Analysis

  • max time kernel
    151s
  • max time network
    53s
  • platform
    windows7_x64
  • resource
    win7-20220715-en
  • resource tags

    arch:x64arch:x86image:win7-20220715-enlocale:en-usos:windows7-x64system
  • submitted
    18-07-2022 18:06

General

  • Target

    5111d9b5672f2b9dbac2d3beee9bcc9b188c6ecc700922e4ec828636dab91d4c.exe

  • Size

    16KB

  • MD5

    d6d75952d12009b90cb8257de43eff49

  • SHA1

    47c5cfcb180bdfcb6744ee332e118fd0b2526aba

  • SHA256

    5111d9b5672f2b9dbac2d3beee9bcc9b188c6ecc700922e4ec828636dab91d4c

  • SHA512

    6c346407c504c546ee7d16b723fa62d4f052121f9aef7488bda2ebaa56807bedeb443663272ec6b1b9da6ff655d3f77fd2f5f63f5dc185cf75d84d7cb0abea2d

Malware Config

Signatures

  • LoaderBot

    LoaderBot is a loader written in .NET downloading and executing miners.

  • LoaderBot executable 1 IoCs
  • Drops startup file 1 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
  • Creates scheduled task(s) 1 TTPs 2 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious behavior: RenamesItself 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 20 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\5111d9b5672f2b9dbac2d3beee9bcc9b188c6ecc700922e4ec828636dab91d4c.exe
    "C:\Users\Admin\AppData\Local\Temp\5111d9b5672f2b9dbac2d3beee9bcc9b188c6ecc700922e4ec828636dab91d4c.exe"
    1⤵
    • Drops startup file
    • Adds Run key to start application
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: RenamesItself
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1164
    • C:\Windows\SysWOW64\cmd.exe
      "cmd" /C schtasks /create /tn \System\SecurityServiceUpdate /tr %userprofile%\AppData\Roaming\Windows\5111d9b5672f2b9dbac2d3beee9bcc9b188c6ecc700922e4ec828636dab91d4c.exe /st 00:00 /du 9999:59 /sc daily /ri 5 /f
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:1504
      • C:\Windows\SysWOW64\schtasks.exe
        schtasks /create /tn \System\SecurityServiceUpdate /tr C:\Users\Admin\AppData\Roaming\Windows\5111d9b5672f2b9dbac2d3beee9bcc9b188c6ecc700922e4ec828636dab91d4c.exe /st 00:00 /du 9999:59 /sc daily /ri 5 /f
        3⤵
        • Creates scheduled task(s)
        PID:1416
  • C:\Windows\system32\taskeng.exe
    taskeng.exe {75400234-F9FE-4FB4-A516-577424283740} S-1-5-21-3440072777-2118400376-1759599358-1000:NKWDSIWE\Admin:Interactive:[1]
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:892
    • C:\Users\Admin\AppData\Roaming\Windows\5111d9b5672f2b9dbac2d3beee9bcc9b188c6ecc700922e4ec828636dab91d4c.exe
      C:\Users\Admin\AppData\Roaming\Windows\5111d9b5672f2b9dbac2d3beee9bcc9b188c6ecc700922e4ec828636dab91d4c.exe
      2⤵
      • Adds Run key to start application
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:940
      • C:\Windows\SysWOW64\cmd.exe
        "cmd" /C schtasks /create /tn \System\SecurityServiceUpdate /tr %userprofile%\AppData\Roaming\Windows\5111d9b5672f2b9dbac2d3beee9bcc9b188c6ecc700922e4ec828636dab91d4c.exe /st 00:00 /du 9999:59 /sc daily /ri 5 /f
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:948
        • C:\Windows\SysWOW64\schtasks.exe
          schtasks /create /tn \System\SecurityServiceUpdate /tr C:\Users\Admin\AppData\Roaming\Windows\5111d9b5672f2b9dbac2d3beee9bcc9b188c6ecc700922e4ec828636dab91d4c.exe /st 00:00 /du 9999:59 /sc daily /ri 5 /f
          4⤵
          • Creates scheduled task(s)
          PID:1768

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/940-58-0x0000000000000000-mapping.dmp

  • memory/948-59-0x0000000000000000-mapping.dmp

  • memory/1164-54-0x0000000000C90000-0x0000000000C9A000-memory.dmp

    Filesize

    40KB

  • memory/1164-56-0x0000000076021000-0x0000000076023000-memory.dmp

    Filesize

    8KB

  • memory/1416-57-0x0000000000000000-mapping.dmp

  • memory/1504-55-0x0000000000000000-mapping.dmp

  • memory/1768-61-0x0000000000000000-mapping.dmp