loaderbot | 5111d9b5672f2b9dbac2d3beee9bcc9b188c6ecc700922e4ec828636dab91d4c

General

Target
5111d9b5672f2b9dbac2d3beee9bcc9b188c6ecc700922e4ec828636dab91d4c.exe
Size 16KB
Sample220718-wp71raccf6
SHA256 5111d9b5672f2b9dbac2d3beee9bcc9b188c6ecc700922e4ec828636dab91d4c
MD5 d6d75952d12009b90cb8257de43eff49
SHA1 47c5cfcb180bdfcb6744ee332e118fd0b2526aba
SHA512 6c346407c504c546ee7d16b723fa62d4f052121f9aef7488bda2ebaa56807bedeb443663272ec6b1b9da6ff655d3f77fd2f5f63f5dc185cf75d84d7cb0abea2d
MD5 SHA1 SHA512

Score

10^/10

LoaderBot
LoaderBot is a loader written in .NET downloading and executing miners.
loader miner loaderbot

LoaderBot executable 1 IoCs

resource	yara_rule
behavioral1/memory/1164-54-0x0000000000C90000-0x0000000000C9A000-memory.dmp	loaderbot

Drops startup file 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Webhost.url	5111d9b5672f2b9dbac2d3beee9bcc9b188c6ecc700922e4ec828636dab91d4c.exe

Adds Run key to start application 2 TTPs 2 IoCs

Registry Run Keys / Startup Folder

Modify Registry

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3440072777-2118400376-1759599358-1000\Software\Microsoft\Windows\CurrentVersion\Run\Webhost = "C:\\Users\\Admin\\AppData\\Roaming\\Windows\\5111d9b5672f2b9dbac2d3beee9bcc9b188c6ecc700922e4ec828636dab91d4c.exe"	5111d9b5672f2b9dbac2d3beee9bcc9b188c6ecc700922e4ec828636dab91d4c.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3440072777-2118400376-1759599358-1000\Software\Microsoft\Windows\CurrentVersion\Run\Webhost = "C:\\Users\\Admin\\AppData\\Roaming\\Windows\\5111d9b5672f2b9dbac2d3beee9bcc9b188c6ecc700922e4ec828636dab91d4c.exe"	5111d9b5672f2b9dbac2d3beee9bcc9b188c6ecc700922e4ec828636dab91d4c.exe

Creates scheduled task(s) 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

Scheduled Task

pid	Process
1416	schtasks.exe
1768	schtasks.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1164	5111d9b5672f2b9dbac2d3beee9bcc9b188c6ecc700922e4ec828636dab91d4c.exe
940	5111d9b5672f2b9dbac2d3beee9bcc9b188c6ecc700922e4ec828636dab91d4c.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
1164	5111d9b5672f2b9dbac2d3beee9bcc9b188c6ecc700922e4ec828636dab91d4c.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1164	5111d9b5672f2b9dbac2d3beee9bcc9b188c6ecc700922e4ec828636dab91d4c.exe
Token: SeDebugPrivilege	940	5111d9b5672f2b9dbac2d3beee9bcc9b188c6ecc700922e4ec828636dab91d4c.exe

Suspicious use of WriteProcessMemory 20 IoCs

description	pid	Process	procid_target
PID 1164 wrote to memory of 1504	1164	5111d9b5672f2b9dbac2d3beee9bcc9b188c6ecc700922e4ec828636dab91d4c.exe	27
PID 1164 wrote to memory of 1504	1164	5111d9b5672f2b9dbac2d3beee9bcc9b188c6ecc700922e4ec828636dab91d4c.exe	27
PID 1164 wrote to memory of 1504	1164	5111d9b5672f2b9dbac2d3beee9bcc9b188c6ecc700922e4ec828636dab91d4c.exe	27
PID 1164 wrote to memory of 1504	1164	5111d9b5672f2b9dbac2d3beee9bcc9b188c6ecc700922e4ec828636dab91d4c.exe	27
PID 1504 wrote to memory of 1416	1504	cmd.exe	29
PID 1504 wrote to memory of 1416	1504	cmd.exe	29
PID 1504 wrote to memory of 1416	1504	cmd.exe	29
PID 1504 wrote to memory of 1416	1504	cmd.exe	29
PID 892 wrote to memory of 940	892	taskeng.exe	32
PID 892 wrote to memory of 940	892	taskeng.exe	32
PID 892 wrote to memory of 940	892	taskeng.exe	32
PID 892 wrote to memory of 940	892	taskeng.exe	32
PID 940 wrote to memory of 948	940	5111d9b5672f2b9dbac2d3beee9bcc9b188c6ecc700922e4ec828636dab91d4c.exe	33
PID 940 wrote to memory of 948	940	5111d9b5672f2b9dbac2d3beee9bcc9b188c6ecc700922e4ec828636dab91d4c.exe	33
PID 940 wrote to memory of 948	940	5111d9b5672f2b9dbac2d3beee9bcc9b188c6ecc700922e4ec828636dab91d4c.exe	33
PID 940 wrote to memory of 948	940	5111d9b5672f2b9dbac2d3beee9bcc9b188c6ecc700922e4ec828636dab91d4c.exe	33
PID 948 wrote to memory of 1768	948	cmd.exe	35
PID 948 wrote to memory of 1768	948	cmd.exe	35
PID 948 wrote to memory of 1768	948	cmd.exe	35
PID 948 wrote to memory of 1768	948	cmd.exe	35

C:\Windows\system32\taskeng.exe
taskeng.exe {75400234-F9FE-4FB4-A516-577424283740} S-1-5-21-3440072777-2118400376-1759599358-1000:NKWDSIWE\Admin:Interactive:[1]
1⤵
- Suspicious use of WriteProcessMemory
PID:892
- C:\Users\Admin\AppData\Roaming\Windows\5111d9b5672f2b9dbac2d3beee9bcc9b188c6ecc700922e4ec828636dab91d4c.exe
  C:\Users\Admin\AppData\Roaming\Windows\5111d9b5672f2b9dbac2d3beee9bcc9b188c6ecc700922e4ec828636dab91d4c.exe
  2⤵
  - Adds Run key to start application
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:940
- - C:\Windows\SysWOW64\cmd.exe
    "cmd" /C schtasks /create /tn \System\SecurityServiceUpdate /tr %userprofile%\AppData\Roaming\Windows\5111d9b5672f2b9dbac2d3beee9bcc9b188c6ecc700922e4ec828636dab91d4c.exe /st 00:00 /du 9999:59 /sc daily /ri 5 /f
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:948
  - - C:\Windows\SysWOW64\schtasks.exe
      schtasks /create /tn \System\SecurityServiceUpdate /tr C:\Users\Admin\AppData\Roaming\Windows\5111d9b5672f2b9dbac2d3beee9bcc9b188c6ecc700922e4ec828636dab91d4c.exe /st 00:00 /du 9999:59 /sc daily /ri 5 /f
      4⤵
      Creates scheduled task(s)
      PID:1768