    moneyhustling.ru
    IN A
    Response
  • flag-us
    DNS
    moneyhustling.ru
    0f3c8120834e15002d21e58a743eca4a9475367604fd0b570b9980d719135225.exe
    Remote address:
    8.8.8.8:53
    Request
    moneyhustling.ru
    IN A
    Response
  • flag-us
    DNS
    moneyhustling.ru
    0f3c8120834e15002d21e58a743eca4a9475367604fd0b570b9980d719135225.exe
    Remote address:
    8.8.8.8:53
    Request
    moneyhustling.ru
    IN A
    Response
  • flag-us
    DNS
    moneyhustling.ru
    0f3c8120834e15002d21e58a743eca4a9475367604fd0b570b9980d719135225.exe
    Remote address:
    8.8.8.8:53
    Request
    moneyhustling.ru
    IN A
    Response
  • flag-us
    DNS
    moneyhustling.ru
    0f3c8120834e15002d21e58a743eca4a9475367604fd0b570b9980d719135225.exe
    Remote address:
    8.8.8.8:53
    Request
    moneyhustling.ru
    IN A
    Response
  • flag-us
    DNS
    moneyhustling.ru
    0f3c8120834e15002d21e58a743eca4a9475367604fd0b570b9980d719135225.exe
    Remote address:
    8.8.8.8:53
    Request
    moneyhustling.ru
    IN A
    Response
  • flag-us
    DNS
    moneyhustling.ru
    0f3c8120834e15002d21e58a743eca4a9475367604fd0b570b9980d719135225.exe
    Remote address:
    8.8.8.8:53
    Request
    moneyhustling.ru
    IN A
    Response
  • flag-us
    DNS
    moneyhustling.ru
    0f3c8120834e15002d21e58a743eca4a9475367604fd0b570b9980d719135225.exe
    Remote address:
    8.8.8.8:53
    Request
    moneyhustling.ru
    IN A
    Response
  • flag-us
    DNS
    moneyhustling.ru
    0f3c8120834e15002d21e58a743eca4a9475367604fd0b570b9980d719135225.exe
    Remote address:
    8.8.8.8:53
    Request
    moneyhustling.ru
    IN A
    Response
  • 13.107.21.200:443
    www.bing.com
    tls, https
    2.8kB
     8.6kB
     19
    19
  • 93.184.220.29:80
    322 B
     7
  • 104.110.191.140:80
    322 B
     7
  • 20.42.65.89:443
    322 B
     7
  • 104.110.191.133:80
    322 B
     7
  • 104.110.191.133:80
    322 B
     7
  • 104.110.191.133:80
    322 B
     7
  • 8.8.8.8:53
    moneyhustling.ru
    dns
    0f3c8120834e15002d21e58a743eca4a9475367604fd0b570b9980d719135225.exe
    186 B
     308 B
     3
    3

    DNS Request

    moneyhustling.ru

    DNS Request

    moneyhustling.ru

    DNS Request

    moneyhustling.ru

  • 8.8.8.8:53
    moneyhustling.ru
    dns
    0f3c8120834e15002d21e58a743eca4a9475367604fd0b570b9980d719135225.exe
    62 B
     123 B
     1
    1

    DNS Request

    moneyhustling.ru

  • 8.8.8.8:53
    moneyhustling.ru
    dns
    0f3c8120834e15002d21e58a743eca4a9475367604fd0b570b9980d719135225.exe
    62 B
     123 B
     1
    1

    DNS Request

    moneyhustling.ru

  • 8.8.8.8:53
    moneyhustling.ru
    dns
    0f3c8120834e15002d21e58a743eca4a9475367604fd0b570b9980d719135225.exe
    62 B
     123 B
     1
    1

    DNS Request

    moneyhustling.ru

  • 8.8.8.8:53
    moneyhustling.ru
    dns
    0f3c8120834e15002d21e58a743eca4a9475367604fd0b570b9980d719135225.exe
    62 B
     123 B
     1
    1

    DNS Request

    moneyhustling.ru

  • 8.8.8.8:53
    moneyhustling.ru
    dns
    0f3c8120834e15002d21e58a743eca4a9475367604fd0b570b9980d719135225.exe
    186 B
     308 B
     3
    3

    DNS Request

    moneyhustling.ru

    DNS Request

    moneyhustling.ru

    DNS Request

    moneyhustling.ru

  • 8.8.8.8:53
    moneyhustling.ru
    dns
    0f3c8120834e15002d21e58a743eca4a9475367604fd0b570b9980d719135225.exe
    124 B
     185 B
     2
    2

    DNS Request

    moneyhustling.ru

    DNS Request

    moneyhustling.ru

  • 8.8.8.8:53
    moneyhustling.ru
    dns
    0f3c8120834e15002d21e58a743eca4a9475367604fd0b570b9980d719135225.exe
    62 B
     123 B
     1
    1

    DNS Request

    moneyhustling.ru

  • 8.8.8.8:53
    moneyhustling.ru
    dns
    0f3c8120834e15002d21e58a743eca4a9475367604fd0b570b9980d719135225.exe
    62 B
     123 B
     1
    1

    DNS Request

    moneyhustling.ru

  • 8.8.8.8:53
    moneyhustling.ru
    dns
    0f3c8120834e15002d21e58a743eca4a9475367604fd0b570b9980d719135225.exe
    62 B
     123 B
     1
    1

    DNS Request

    moneyhustling.ru

  • 8.8.8.8:53
    moneyhustling.ru
    dns
    0f3c8120834e15002d21e58a743eca4a9475367604fd0b570b9980d719135225.exe
    62 B
     123 B
     1
    1

    DNS Request

    moneyhustling.ru

  • 8.8.8.8:53
    moneyhustling.ru
    dns
    0f3c8120834e15002d21e58a743eca4a9475367604fd0b570b9980d719135225.exe
    62 B
     123 B
     1
    1

    DNS Request

    moneyhustling.ru

  • 8.8.8.8:53
    moneyhustling.ru
    dns
    0f3c8120834e15002d21e58a743eca4a9475367604fd0b570b9980d719135225.exe
    62 B
     123 B
     1
    1

    DNS Request

    moneyhustling.ru

  • 8.8.8.8:53
    moneyhustling.ru
    dns
    0f3c8120834e15002d21e58a743eca4a9475367604fd0b570b9980d719135225.exe
    62 B
     123 B
     1
    1

    DNS Request

    moneyhustling.ru

  • 8.8.8.8:53
    moneyhustling.ru
    dns
    0f3c8120834e15002d21e58a743eca4a9475367604fd0b570b9980d719135225.exe
    62 B
     123 B
     1
    1

    DNS Request

    moneyhustling.ru

  • 8.8.8.8:53
    moneyhustling.ru
    dns
    0f3c8120834e15002d21e58a743eca4a9475367604fd0b570b9980d719135225.exe
    62 B
     123 B
     1
    1

    DNS Request

    moneyhustling.ru

  • 8.8.8.8:53
    moneyhustling.ru
    dns
    0f3c8120834e15002d21e58a743eca4a9475367604fd0b570b9980d719135225.exe
    186 B
     369 B
     3
    3

    DNS Request

    moneyhustling.ru

    DNS Request

    moneyhustling.ru

    DNS Request

    moneyhustling.ru

  • 8.8.8.8:53
    moneyhustling.ru
    dns
    0f3c8120834e15002d21e58a743eca4a9475367604fd0b570b9980d719135225.exe
    62 B
     123 B
     1
    1

    DNS Request

    moneyhustling.ru

  • 8.8.8.8:53
    moneyhustling.ru
    dns
    0f3c8120834e15002d21e58a743eca4a9475367604fd0b570b9980d719135225.exe
    62 B
     123 B
     1
    1

    DNS Request

    moneyhustling.ru

  • 8.8.8.8:53
    moneyhustling.ru
    dns
    0f3c8120834e15002d21e58a743eca4a9475367604fd0b570b9980d719135225.exe
    62 B
     123 B
     1
    1

    DNS Request

    moneyhustling.ru

  • 8.8.8.8:53
    moneyhustling.ru
    dns
    0f3c8120834e15002d21e58a743eca4a9475367604fd0b570b9980d719135225.exe
    62 B
     123 B
     1
    1

    DNS Request

    moneyhustling.ru

  • 8.8.8.8:53
    moneyhustling.ru
    dns
    0f3c8120834e15002d21e58a743eca4a9475367604fd0b570b9980d719135225.exe
    62 B
     123 B
     1
    1

    DNS Request

    moneyhustling.ru

  • 8.8.8.8:53
    moneyhustling.ru
    dns
    0f3c8120834e15002d21e58a743eca4a9475367604fd0b570b9980d719135225.exe
    62 B
     123 B
     1
    1

    DNS Request

    moneyhustling.ru

  • 8.8.8.8:53
    moneyhustling.ru
    dns
    0f3c8120834e15002d21e58a743eca4a9475367604fd0b570b9980d719135225.exe
    62 B
     123 B
     1
    1

    DNS Request

    moneyhustling.ru

  • 8.8.8.8:53
    moneyhustling.ru
    dns
    0f3c8120834e15002d21e58a743eca4a9475367604fd0b570b9980d719135225.exe
    62 B
     123 B
     1
    1

    DNS Request

    moneyhustling.ru

  • 8.8.8.8:53
    moneyhustling.ru
    dns
    0f3c8120834e15002d21e58a743eca4a9475367604fd0b570b9980d719135225.exe
    62 B
     123 B
     1
    1

    DNS Request

    moneyhustling.ru

  • 8.8.8.8:53
    moneyhustling.ru
    dns
    0f3c8120834e15002d21e58a743eca4a9475367604fd0b570b9980d719135225.exe
    62 B
     123 B
     1
    1

    DNS Request

    moneyhustling.ru

  • 8.8.8.8:53
    moneyhustling.ru
    dns
    0f3c8120834e15002d21e58a743eca4a9475367604fd0b570b9980d719135225.exe
    62 B
     123 B
     1
    1

    DNS Request

    moneyhustling.ru

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/4532-131-0x0000000000D20000-0x0000000000D2A000-memory.dmp

    Filesize

    40KB

    Download

  • memory/4532-134-0x0000000005A50000-0x0000000005AB6000-memory.dmp

    Filesize

    408KB

    Download

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.