Analysis
-
max time kernel
150s -
max time network
154s -
platform
windows10-2004_x64 -
resource
win10v2004-20220414-en -
submitted
01-07-2022 05:53
Static task
static1
Behavioral task
behavioral1
Sample
9ecffc46c622a2f5e1d1478796f70496492471f06015435a2e51b8dc0ae759bb.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
9ecffc46c622a2f5e1d1478796f70496492471f06015435a2e51b8dc0ae759bb.exe
Resource
win10v2004-20220414-en
General
-
Target
9ecffc46c622a2f5e1d1478796f70496492471f06015435a2e51b8dc0ae759bb.exe
-
Size
16KB
-
MD5
b13ff03a1867bbce5a219d053ab08faf
-
SHA1
b43c892c801a668ef53e9eb16e3742e5b431423c
-
SHA256
9ecffc46c622a2f5e1d1478796f70496492471f06015435a2e51b8dc0ae759bb
-
SHA512
21387ca5a82182e6cc1ff188a1b44ac7fa3f9b82be95a74879d78d4eb3d5195ba83338a7497ddf504e45b587694af9de770ec444175fd661a723c6ce6cdf7164
Malware Config
Signatures
-
LoaderBot executable 1 IoCs
Processes:
resource yara_rule behavioral2/memory/2900-130-0x0000000000200000-0x000000000020A000-memory.dmp loaderbot -
Drops startup file 1 IoCs
Processes:
9ecffc46c622a2f5e1d1478796f70496492471f06015435a2e51b8dc0ae759bb.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Webhost.url 9ecffc46c622a2f5e1d1478796f70496492471f06015435a2e51b8dc0ae759bb.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
9ecffc46c622a2f5e1d1478796f70496492471f06015435a2e51b8dc0ae759bb.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Webhost = "C:\\Users\\Admin\\AppData\\Roaming\\Windows\\9ecffc46c622a2f5e1d1478796f70496492471f06015435a2e51b8dc0ae759bb.exe" 9ecffc46c622a2f5e1d1478796f70496492471f06015435a2e51b8dc0ae759bb.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
9ecffc46c622a2f5e1d1478796f70496492471f06015435a2e51b8dc0ae759bb.exepid process 2900 9ecffc46c622a2f5e1d1478796f70496492471f06015435a2e51b8dc0ae759bb.exe -
Suspicious behavior: RenamesItself 1 IoCs
Processes:
9ecffc46c622a2f5e1d1478796f70496492471f06015435a2e51b8dc0ae759bb.exepid process 2900 9ecffc46c622a2f5e1d1478796f70496492471f06015435a2e51b8dc0ae759bb.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
9ecffc46c622a2f5e1d1478796f70496492471f06015435a2e51b8dc0ae759bb.exedescription pid process Token: SeDebugPrivilege 2900 9ecffc46c622a2f5e1d1478796f70496492471f06015435a2e51b8dc0ae759bb.exe -
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
9ecffc46c622a2f5e1d1478796f70496492471f06015435a2e51b8dc0ae759bb.execmd.exedescription pid process target process PID 2900 wrote to memory of 1536 2900 9ecffc46c622a2f5e1d1478796f70496492471f06015435a2e51b8dc0ae759bb.exe cmd.exe PID 2900 wrote to memory of 1536 2900 9ecffc46c622a2f5e1d1478796f70496492471f06015435a2e51b8dc0ae759bb.exe cmd.exe PID 2900 wrote to memory of 1536 2900 9ecffc46c622a2f5e1d1478796f70496492471f06015435a2e51b8dc0ae759bb.exe cmd.exe PID 1536 wrote to memory of 544 1536 cmd.exe schtasks.exe PID 1536 wrote to memory of 544 1536 cmd.exe schtasks.exe PID 1536 wrote to memory of 544 1536 cmd.exe schtasks.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\9ecffc46c622a2f5e1d1478796f70496492471f06015435a2e51b8dc0ae759bb.exe"C:\Users\Admin\AppData\Local\Temp\9ecffc46c622a2f5e1d1478796f70496492471f06015435a2e51b8dc0ae759bb.exe"1⤵
- Drops startup file
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2900 -
C:\Windows\SysWOW64\cmd.exe"cmd" /C schtasks /create /tn \System\SecurityServiceUpdate /tr %userprofile%\AppData\Roaming\Windows\9ecffc46c622a2f5e1d1478796f70496492471f06015435a2e51b8dc0ae759bb.exe /st 00:00 /du 9999:59 /sc daily /ri 5 /f2⤵
- Suspicious use of WriteProcessMemory
PID:1536 -
C:\Windows\SysWOW64\schtasks.exeschtasks /create /tn \System\SecurityServiceUpdate /tr C:\Users\Admin\AppData\Roaming\Windows\9ecffc46c622a2f5e1d1478796f70496492471f06015435a2e51b8dc0ae759bb.exe /st 00:00 /du 9999:59 /sc daily /ri 5 /f3⤵
- Creates scheduled task(s)
PID:544