Analysis
-
max time kernel
152s -
max time network
47s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
01-07-2022 05:53
Static task
static1
Behavioral task
behavioral1
Sample
9ecffc46c622a2f5e1d1478796f70496492471f06015435a2e51b8dc0ae759bb.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
9ecffc46c622a2f5e1d1478796f70496492471f06015435a2e51b8dc0ae759bb.exe
Resource
win10v2004-20220414-en
General
-
Target
9ecffc46c622a2f5e1d1478796f70496492471f06015435a2e51b8dc0ae759bb.exe
-
Size
16KB
-
MD5
b13ff03a1867bbce5a219d053ab08faf
-
SHA1
b43c892c801a668ef53e9eb16e3742e5b431423c
-
SHA256
9ecffc46c622a2f5e1d1478796f70496492471f06015435a2e51b8dc0ae759bb
-
SHA512
21387ca5a82182e6cc1ff188a1b44ac7fa3f9b82be95a74879d78d4eb3d5195ba83338a7497ddf504e45b587694af9de770ec444175fd661a723c6ce6cdf7164
Malware Config
Signatures
-
LoaderBot executable 1 IoCs
Processes:
resource yara_rule behavioral1/memory/1664-54-0x00000000002C0000-0x00000000002CA000-memory.dmp loaderbot -
Drops startup file 1 IoCs
Processes:
9ecffc46c622a2f5e1d1478796f70496492471f06015435a2e51b8dc0ae759bb.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Webhost.url 9ecffc46c622a2f5e1d1478796f70496492471f06015435a2e51b8dc0ae759bb.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
9ecffc46c622a2f5e1d1478796f70496492471f06015435a2e51b8dc0ae759bb.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Windows\CurrentVersion\Run\Webhost = "C:\\Users\\Admin\\AppData\\Roaming\\Windows\\9ecffc46c622a2f5e1d1478796f70496492471f06015435a2e51b8dc0ae759bb.exe" 9ecffc46c622a2f5e1d1478796f70496492471f06015435a2e51b8dc0ae759bb.exe -
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
9ecffc46c622a2f5e1d1478796f70496492471f06015435a2e51b8dc0ae759bb.exepid process 1664 9ecffc46c622a2f5e1d1478796f70496492471f06015435a2e51b8dc0ae759bb.exe -
Suspicious behavior: RenamesItself 1 IoCs
Processes:
9ecffc46c622a2f5e1d1478796f70496492471f06015435a2e51b8dc0ae759bb.exepid process 1664 9ecffc46c622a2f5e1d1478796f70496492471f06015435a2e51b8dc0ae759bb.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
9ecffc46c622a2f5e1d1478796f70496492471f06015435a2e51b8dc0ae759bb.exedescription pid process Token: SeDebugPrivilege 1664 9ecffc46c622a2f5e1d1478796f70496492471f06015435a2e51b8dc0ae759bb.exe -
Suspicious use of WriteProcessMemory 8 IoCs
Processes:
9ecffc46c622a2f5e1d1478796f70496492471f06015435a2e51b8dc0ae759bb.execmd.exedescription pid process target process PID 1664 wrote to memory of 1348 1664 9ecffc46c622a2f5e1d1478796f70496492471f06015435a2e51b8dc0ae759bb.exe cmd.exe PID 1664 wrote to memory of 1348 1664 9ecffc46c622a2f5e1d1478796f70496492471f06015435a2e51b8dc0ae759bb.exe cmd.exe PID 1664 wrote to memory of 1348 1664 9ecffc46c622a2f5e1d1478796f70496492471f06015435a2e51b8dc0ae759bb.exe cmd.exe PID 1664 wrote to memory of 1348 1664 9ecffc46c622a2f5e1d1478796f70496492471f06015435a2e51b8dc0ae759bb.exe cmd.exe PID 1348 wrote to memory of 1160 1348 cmd.exe schtasks.exe PID 1348 wrote to memory of 1160 1348 cmd.exe schtasks.exe PID 1348 wrote to memory of 1160 1348 cmd.exe schtasks.exe PID 1348 wrote to memory of 1160 1348 cmd.exe schtasks.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\9ecffc46c622a2f5e1d1478796f70496492471f06015435a2e51b8dc0ae759bb.exe"C:\Users\Admin\AppData\Local\Temp\9ecffc46c622a2f5e1d1478796f70496492471f06015435a2e51b8dc0ae759bb.exe"1⤵
- Drops startup file
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1664 -
C:\Windows\SysWOW64\cmd.exe"cmd" /C schtasks /create /tn \System\SecurityServiceUpdate /tr %userprofile%\AppData\Roaming\Windows\9ecffc46c622a2f5e1d1478796f70496492471f06015435a2e51b8dc0ae759bb.exe /st 00:00 /du 9999:59 /sc daily /ri 5 /f2⤵
- Suspicious use of WriteProcessMemory
PID:1348 -
C:\Windows\SysWOW64\schtasks.exeschtasks /create /tn \System\SecurityServiceUpdate /tr C:\Users\Admin\AppData\Roaming\Windows\9ecffc46c622a2f5e1d1478796f70496492471f06015435a2e51b8dc0ae759bb.exe /st 00:00 /du 9999:59 /sc daily /ri 5 /f3⤵
- Creates scheduled task(s)
PID:1160