Analysis
-
max time kernel
151s -
max time network
41s -
platform
windows7_x64 -
resource
win7-20220715-en -
resource tags
arch:x64arch:x86image:win7-20220715-enlocale:en-usos:windows7-x64system -
submitted
24-07-2022 21:28
Behavioral task
behavioral1
Sample
8b893cde796921deb7a83a618842db19064c9b2ac49e5caf7214eb860118172d.exe
Resource
win7-20220715-en
Behavioral task
behavioral2
Sample
8b893cde796921deb7a83a618842db19064c9b2ac49e5caf7214eb860118172d.exe
Resource
win10v2004-20220721-en
General
-
Target
8b893cde796921deb7a83a618842db19064c9b2ac49e5caf7214eb860118172d.exe
-
Size
16KB
-
MD5
b452a4d977de9b9b9285d6eec3edd72f
-
SHA1
ca89b0e21209caf635aae906927070eb3d09a4bf
-
SHA256
8b893cde796921deb7a83a618842db19064c9b2ac49e5caf7214eb860118172d
-
SHA512
0993328ce9e98fe0441ee2c33d67a9b4e8cfa8b52d1b6fd975f0adfa17de970ee90504afe1bf6af93d4e92af2f23bc37fc733abf29bae734407f01417de6c140
Malware Config
Signatures
-
LoaderBot executable 1 IoCs
Processes:
resource yara_rule behavioral1/memory/1540-54-0x0000000000160000-0x000000000016A000-memory.dmp loaderbot -
Drops startup file 1 IoCs
Processes:
8b893cde796921deb7a83a618842db19064c9b2ac49e5caf7214eb860118172d.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Webhost.url 8b893cde796921deb7a83a618842db19064c9b2ac49e5caf7214eb860118172d.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
8b893cde796921deb7a83a618842db19064c9b2ac49e5caf7214eb860118172d.exe8b893cde796921deb7a83a618842db19064c9b2ac49e5caf7214eb860118172d.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-335065374-4263250628-1829373619-1000\Software\Microsoft\Windows\CurrentVersion\Run\Webhost = "C:\\Users\\Admin\\AppData\\Roaming\\Windows\\8b893cde796921deb7a83a618842db19064c9b2ac49e5caf7214eb860118172d.exe" 8b893cde796921deb7a83a618842db19064c9b2ac49e5caf7214eb860118172d.exe Set value (str) \REGISTRY\USER\S-1-5-21-335065374-4263250628-1829373619-1000\Software\Microsoft\Windows\CurrentVersion\Run\Webhost = "C:\\Users\\Admin\\AppData\\Roaming\\Windows\\8b893cde796921deb7a83a618842db19064c9b2ac49e5caf7214eb860118172d.exe" 8b893cde796921deb7a83a618842db19064c9b2ac49e5caf7214eb860118172d.exe -
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
Processes:
schtasks.exeschtasks.exepid process 1896 schtasks.exe 2004 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
8b893cde796921deb7a83a618842db19064c9b2ac49e5caf7214eb860118172d.exe8b893cde796921deb7a83a618842db19064c9b2ac49e5caf7214eb860118172d.exepid process 1540 8b893cde796921deb7a83a618842db19064c9b2ac49e5caf7214eb860118172d.exe 1700 8b893cde796921deb7a83a618842db19064c9b2ac49e5caf7214eb860118172d.exe -
Suspicious behavior: RenamesItself 1 IoCs
Processes:
8b893cde796921deb7a83a618842db19064c9b2ac49e5caf7214eb860118172d.exepid process 1540 8b893cde796921deb7a83a618842db19064c9b2ac49e5caf7214eb860118172d.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
8b893cde796921deb7a83a618842db19064c9b2ac49e5caf7214eb860118172d.exe8b893cde796921deb7a83a618842db19064c9b2ac49e5caf7214eb860118172d.exedescription pid process Token: SeDebugPrivilege 1540 8b893cde796921deb7a83a618842db19064c9b2ac49e5caf7214eb860118172d.exe Token: SeDebugPrivilege 1700 8b893cde796921deb7a83a618842db19064c9b2ac49e5caf7214eb860118172d.exe -
Suspicious use of WriteProcessMemory 20 IoCs
Processes:
8b893cde796921deb7a83a618842db19064c9b2ac49e5caf7214eb860118172d.execmd.exetaskeng.exe8b893cde796921deb7a83a618842db19064c9b2ac49e5caf7214eb860118172d.execmd.exedescription pid process target process PID 1540 wrote to memory of 1524 1540 8b893cde796921deb7a83a618842db19064c9b2ac49e5caf7214eb860118172d.exe cmd.exe PID 1540 wrote to memory of 1524 1540 8b893cde796921deb7a83a618842db19064c9b2ac49e5caf7214eb860118172d.exe cmd.exe PID 1540 wrote to memory of 1524 1540 8b893cde796921deb7a83a618842db19064c9b2ac49e5caf7214eb860118172d.exe cmd.exe PID 1540 wrote to memory of 1524 1540 8b893cde796921deb7a83a618842db19064c9b2ac49e5caf7214eb860118172d.exe cmd.exe PID 1524 wrote to memory of 2004 1524 cmd.exe schtasks.exe PID 1524 wrote to memory of 2004 1524 cmd.exe schtasks.exe PID 1524 wrote to memory of 2004 1524 cmd.exe schtasks.exe PID 1524 wrote to memory of 2004 1524 cmd.exe schtasks.exe PID 1708 wrote to memory of 1700 1708 taskeng.exe 8b893cde796921deb7a83a618842db19064c9b2ac49e5caf7214eb860118172d.exe PID 1708 wrote to memory of 1700 1708 taskeng.exe 8b893cde796921deb7a83a618842db19064c9b2ac49e5caf7214eb860118172d.exe PID 1708 wrote to memory of 1700 1708 taskeng.exe 8b893cde796921deb7a83a618842db19064c9b2ac49e5caf7214eb860118172d.exe PID 1708 wrote to memory of 1700 1708 taskeng.exe 8b893cde796921deb7a83a618842db19064c9b2ac49e5caf7214eb860118172d.exe PID 1700 wrote to memory of 1072 1700 8b893cde796921deb7a83a618842db19064c9b2ac49e5caf7214eb860118172d.exe cmd.exe PID 1700 wrote to memory of 1072 1700 8b893cde796921deb7a83a618842db19064c9b2ac49e5caf7214eb860118172d.exe cmd.exe PID 1700 wrote to memory of 1072 1700 8b893cde796921deb7a83a618842db19064c9b2ac49e5caf7214eb860118172d.exe cmd.exe PID 1700 wrote to memory of 1072 1700 8b893cde796921deb7a83a618842db19064c9b2ac49e5caf7214eb860118172d.exe cmd.exe PID 1072 wrote to memory of 1896 1072 cmd.exe schtasks.exe PID 1072 wrote to memory of 1896 1072 cmd.exe schtasks.exe PID 1072 wrote to memory of 1896 1072 cmd.exe schtasks.exe PID 1072 wrote to memory of 1896 1072 cmd.exe schtasks.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\8b893cde796921deb7a83a618842db19064c9b2ac49e5caf7214eb860118172d.exe"C:\Users\Admin\AppData\Local\Temp\8b893cde796921deb7a83a618842db19064c9b2ac49e5caf7214eb860118172d.exe"1⤵
- Drops startup file
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1540 -
C:\Windows\SysWOW64\cmd.exe"cmd" /C schtasks /create /tn \System\SecurityServiceUpdate /tr %userprofile%\AppData\Roaming\Windows\8b893cde796921deb7a83a618842db19064c9b2ac49e5caf7214eb860118172d.exe /st 00:00 /du 9999:59 /sc daily /ri 5 /f2⤵
- Suspicious use of WriteProcessMemory
PID:1524 -
C:\Windows\SysWOW64\schtasks.exeschtasks /create /tn \System\SecurityServiceUpdate /tr C:\Users\Admin\AppData\Roaming\Windows\8b893cde796921deb7a83a618842db19064c9b2ac49e5caf7214eb860118172d.exe /st 00:00 /du 9999:59 /sc daily /ri 5 /f3⤵
- Creates scheduled task(s)
PID:2004
-
C:\Windows\system32\taskeng.exetaskeng.exe {51DDEA60-4743-4E6C-A7C3-2EF379D3520C} S-1-5-21-335065374-4263250628-1829373619-1000:RTYPLWYY\Admin:Interactive:[1]1⤵
- Suspicious use of WriteProcessMemory
PID:1708 -
C:\Users\Admin\AppData\Roaming\Windows\8b893cde796921deb7a83a618842db19064c9b2ac49e5caf7214eb860118172d.exeC:\Users\Admin\AppData\Roaming\Windows\8b893cde796921deb7a83a618842db19064c9b2ac49e5caf7214eb860118172d.exe2⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1700 -
C:\Windows\SysWOW64\cmd.exe"cmd" /C schtasks /create /tn \System\SecurityServiceUpdate /tr %userprofile%\AppData\Roaming\Windows\8b893cde796921deb7a83a618842db19064c9b2ac49e5caf7214eb860118172d.exe /st 00:00 /du 9999:59 /sc daily /ri 5 /f3⤵
- Suspicious use of WriteProcessMemory
PID:1072 -
C:\Windows\SysWOW64\schtasks.exeschtasks /create /tn \System\SecurityServiceUpdate /tr C:\Users\Admin\AppData\Roaming\Windows\8b893cde796921deb7a83a618842db19064c9b2ac49e5caf7214eb860118172d.exe /st 00:00 /du 9999:59 /sc daily /ri 5 /f4⤵
- Creates scheduled task(s)
PID:1896