loaderbot | 3f92251c61010466cd2cd14846a6f4bde4054e8cf5c93e9cf576c603bead7ea2

General

Target
3f92251c61010466cd2cd14846a6f4bde4054e8cf5c93e9cf576c603bead7ea2.exe
Size 16KB
Sample220701-adx6hsddgm
SHA256 3f92251c61010466cd2cd14846a6f4bde4054e8cf5c93e9cf576c603bead7ea2
MD5 b5099869ad42589763e1cfb0d6c02080
SHA1 36e8b076e80b3e92b753e476fb4d73c2d68997d1
SHA512 f5688d69ce280176d5abb00f04c68e5ef714d0436d6380447cfb8fd0155bed8081021ac566c327aef9aeac42954111596f7216b677c2a7709dd42742d1ffaf6f
MD5 SHA1 SHA512

Score

10^/10

LoaderBot
LoaderBot is a loader written in .NET downloading and executing miners.
loader miner loaderbot

LoaderBot executable 1 IoCs

resource	yara_rule
behavioral2/memory/2540-131-0x0000000000EF0000-0x0000000000EFA000-memory.dmp	loaderbot

Drops startup file 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Webhost.url	3f92251c61010466cd2cd14846a6f4bde4054e8cf5c93e9cf576c603bead7ea2.exe

Adds Run key to start application 2 TTPs 2 IoCs

Registry Run Keys / Startup Folder

Modify Registry

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Webhost = "C:\\Users\\Admin\\AppData\\Roaming\\Windows\\3f92251c61010466cd2cd14846a6f4bde4054e8cf5c93e9cf576c603bead7ea2.exe"	3f92251c61010466cd2cd14846a6f4bde4054e8cf5c93e9cf576c603bead7ea2.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Webhost = "C:\\Users\\Admin\\AppData\\Roaming\\Windows\\3f92251c61010466cd2cd14846a6f4bde4054e8cf5c93e9cf576c603bead7ea2.exe"	3f92251c61010466cd2cd14846a6f4bde4054e8cf5c93e9cf576c603bead7ea2.exe

Creates scheduled task(s) 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

Scheduled Task

pid	Process
3056	schtasks.exe
4680	schtasks.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2540	3f92251c61010466cd2cd14846a6f4bde4054e8cf5c93e9cf576c603bead7ea2.exe
2176	3f92251c61010466cd2cd14846a6f4bde4054e8cf5c93e9cf576c603bead7ea2.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
2540	3f92251c61010466cd2cd14846a6f4bde4054e8cf5c93e9cf576c603bead7ea2.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2540	3f92251c61010466cd2cd14846a6f4bde4054e8cf5c93e9cf576c603bead7ea2.exe
Token: SeDebugPrivilege	2176	3f92251c61010466cd2cd14846a6f4bde4054e8cf5c93e9cf576c603bead7ea2.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 2540 wrote to memory of 4488	2540	3f92251c61010466cd2cd14846a6f4bde4054e8cf5c93e9cf576c603bead7ea2.exe	81
PID 2540 wrote to memory of 4488	2540	3f92251c61010466cd2cd14846a6f4bde4054e8cf5c93e9cf576c603bead7ea2.exe	81
PID 2540 wrote to memory of 4488	2540	3f92251c61010466cd2cd14846a6f4bde4054e8cf5c93e9cf576c603bead7ea2.exe	81
PID 4488 wrote to memory of 3056	4488	cmd.exe	83
PID 4488 wrote to memory of 3056	4488	cmd.exe	83
PID 4488 wrote to memory of 3056	4488	cmd.exe	83
PID 2176 wrote to memory of 4732	2176	3f92251c61010466cd2cd14846a6f4bde4054e8cf5c93e9cf576c603bead7ea2.exe	91
PID 2176 wrote to memory of 4732	2176	3f92251c61010466cd2cd14846a6f4bde4054e8cf5c93e9cf576c603bead7ea2.exe	91
PID 2176 wrote to memory of 4732	2176	3f92251c61010466cd2cd14846a6f4bde4054e8cf5c93e9cf576c603bead7ea2.exe	91
PID 4732 wrote to memory of 4680	4732	cmd.exe	93
PID 4732 wrote to memory of 4680	4732	cmd.exe	93
PID 4732 wrote to memory of 4680	4732	cmd.exe	93