Analysis
-
max time kernel
155s -
max time network
125s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
08-07-2022 06:44
Static task
static1
Behavioral task
behavioral1
Sample
4121794e6c8ffbf1a29d3dee1d0901b1682cd634f37502218739b78652a4a390.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
4121794e6c8ffbf1a29d3dee1d0901b1682cd634f37502218739b78652a4a390.exe
Resource
win10v2004-20220414-en
General
-
Target
4121794e6c8ffbf1a29d3dee1d0901b1682cd634f37502218739b78652a4a390.exe
-
Size
16KB
-
MD5
9c5088af14da209f0a78ca828ad16e97
-
SHA1
8955e3530454adc88e36183ec26b36cf48138c3c
-
SHA256
4121794e6c8ffbf1a29d3dee1d0901b1682cd634f37502218739b78652a4a390
-
SHA512
a8986849183c61ac2643186614284a6620501bae3dee3c1a9c6a55f5aa7b5cc2b5b4456227bbbda39d2103ea84d2c91a1d185ad90603519e93ac6ffeab328a79
Malware Config
Signatures
-
LoaderBot executable 1 IoCs
Processes:
resource yara_rule behavioral1/memory/1728-54-0x0000000000130000-0x000000000013A000-memory.dmp loaderbot -
Drops startup file 1 IoCs
Processes:
4121794e6c8ffbf1a29d3dee1d0901b1682cd634f37502218739b78652a4a390.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Webhost.url 4121794e6c8ffbf1a29d3dee1d0901b1682cd634f37502218739b78652a4a390.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
4121794e6c8ffbf1a29d3dee1d0901b1682cd634f37502218739b78652a4a390.exe4121794e6c8ffbf1a29d3dee1d0901b1682cd634f37502218739b78652a4a390.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Windows\CurrentVersion\Run\Webhost = "C:\\Users\\Admin\\AppData\\Roaming\\Windows\\4121794e6c8ffbf1a29d3dee1d0901b1682cd634f37502218739b78652a4a390.exe" 4121794e6c8ffbf1a29d3dee1d0901b1682cd634f37502218739b78652a4a390.exe Set value (str) \REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Windows\CurrentVersion\Run\Webhost = "C:\\Users\\Admin\\AppData\\Roaming\\Windows\\4121794e6c8ffbf1a29d3dee1d0901b1682cd634f37502218739b78652a4a390.exe" 4121794e6c8ffbf1a29d3dee1d0901b1682cd634f37502218739b78652a4a390.exe -
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
4121794e6c8ffbf1a29d3dee1d0901b1682cd634f37502218739b78652a4a390.exe4121794e6c8ffbf1a29d3dee1d0901b1682cd634f37502218739b78652a4a390.exepid process 1728 4121794e6c8ffbf1a29d3dee1d0901b1682cd634f37502218739b78652a4a390.exe 1660 4121794e6c8ffbf1a29d3dee1d0901b1682cd634f37502218739b78652a4a390.exe -
Suspicious behavior: RenamesItself 1 IoCs
Processes:
4121794e6c8ffbf1a29d3dee1d0901b1682cd634f37502218739b78652a4a390.exepid process 1728 4121794e6c8ffbf1a29d3dee1d0901b1682cd634f37502218739b78652a4a390.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
4121794e6c8ffbf1a29d3dee1d0901b1682cd634f37502218739b78652a4a390.exe4121794e6c8ffbf1a29d3dee1d0901b1682cd634f37502218739b78652a4a390.exedescription pid process Token: SeDebugPrivilege 1728 4121794e6c8ffbf1a29d3dee1d0901b1682cd634f37502218739b78652a4a390.exe Token: SeDebugPrivilege 1660 4121794e6c8ffbf1a29d3dee1d0901b1682cd634f37502218739b78652a4a390.exe -
Suspicious use of WriteProcessMemory 20 IoCs
Processes:
4121794e6c8ffbf1a29d3dee1d0901b1682cd634f37502218739b78652a4a390.execmd.exetaskeng.exe4121794e6c8ffbf1a29d3dee1d0901b1682cd634f37502218739b78652a4a390.execmd.exedescription pid process target process PID 1728 wrote to memory of 580 1728 4121794e6c8ffbf1a29d3dee1d0901b1682cd634f37502218739b78652a4a390.exe cmd.exe PID 1728 wrote to memory of 580 1728 4121794e6c8ffbf1a29d3dee1d0901b1682cd634f37502218739b78652a4a390.exe cmd.exe PID 1728 wrote to memory of 580 1728 4121794e6c8ffbf1a29d3dee1d0901b1682cd634f37502218739b78652a4a390.exe cmd.exe PID 1728 wrote to memory of 580 1728 4121794e6c8ffbf1a29d3dee1d0901b1682cd634f37502218739b78652a4a390.exe cmd.exe PID 580 wrote to memory of 864 580 cmd.exe schtasks.exe PID 580 wrote to memory of 864 580 cmd.exe schtasks.exe PID 580 wrote to memory of 864 580 cmd.exe schtasks.exe PID 580 wrote to memory of 864 580 cmd.exe schtasks.exe PID 108 wrote to memory of 1660 108 taskeng.exe 4121794e6c8ffbf1a29d3dee1d0901b1682cd634f37502218739b78652a4a390.exe PID 108 wrote to memory of 1660 108 taskeng.exe 4121794e6c8ffbf1a29d3dee1d0901b1682cd634f37502218739b78652a4a390.exe PID 108 wrote to memory of 1660 108 taskeng.exe 4121794e6c8ffbf1a29d3dee1d0901b1682cd634f37502218739b78652a4a390.exe PID 108 wrote to memory of 1660 108 taskeng.exe 4121794e6c8ffbf1a29d3dee1d0901b1682cd634f37502218739b78652a4a390.exe PID 1660 wrote to memory of 668 1660 4121794e6c8ffbf1a29d3dee1d0901b1682cd634f37502218739b78652a4a390.exe cmd.exe PID 1660 wrote to memory of 668 1660 4121794e6c8ffbf1a29d3dee1d0901b1682cd634f37502218739b78652a4a390.exe cmd.exe PID 1660 wrote to memory of 668 1660 4121794e6c8ffbf1a29d3dee1d0901b1682cd634f37502218739b78652a4a390.exe cmd.exe PID 1660 wrote to memory of 668 1660 4121794e6c8ffbf1a29d3dee1d0901b1682cd634f37502218739b78652a4a390.exe cmd.exe PID 668 wrote to memory of 1808 668 cmd.exe schtasks.exe PID 668 wrote to memory of 1808 668 cmd.exe schtasks.exe PID 668 wrote to memory of 1808 668 cmd.exe schtasks.exe PID 668 wrote to memory of 1808 668 cmd.exe schtasks.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\4121794e6c8ffbf1a29d3dee1d0901b1682cd634f37502218739b78652a4a390.exe"C:\Users\Admin\AppData\Local\Temp\4121794e6c8ffbf1a29d3dee1d0901b1682cd634f37502218739b78652a4a390.exe"1⤵
- Drops startup file
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1728 -
C:\Windows\SysWOW64\cmd.exe"cmd" /C schtasks /create /tn \System\SecurityServiceUpdate /tr %userprofile%\AppData\Roaming\Windows\4121794e6c8ffbf1a29d3dee1d0901b1682cd634f37502218739b78652a4a390.exe /st 00:00 /du 9999:59 /sc daily /ri 5 /f2⤵
- Suspicious use of WriteProcessMemory
PID:580 -
C:\Windows\SysWOW64\schtasks.exeschtasks /create /tn \System\SecurityServiceUpdate /tr C:\Users\Admin\AppData\Roaming\Windows\4121794e6c8ffbf1a29d3dee1d0901b1682cd634f37502218739b78652a4a390.exe /st 00:00 /du 9999:59 /sc daily /ri 5 /f3⤵
- Creates scheduled task(s)
PID:864
-
C:\Windows\system32\taskeng.exetaskeng.exe {A8EA15ED-0CE3-4014-8C3C-ADC13477C246} S-1-5-21-1083475884-596052423-1669053738-1000:WYZSGDWS\Admin:Interactive:[1]1⤵
- Suspicious use of WriteProcessMemory
PID:108 -
C:\Users\Admin\AppData\Roaming\Windows\4121794e6c8ffbf1a29d3dee1d0901b1682cd634f37502218739b78652a4a390.exeC:\Users\Admin\AppData\Roaming\Windows\4121794e6c8ffbf1a29d3dee1d0901b1682cd634f37502218739b78652a4a390.exe2⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1660 -
C:\Windows\SysWOW64\cmd.exe"cmd" /C schtasks /create /tn \System\SecurityServiceUpdate /tr %userprofile%\AppData\Roaming\Windows\4121794e6c8ffbf1a29d3dee1d0901b1682cd634f37502218739b78652a4a390.exe /st 00:00 /du 9999:59 /sc daily /ri 5 /f3⤵
- Suspicious use of WriteProcessMemory
PID:668 -
C:\Windows\SysWOW64\schtasks.exeschtasks /create /tn \System\SecurityServiceUpdate /tr C:\Users\Admin\AppData\Roaming\Windows\4121794e6c8ffbf1a29d3dee1d0901b1682cd634f37502218739b78652a4a390.exe /st 00:00 /du 9999:59 /sc daily /ri 5 /f4⤵
- Creates scheduled task(s)
PID:1808