Analysis
-
max time kernel
179s -
max time network
197s -
platform
windows10-2004_x64 -
resource
win10v2004-20220414-en -
submitted
08-07-2022 06:44
Static task
static1
Behavioral task
behavioral1
Sample
4121794e6c8ffbf1a29d3dee1d0901b1682cd634f37502218739b78652a4a390.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
4121794e6c8ffbf1a29d3dee1d0901b1682cd634f37502218739b78652a4a390.exe
Resource
win10v2004-20220414-en
General
-
Target
4121794e6c8ffbf1a29d3dee1d0901b1682cd634f37502218739b78652a4a390.exe
-
Size
16KB
-
MD5
9c5088af14da209f0a78ca828ad16e97
-
SHA1
8955e3530454adc88e36183ec26b36cf48138c3c
-
SHA256
4121794e6c8ffbf1a29d3dee1d0901b1682cd634f37502218739b78652a4a390
-
SHA512
a8986849183c61ac2643186614284a6620501bae3dee3c1a9c6a55f5aa7b5cc2b5b4456227bbbda39d2103ea84d2c91a1d185ad90603519e93ac6ffeab328a79
Malware Config
Signatures
-
LoaderBot executable 1 IoCs
Processes:
resource yara_rule behavioral2/memory/1760-130-0x0000000000A80000-0x0000000000A8A000-memory.dmp loaderbot -
Drops startup file 1 IoCs
Processes:
4121794e6c8ffbf1a29d3dee1d0901b1682cd634f37502218739b78652a4a390.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Webhost.url 4121794e6c8ffbf1a29d3dee1d0901b1682cd634f37502218739b78652a4a390.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
4121794e6c8ffbf1a29d3dee1d0901b1682cd634f37502218739b78652a4a390.exe4121794e6c8ffbf1a29d3dee1d0901b1682cd634f37502218739b78652a4a390.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Webhost = "C:\\Users\\Admin\\AppData\\Roaming\\Windows\\4121794e6c8ffbf1a29d3dee1d0901b1682cd634f37502218739b78652a4a390.exe" 4121794e6c8ffbf1a29d3dee1d0901b1682cd634f37502218739b78652a4a390.exe Set value (str) \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Webhost = "C:\\Users\\Admin\\AppData\\Roaming\\Windows\\4121794e6c8ffbf1a29d3dee1d0901b1682cd634f37502218739b78652a4a390.exe" 4121794e6c8ffbf1a29d3dee1d0901b1682cd634f37502218739b78652a4a390.exe -
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
Processes:
schtasks.exeschtasks.exepid process 4088 schtasks.exe 2344 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
4121794e6c8ffbf1a29d3dee1d0901b1682cd634f37502218739b78652a4a390.exe4121794e6c8ffbf1a29d3dee1d0901b1682cd634f37502218739b78652a4a390.exepid process 1760 4121794e6c8ffbf1a29d3dee1d0901b1682cd634f37502218739b78652a4a390.exe 4568 4121794e6c8ffbf1a29d3dee1d0901b1682cd634f37502218739b78652a4a390.exe -
Suspicious behavior: RenamesItself 1 IoCs
Processes:
4121794e6c8ffbf1a29d3dee1d0901b1682cd634f37502218739b78652a4a390.exepid process 1760 4121794e6c8ffbf1a29d3dee1d0901b1682cd634f37502218739b78652a4a390.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
4121794e6c8ffbf1a29d3dee1d0901b1682cd634f37502218739b78652a4a390.exe4121794e6c8ffbf1a29d3dee1d0901b1682cd634f37502218739b78652a4a390.exedescription pid process Token: SeDebugPrivilege 1760 4121794e6c8ffbf1a29d3dee1d0901b1682cd634f37502218739b78652a4a390.exe Token: SeDebugPrivilege 4568 4121794e6c8ffbf1a29d3dee1d0901b1682cd634f37502218739b78652a4a390.exe -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
4121794e6c8ffbf1a29d3dee1d0901b1682cd634f37502218739b78652a4a390.execmd.exe4121794e6c8ffbf1a29d3dee1d0901b1682cd634f37502218739b78652a4a390.execmd.exedescription pid process target process PID 1760 wrote to memory of 4036 1760 4121794e6c8ffbf1a29d3dee1d0901b1682cd634f37502218739b78652a4a390.exe cmd.exe PID 1760 wrote to memory of 4036 1760 4121794e6c8ffbf1a29d3dee1d0901b1682cd634f37502218739b78652a4a390.exe cmd.exe PID 1760 wrote to memory of 4036 1760 4121794e6c8ffbf1a29d3dee1d0901b1682cd634f37502218739b78652a4a390.exe cmd.exe PID 4036 wrote to memory of 4088 4036 cmd.exe schtasks.exe PID 4036 wrote to memory of 4088 4036 cmd.exe schtasks.exe PID 4036 wrote to memory of 4088 4036 cmd.exe schtasks.exe PID 4568 wrote to memory of 4460 4568 4121794e6c8ffbf1a29d3dee1d0901b1682cd634f37502218739b78652a4a390.exe cmd.exe PID 4568 wrote to memory of 4460 4568 4121794e6c8ffbf1a29d3dee1d0901b1682cd634f37502218739b78652a4a390.exe cmd.exe PID 4568 wrote to memory of 4460 4568 4121794e6c8ffbf1a29d3dee1d0901b1682cd634f37502218739b78652a4a390.exe cmd.exe PID 4460 wrote to memory of 2344 4460 cmd.exe schtasks.exe PID 4460 wrote to memory of 2344 4460 cmd.exe schtasks.exe PID 4460 wrote to memory of 2344 4460 cmd.exe schtasks.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\4121794e6c8ffbf1a29d3dee1d0901b1682cd634f37502218739b78652a4a390.exe"C:\Users\Admin\AppData\Local\Temp\4121794e6c8ffbf1a29d3dee1d0901b1682cd634f37502218739b78652a4a390.exe"1⤵
- Drops startup file
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1760 -
C:\Windows\SysWOW64\cmd.exe"cmd" /C schtasks /create /tn \System\SecurityServiceUpdate /tr %userprofile%\AppData\Roaming\Windows\4121794e6c8ffbf1a29d3dee1d0901b1682cd634f37502218739b78652a4a390.exe /st 00:00 /du 9999:59 /sc daily /ri 5 /f2⤵
- Suspicious use of WriteProcessMemory
PID:4036 -
C:\Windows\SysWOW64\schtasks.exeschtasks /create /tn \System\SecurityServiceUpdate /tr C:\Users\Admin\AppData\Roaming\Windows\4121794e6c8ffbf1a29d3dee1d0901b1682cd634f37502218739b78652a4a390.exe /st 00:00 /du 9999:59 /sc daily /ri 5 /f3⤵
- Creates scheduled task(s)
PID:4088
-
C:\Users\Admin\AppData\Roaming\Windows\4121794e6c8ffbf1a29d3dee1d0901b1682cd634f37502218739b78652a4a390.exeC:\Users\Admin\AppData\Roaming\Windows\4121794e6c8ffbf1a29d3dee1d0901b1682cd634f37502218739b78652a4a390.exe1⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4568 -
C:\Windows\SysWOW64\cmd.exe"cmd" /C schtasks /create /tn \System\SecurityServiceUpdate /tr %userprofile%\AppData\Roaming\Windows\4121794e6c8ffbf1a29d3dee1d0901b1682cd634f37502218739b78652a4a390.exe /st 00:00 /du 9999:59 /sc daily /ri 5 /f2⤵
- Suspicious use of WriteProcessMemory
PID:4460 -
C:\Windows\SysWOW64\schtasks.exeschtasks /create /tn \System\SecurityServiceUpdate /tr C:\Users\Admin\AppData\Roaming\Windows\4121794e6c8ffbf1a29d3dee1d0901b1682cd634f37502218739b78652a4a390.exe /st 00:00 /du 9999:59 /sc daily /ri 5 /f3⤵
- Creates scheduled task(s)
PID:2344