Analysis

  • max time kernel
    151s
  • max time network
    42s
  • platform
    windows7_x64
  • resource
    win7-20220414-en
  • submitted
    12-07-2022 10:02

General

  • Target

    4b68a446a8326ccb9adaa3f2bbb7ba5530b4f3b1c08b21be244e06392974fec8.exe

  • Size

    16KB

  • MD5

    e14558e702089180c651a530f3d8d491

  • SHA1

    ebdbfa5db972920ba262d2698e97aeb7f417b157

  • SHA256

    4b68a446a8326ccb9adaa3f2bbb7ba5530b4f3b1c08b21be244e06392974fec8

  • SHA512

    484dad988ea4d627206767e424fef31c9147aefac60b059a4ba603decfa99876d40e545efcde8fef50711b89e37a9809b7975ad7f09206c7b60e49e283f24d2f

Malware Config

Signatures

  • LoaderBot

    LoaderBot is a loader written in .NET downloading and executing miners.

  • LoaderBot executable 1 IoCs
  • Drops startup file 1 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious behavior: RenamesItself 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\4b68a446a8326ccb9adaa3f2bbb7ba5530b4f3b1c08b21be244e06392974fec8.exe
    "C:\Users\Admin\AppData\Local\Temp\4b68a446a8326ccb9adaa3f2bbb7ba5530b4f3b1c08b21be244e06392974fec8.exe"
    1⤵
    • Drops startup file
    • Adds Run key to start application
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: RenamesItself
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:972
    • C:\Windows\SysWOW64\cmd.exe
      "cmd" /C schtasks /create /tn \System\SecurityServiceUpdate /tr %userprofile%\AppData\Roaming\Windows\4b68a446a8326ccb9adaa3f2bbb7ba5530b4f3b1c08b21be244e06392974fec8.exe /st 00:00 /du 9999:59 /sc daily /ri 5 /f
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:908
      • C:\Windows\SysWOW64\schtasks.exe
        schtasks /create /tn \System\SecurityServiceUpdate /tr C:\Users\Admin\AppData\Roaming\Windows\4b68a446a8326ccb9adaa3f2bbb7ba5530b4f3b1c08b21be244e06392974fec8.exe /st 00:00 /du 9999:59 /sc daily /ri 5 /f
        3⤵
        • Creates scheduled task(s)
        PID:1300
  • C:\Windows\system32\taskeng.exe
    taskeng.exe {2A4E9FD7-956E-4160-97B7-5F88DD36D8C5} S-1-5-21-790309383-526510583-3802439154-1000:TVHJCWMH\Admin:Interactive:[1]
    1⤵
      PID:1504

    Network

    MITRE ATT&CK Enterprise v6

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/908-55-0x0000000000000000-mapping.dmp

    • memory/972-54-0x00000000013D0000-0x00000000013DA000-memory.dmp

      Filesize

      40KB

    • memory/972-56-0x0000000075D21000-0x0000000075D23000-memory.dmp

      Filesize

      8KB

    • memory/1300-57-0x0000000000000000-mapping.dmp