Analysis
-
max time kernel
151s -
max time network
45s -
platform
windows7_x64 -
resource
win7-20220718-en -
resource tags
arch:x64arch:x86image:win7-20220718-enlocale:en-usos:windows7-x64system -
submitted
25-07-2022 01:24
Behavioral task
behavioral1
Sample
56e2baf5c4a18cc9ecf8a5b4d41598488c285016d733fe2e8b1e0fc18cc31c47.exe
Resource
win7-20220718-en
Behavioral task
behavioral2
Sample
56e2baf5c4a18cc9ecf8a5b4d41598488c285016d733fe2e8b1e0fc18cc31c47.exe
Resource
win10v2004-20220721-en
General
-
Target
56e2baf5c4a18cc9ecf8a5b4d41598488c285016d733fe2e8b1e0fc18cc31c47.exe
-
Size
16KB
-
MD5
28f2a2d70f07a4c4693ca44579dd4b81
-
SHA1
f7246bf4ee3fdab958edaa6b717b185d0def17d1
-
SHA256
56e2baf5c4a18cc9ecf8a5b4d41598488c285016d733fe2e8b1e0fc18cc31c47
-
SHA512
1afa1c8d97b13b6363a0c2607b7133ceada6e9065ae802d53ea5d44739a504828e6dcab85ffcddbf8145c7720289f1a52c57c20408965c26dbec5df10c24c8c0
Malware Config
Signatures
-
LoaderBot executable 1 IoCs
Processes:
resource yara_rule behavioral1/memory/1956-54-0x0000000000040000-0x000000000004A000-memory.dmp loaderbot -
Drops startup file 1 IoCs
Processes:
56e2baf5c4a18cc9ecf8a5b4d41598488c285016d733fe2e8b1e0fc18cc31c47.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Webhost.url 56e2baf5c4a18cc9ecf8a5b4d41598488c285016d733fe2e8b1e0fc18cc31c47.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
56e2baf5c4a18cc9ecf8a5b4d41598488c285016d733fe2e8b1e0fc18cc31c47.exe56e2baf5c4a18cc9ecf8a5b4d41598488c285016d733fe2e8b1e0fc18cc31c47.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-3762437355-3468409815-1164039494-1000\Software\Microsoft\Windows\CurrentVersion\Run\Webhost = "C:\\Users\\Admin\\AppData\\Roaming\\Windows\\56e2baf5c4a18cc9ecf8a5b4d41598488c285016d733fe2e8b1e0fc18cc31c47.exe" 56e2baf5c4a18cc9ecf8a5b4d41598488c285016d733fe2e8b1e0fc18cc31c47.exe Set value (str) \REGISTRY\USER\S-1-5-21-3762437355-3468409815-1164039494-1000\Software\Microsoft\Windows\CurrentVersion\Run\Webhost = "C:\\Users\\Admin\\AppData\\Roaming\\Windows\\56e2baf5c4a18cc9ecf8a5b4d41598488c285016d733fe2e8b1e0fc18cc31c47.exe" 56e2baf5c4a18cc9ecf8a5b4d41598488c285016d733fe2e8b1e0fc18cc31c47.exe -
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
Processes:
schtasks.exeschtasks.exepid process 1260 schtasks.exe 2044 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
56e2baf5c4a18cc9ecf8a5b4d41598488c285016d733fe2e8b1e0fc18cc31c47.exe56e2baf5c4a18cc9ecf8a5b4d41598488c285016d733fe2e8b1e0fc18cc31c47.exepid process 1956 56e2baf5c4a18cc9ecf8a5b4d41598488c285016d733fe2e8b1e0fc18cc31c47.exe 1060 56e2baf5c4a18cc9ecf8a5b4d41598488c285016d733fe2e8b1e0fc18cc31c47.exe -
Suspicious behavior: RenamesItself 1 IoCs
Processes:
56e2baf5c4a18cc9ecf8a5b4d41598488c285016d733fe2e8b1e0fc18cc31c47.exepid process 1956 56e2baf5c4a18cc9ecf8a5b4d41598488c285016d733fe2e8b1e0fc18cc31c47.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
56e2baf5c4a18cc9ecf8a5b4d41598488c285016d733fe2e8b1e0fc18cc31c47.exe56e2baf5c4a18cc9ecf8a5b4d41598488c285016d733fe2e8b1e0fc18cc31c47.exedescription pid process Token: SeDebugPrivilege 1956 56e2baf5c4a18cc9ecf8a5b4d41598488c285016d733fe2e8b1e0fc18cc31c47.exe Token: SeDebugPrivilege 1060 56e2baf5c4a18cc9ecf8a5b4d41598488c285016d733fe2e8b1e0fc18cc31c47.exe -
Suspicious use of WriteProcessMemory 20 IoCs
Processes:
56e2baf5c4a18cc9ecf8a5b4d41598488c285016d733fe2e8b1e0fc18cc31c47.execmd.exetaskeng.exe56e2baf5c4a18cc9ecf8a5b4d41598488c285016d733fe2e8b1e0fc18cc31c47.execmd.exedescription pid process target process PID 1956 wrote to memory of 1924 1956 56e2baf5c4a18cc9ecf8a5b4d41598488c285016d733fe2e8b1e0fc18cc31c47.exe cmd.exe PID 1956 wrote to memory of 1924 1956 56e2baf5c4a18cc9ecf8a5b4d41598488c285016d733fe2e8b1e0fc18cc31c47.exe cmd.exe PID 1956 wrote to memory of 1924 1956 56e2baf5c4a18cc9ecf8a5b4d41598488c285016d733fe2e8b1e0fc18cc31c47.exe cmd.exe PID 1956 wrote to memory of 1924 1956 56e2baf5c4a18cc9ecf8a5b4d41598488c285016d733fe2e8b1e0fc18cc31c47.exe cmd.exe PID 1924 wrote to memory of 1260 1924 cmd.exe schtasks.exe PID 1924 wrote to memory of 1260 1924 cmd.exe schtasks.exe PID 1924 wrote to memory of 1260 1924 cmd.exe schtasks.exe PID 1924 wrote to memory of 1260 1924 cmd.exe schtasks.exe PID 572 wrote to memory of 1060 572 taskeng.exe 56e2baf5c4a18cc9ecf8a5b4d41598488c285016d733fe2e8b1e0fc18cc31c47.exe PID 572 wrote to memory of 1060 572 taskeng.exe 56e2baf5c4a18cc9ecf8a5b4d41598488c285016d733fe2e8b1e0fc18cc31c47.exe PID 572 wrote to memory of 1060 572 taskeng.exe 56e2baf5c4a18cc9ecf8a5b4d41598488c285016d733fe2e8b1e0fc18cc31c47.exe PID 572 wrote to memory of 1060 572 taskeng.exe 56e2baf5c4a18cc9ecf8a5b4d41598488c285016d733fe2e8b1e0fc18cc31c47.exe PID 1060 wrote to memory of 1044 1060 56e2baf5c4a18cc9ecf8a5b4d41598488c285016d733fe2e8b1e0fc18cc31c47.exe cmd.exe PID 1060 wrote to memory of 1044 1060 56e2baf5c4a18cc9ecf8a5b4d41598488c285016d733fe2e8b1e0fc18cc31c47.exe cmd.exe PID 1060 wrote to memory of 1044 1060 56e2baf5c4a18cc9ecf8a5b4d41598488c285016d733fe2e8b1e0fc18cc31c47.exe cmd.exe PID 1060 wrote to memory of 1044 1060 56e2baf5c4a18cc9ecf8a5b4d41598488c285016d733fe2e8b1e0fc18cc31c47.exe cmd.exe PID 1044 wrote to memory of 2044 1044 cmd.exe schtasks.exe PID 1044 wrote to memory of 2044 1044 cmd.exe schtasks.exe PID 1044 wrote to memory of 2044 1044 cmd.exe schtasks.exe PID 1044 wrote to memory of 2044 1044 cmd.exe schtasks.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\56e2baf5c4a18cc9ecf8a5b4d41598488c285016d733fe2e8b1e0fc18cc31c47.exe"C:\Users\Admin\AppData\Local\Temp\56e2baf5c4a18cc9ecf8a5b4d41598488c285016d733fe2e8b1e0fc18cc31c47.exe"1⤵
- Drops startup file
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1956 -
C:\Windows\SysWOW64\cmd.exe"cmd" /C schtasks /create /tn \System\SecurityServiceUpdate /tr %userprofile%\AppData\Roaming\Windows\56e2baf5c4a18cc9ecf8a5b4d41598488c285016d733fe2e8b1e0fc18cc31c47.exe /st 00:00 /du 9999:59 /sc daily /ri 5 /f2⤵
- Suspicious use of WriteProcessMemory
PID:1924 -
C:\Windows\SysWOW64\schtasks.exeschtasks /create /tn \System\SecurityServiceUpdate /tr C:\Users\Admin\AppData\Roaming\Windows\56e2baf5c4a18cc9ecf8a5b4d41598488c285016d733fe2e8b1e0fc18cc31c47.exe /st 00:00 /du 9999:59 /sc daily /ri 5 /f3⤵
- Creates scheduled task(s)
PID:1260
-
C:\Windows\system32\taskeng.exetaskeng.exe {0861FA54-0130-45B7-A6CC-3307C4474420} S-1-5-21-3762437355-3468409815-1164039494-1000:TZEOUYSL\Admin:Interactive:[1]1⤵
- Suspicious use of WriteProcessMemory
PID:572 -
C:\Users\Admin\AppData\Roaming\Windows\56e2baf5c4a18cc9ecf8a5b4d41598488c285016d733fe2e8b1e0fc18cc31c47.exeC:\Users\Admin\AppData\Roaming\Windows\56e2baf5c4a18cc9ecf8a5b4d41598488c285016d733fe2e8b1e0fc18cc31c47.exe2⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1060 -
C:\Windows\SysWOW64\cmd.exe"cmd" /C schtasks /create /tn \System\SecurityServiceUpdate /tr %userprofile%\AppData\Roaming\Windows\56e2baf5c4a18cc9ecf8a5b4d41598488c285016d733fe2e8b1e0fc18cc31c47.exe /st 00:00 /du 9999:59 /sc daily /ri 5 /f3⤵
- Suspicious use of WriteProcessMemory
PID:1044 -
C:\Windows\SysWOW64\schtasks.exeschtasks /create /tn \System\SecurityServiceUpdate /tr C:\Users\Admin\AppData\Roaming\Windows\56e2baf5c4a18cc9ecf8a5b4d41598488c285016d733fe2e8b1e0fc18cc31c47.exe /st 00:00 /du 9999:59 /sc daily /ri 5 /f4⤵
- Creates scheduled task(s)
PID:2044