Malware Analysis Report

2024-10-18 23:17

Sample ID 220725-vjqzlsbear
Target 551b7d95d82018d8e33d47267059b30da2863acdb7cab642e4ddf47458643ed2
SHA256 551b7d95d82018d8e33d47267059b30da2863acdb7cab642e4ddf47458643ed2
Tags
loaderbot xmrig loader miner persistence
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V6

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

551b7d95d82018d8e33d47267059b30da2863acdb7cab642e4ddf47458643ed2

Threat Level: Known bad

The file 551b7d95d82018d8e33d47267059b30da2863acdb7cab642e4ddf47458643ed2 was found to be: Known bad.

Malicious Activity Summary

loaderbot xmrig loader miner persistence

LoaderBot executable

xmrig

LoaderBot

Loaderbot family

XMRig Miner payload

LoaderBot executable

Executes dropped EXE

Checks computer location settings

Drops startup file

Loads dropped DLL

Adds Run key to start application

Drops file in System32 directory

Enumerates physical storage devices

Suspicious use of WriteProcessMemory

Checks processor information in registry

Enumerates system info in registry

Suspicious use of AdjustPrivilegeToken

Suspicious behavior: EnumeratesProcesses

Suspicious behavior: RenamesItself

Suspicious behavior: LoadsDriver

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2022-07-25 17:01

Signatures

LoaderBot executable

Description Indicator Process Target
N/A N/A N/A N/A

Loaderbot family

loaderbot

Analysis: behavioral1

Detonation Overview

Submitted

2022-07-25 17:01

Reported

2022-07-26 05:28

Platform

win7-20220715-en

Max time kernel

151s

Max time network

135s

Command Line

"C:\Users\Admin\AppData\Local\Temp\551b7d95d82018d8e33d47267059b30da2863acdb7cab642e4ddf47458643ed2.exe"

Signatures

LoaderBot

loader miner loaderbot

xmrig

miner xmrig

LoaderBot executable

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

XMRig Miner payload

miner
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe N/A

Drops startup file

Description Indicator Process Target
File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Driver.url C:\Users\Admin\AppData\Local\Temp\551b7d95d82018d8e33d47267059b30da2863acdb7cab642e4ddf47458643ed2.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-3440072777-2118400376-1759599358-1000\Software\Microsoft\Windows\CurrentVersion\Run\Driver = "C:\\Users\\Admin\\AppData\\Roaming\\Sysfiles\\551b7d95d82018d8e33d47267059b30da2863acdb7cab642e4ddf47458643ed2.exe" C:\Users\Admin\AppData\Local\Temp\551b7d95d82018d8e33d47267059b30da2863acdb7cab642e4ddf47458643ed2.exe N/A

Enumerates physical storage devices

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\551b7d95d82018d8e33d47267059b30da2863acdb7cab642e4ddf47458643ed2.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\551b7d95d82018d8e33d47267059b30da2863acdb7cab642e4ddf47458643ed2.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\551b7d95d82018d8e33d47267059b30da2863acdb7cab642e4ddf47458643ed2.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\551b7d95d82018d8e33d47267059b30da2863acdb7cab642e4ddf47458643ed2.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\551b7d95d82018d8e33d47267059b30da2863acdb7cab642e4ddf47458643ed2.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\551b7d95d82018d8e33d47267059b30da2863acdb7cab642e4ddf47458643ed2.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\551b7d95d82018d8e33d47267059b30da2863acdb7cab642e4ddf47458643ed2.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\551b7d95d82018d8e33d47267059b30da2863acdb7cab642e4ddf47458643ed2.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\551b7d95d82018d8e33d47267059b30da2863acdb7cab642e4ddf47458643ed2.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\551b7d95d82018d8e33d47267059b30da2863acdb7cab642e4ddf47458643ed2.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\551b7d95d82018d8e33d47267059b30da2863acdb7cab642e4ddf47458643ed2.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\551b7d95d82018d8e33d47267059b30da2863acdb7cab642e4ddf47458643ed2.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\551b7d95d82018d8e33d47267059b30da2863acdb7cab642e4ddf47458643ed2.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\551b7d95d82018d8e33d47267059b30da2863acdb7cab642e4ddf47458643ed2.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\551b7d95d82018d8e33d47267059b30da2863acdb7cab642e4ddf47458643ed2.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\551b7d95d82018d8e33d47267059b30da2863acdb7cab642e4ddf47458643ed2.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\551b7d95d82018d8e33d47267059b30da2863acdb7cab642e4ddf47458643ed2.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\551b7d95d82018d8e33d47267059b30da2863acdb7cab642e4ddf47458643ed2.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\551b7d95d82018d8e33d47267059b30da2863acdb7cab642e4ddf47458643ed2.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\551b7d95d82018d8e33d47267059b30da2863acdb7cab642e4ddf47458643ed2.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\551b7d95d82018d8e33d47267059b30da2863acdb7cab642e4ddf47458643ed2.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\551b7d95d82018d8e33d47267059b30da2863acdb7cab642e4ddf47458643ed2.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\551b7d95d82018d8e33d47267059b30da2863acdb7cab642e4ddf47458643ed2.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\551b7d95d82018d8e33d47267059b30da2863acdb7cab642e4ddf47458643ed2.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\551b7d95d82018d8e33d47267059b30da2863acdb7cab642e4ddf47458643ed2.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\551b7d95d82018d8e33d47267059b30da2863acdb7cab642e4ddf47458643ed2.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\551b7d95d82018d8e33d47267059b30da2863acdb7cab642e4ddf47458643ed2.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\551b7d95d82018d8e33d47267059b30da2863acdb7cab642e4ddf47458643ed2.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\551b7d95d82018d8e33d47267059b30da2863acdb7cab642e4ddf47458643ed2.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\551b7d95d82018d8e33d47267059b30da2863acdb7cab642e4ddf47458643ed2.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\551b7d95d82018d8e33d47267059b30da2863acdb7cab642e4ddf47458643ed2.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\551b7d95d82018d8e33d47267059b30da2863acdb7cab642e4ddf47458643ed2.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\551b7d95d82018d8e33d47267059b30da2863acdb7cab642e4ddf47458643ed2.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\551b7d95d82018d8e33d47267059b30da2863acdb7cab642e4ddf47458643ed2.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\551b7d95d82018d8e33d47267059b30da2863acdb7cab642e4ddf47458643ed2.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\551b7d95d82018d8e33d47267059b30da2863acdb7cab642e4ddf47458643ed2.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\551b7d95d82018d8e33d47267059b30da2863acdb7cab642e4ddf47458643ed2.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\551b7d95d82018d8e33d47267059b30da2863acdb7cab642e4ddf47458643ed2.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\551b7d95d82018d8e33d47267059b30da2863acdb7cab642e4ddf47458643ed2.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\551b7d95d82018d8e33d47267059b30da2863acdb7cab642e4ddf47458643ed2.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\551b7d95d82018d8e33d47267059b30da2863acdb7cab642e4ddf47458643ed2.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\551b7d95d82018d8e33d47267059b30da2863acdb7cab642e4ddf47458643ed2.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\551b7d95d82018d8e33d47267059b30da2863acdb7cab642e4ddf47458643ed2.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\551b7d95d82018d8e33d47267059b30da2863acdb7cab642e4ddf47458643ed2.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\551b7d95d82018d8e33d47267059b30da2863acdb7cab642e4ddf47458643ed2.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\551b7d95d82018d8e33d47267059b30da2863acdb7cab642e4ddf47458643ed2.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\551b7d95d82018d8e33d47267059b30da2863acdb7cab642e4ddf47458643ed2.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\551b7d95d82018d8e33d47267059b30da2863acdb7cab642e4ddf47458643ed2.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\551b7d95d82018d8e33d47267059b30da2863acdb7cab642e4ddf47458643ed2.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\551b7d95d82018d8e33d47267059b30da2863acdb7cab642e4ddf47458643ed2.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\551b7d95d82018d8e33d47267059b30da2863acdb7cab642e4ddf47458643ed2.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\551b7d95d82018d8e33d47267059b30da2863acdb7cab642e4ddf47458643ed2.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\551b7d95d82018d8e33d47267059b30da2863acdb7cab642e4ddf47458643ed2.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\551b7d95d82018d8e33d47267059b30da2863acdb7cab642e4ddf47458643ed2.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\551b7d95d82018d8e33d47267059b30da2863acdb7cab642e4ddf47458643ed2.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\551b7d95d82018d8e33d47267059b30da2863acdb7cab642e4ddf47458643ed2.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\551b7d95d82018d8e33d47267059b30da2863acdb7cab642e4ddf47458643ed2.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\551b7d95d82018d8e33d47267059b30da2863acdb7cab642e4ddf47458643ed2.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\551b7d95d82018d8e33d47267059b30da2863acdb7cab642e4ddf47458643ed2.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\551b7d95d82018d8e33d47267059b30da2863acdb7cab642e4ddf47458643ed2.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\551b7d95d82018d8e33d47267059b30da2863acdb7cab642e4ddf47458643ed2.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\551b7d95d82018d8e33d47267059b30da2863acdb7cab642e4ddf47458643ed2.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\551b7d95d82018d8e33d47267059b30da2863acdb7cab642e4ddf47458643ed2.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\551b7d95d82018d8e33d47267059b30da2863acdb7cab642e4ddf47458643ed2.exe N/A

Suspicious behavior: LoadsDriver

Description Indicator Process Target
N/A N/A N/A N/A

Suspicious behavior: RenamesItself

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\551b7d95d82018d8e33d47267059b30da2863acdb7cab642e4ddf47458643ed2.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\551b7d95d82018d8e33d47267059b30da2863acdb7cab642e4ddf47458643ed2.exe N/A
Token: SeLockMemoryPrivilege N/A C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe N/A
Token: SeLockMemoryPrivilege N/A C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\551b7d95d82018d8e33d47267059b30da2863acdb7cab642e4ddf47458643ed2.exe

"C:\Users\Admin\AppData\Local\Temp\551b7d95d82018d8e33d47267059b30da2863acdb7cab642e4ddf47458643ed2.exe"

C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe

"C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe" -o gulf.moneroocean.stream:10128 -u 4AtkMz9HEF6QawKvDu1ZyU8covdLT1geJMCpUQRYEofDh6rZxTkcpCoVRrrFrC1BVdH7H9u1szcxsQWDoXyuciuQLmYCWCF -p x -k -v=0 --donate-level=1 -t 1

Network

Country Destination Domain Proto
US 8.8.8.8:53 gulf.moneroocean.stream udp
DE 51.75.64.249:10128 gulf.moneroocean.stream tcp

Files

memory/852-54-0x00000000010C0000-0x0000000001520000-memory.dmp

memory/852-55-0x0000000076021000-0x0000000076023000-memory.dmp

\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe

MD5 c58b9de8d4554c6718264f55c9861cfd
SHA1 2e120be3d952d9deefc8972519d452bab8814156
SHA256 c371d06d30f5afea4fa0bf62f7ea104d3073c688802cdac21d33b4464e9beff4
SHA512 2d64f80a507b6bb6001b1c8eea09e5d7c7ede93ae3b670ec2db809b46ebead1758abe9b485ce4bb28440b8ad7164594fca08d28198f2c8cd807dbc9eb36d0335

memory/1576-57-0x0000000000000000-mapping.dmp

C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe

MD5 c58b9de8d4554c6718264f55c9861cfd
SHA1 2e120be3d952d9deefc8972519d452bab8814156
SHA256 c371d06d30f5afea4fa0bf62f7ea104d3073c688802cdac21d33b4464e9beff4
SHA512 2d64f80a507b6bb6001b1c8eea09e5d7c7ede93ae3b670ec2db809b46ebead1758abe9b485ce4bb28440b8ad7164594fca08d28198f2c8cd807dbc9eb36d0335

memory/1576-59-0x0000000001090000-0x00000000010A4000-memory.dmp

memory/852-60-0x00000000069C0000-0x000000000764D000-memory.dmp

memory/1576-61-0x0000000000400000-0x000000000108D000-memory.dmp

memory/1576-62-0x0000000000000000-0x0000000001000000-memory.dmp

memory/852-63-0x00000000069C0000-0x000000000764D000-memory.dmp

memory/1576-64-0x0000000000400000-0x000000000108D000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2022-07-25 17:01

Reported

2022-07-26 05:28

Platform

win10v2004-20220721-en

Max time kernel

151s

Max time network

146s

Command Line

"C:\Users\Admin\AppData\Local\Temp\551b7d95d82018d8e33d47267059b30da2863acdb7cab642e4ddf47458643ed2.exe"

Signatures

LoaderBot

loader miner loaderbot

xmrig

miner xmrig

LoaderBot executable

Description Indicator Process Target
N/A N/A N/A N/A

XMRig Miner payload

miner
Description Indicator Process Target
N/A N/A N/A N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-2660308776-3705150086-26593515-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\551b7d95d82018d8e33d47267059b30da2863acdb7cab642e4ddf47458643ed2.exe N/A

Drops startup file

Description Indicator Process Target
File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Driver.url C:\Users\Admin\AppData\Local\Temp\551b7d95d82018d8e33d47267059b30da2863acdb7cab642e4ddf47458643ed2.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-2660308776-3705150086-26593515-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Driver = "C:\\Users\\Admin\\AppData\\Roaming\\Sysfiles\\551b7d95d82018d8e33d47267059b30da2863acdb7cab642e4ddf47458643ed2.exe" C:\Users\Admin\AppData\Local\Temp\551b7d95d82018d8e33d47267059b30da2863acdb7cab642e4ddf47458643ed2.exe N/A

Drops file in System32 directory

Description Indicator Process Target
File created C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\InstallService\{EF349C22-6128-4B3F-8884-0F115792C0A7}.catalogItem C:\Windows\System32\svchost.exe N/A
File created C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\InstallService\{F2A40C65-2F90-4F1E-8CF4-2976E3CCA044}.catalogItem C:\Windows\System32\svchost.exe N/A

Enumerates physical storage devices

Checks processor information in registry

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString C:\Windows\System32\svchost.exe N/A
Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 C:\Windows\System32\svchost.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz C:\Windows\System32\svchost.exe N/A

Enumerates system info in registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS C:\Windows\System32\svchost.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU C:\Windows\System32\svchost.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\551b7d95d82018d8e33d47267059b30da2863acdb7cab642e4ddf47458643ed2.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\551b7d95d82018d8e33d47267059b30da2863acdb7cab642e4ddf47458643ed2.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\551b7d95d82018d8e33d47267059b30da2863acdb7cab642e4ddf47458643ed2.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\551b7d95d82018d8e33d47267059b30da2863acdb7cab642e4ddf47458643ed2.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\551b7d95d82018d8e33d47267059b30da2863acdb7cab642e4ddf47458643ed2.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\551b7d95d82018d8e33d47267059b30da2863acdb7cab642e4ddf47458643ed2.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\551b7d95d82018d8e33d47267059b30da2863acdb7cab642e4ddf47458643ed2.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\551b7d95d82018d8e33d47267059b30da2863acdb7cab642e4ddf47458643ed2.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\551b7d95d82018d8e33d47267059b30da2863acdb7cab642e4ddf47458643ed2.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\551b7d95d82018d8e33d47267059b30da2863acdb7cab642e4ddf47458643ed2.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\551b7d95d82018d8e33d47267059b30da2863acdb7cab642e4ddf47458643ed2.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\551b7d95d82018d8e33d47267059b30da2863acdb7cab642e4ddf47458643ed2.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\551b7d95d82018d8e33d47267059b30da2863acdb7cab642e4ddf47458643ed2.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\551b7d95d82018d8e33d47267059b30da2863acdb7cab642e4ddf47458643ed2.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\551b7d95d82018d8e33d47267059b30da2863acdb7cab642e4ddf47458643ed2.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\551b7d95d82018d8e33d47267059b30da2863acdb7cab642e4ddf47458643ed2.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\551b7d95d82018d8e33d47267059b30da2863acdb7cab642e4ddf47458643ed2.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\551b7d95d82018d8e33d47267059b30da2863acdb7cab642e4ddf47458643ed2.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\551b7d95d82018d8e33d47267059b30da2863acdb7cab642e4ddf47458643ed2.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\551b7d95d82018d8e33d47267059b30da2863acdb7cab642e4ddf47458643ed2.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\551b7d95d82018d8e33d47267059b30da2863acdb7cab642e4ddf47458643ed2.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\551b7d95d82018d8e33d47267059b30da2863acdb7cab642e4ddf47458643ed2.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\551b7d95d82018d8e33d47267059b30da2863acdb7cab642e4ddf47458643ed2.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\551b7d95d82018d8e33d47267059b30da2863acdb7cab642e4ddf47458643ed2.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\551b7d95d82018d8e33d47267059b30da2863acdb7cab642e4ddf47458643ed2.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\551b7d95d82018d8e33d47267059b30da2863acdb7cab642e4ddf47458643ed2.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\551b7d95d82018d8e33d47267059b30da2863acdb7cab642e4ddf47458643ed2.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\551b7d95d82018d8e33d47267059b30da2863acdb7cab642e4ddf47458643ed2.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\551b7d95d82018d8e33d47267059b30da2863acdb7cab642e4ddf47458643ed2.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\551b7d95d82018d8e33d47267059b30da2863acdb7cab642e4ddf47458643ed2.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\551b7d95d82018d8e33d47267059b30da2863acdb7cab642e4ddf47458643ed2.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\551b7d95d82018d8e33d47267059b30da2863acdb7cab642e4ddf47458643ed2.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\551b7d95d82018d8e33d47267059b30da2863acdb7cab642e4ddf47458643ed2.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\551b7d95d82018d8e33d47267059b30da2863acdb7cab642e4ddf47458643ed2.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\551b7d95d82018d8e33d47267059b30da2863acdb7cab642e4ddf47458643ed2.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\551b7d95d82018d8e33d47267059b30da2863acdb7cab642e4ddf47458643ed2.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\551b7d95d82018d8e33d47267059b30da2863acdb7cab642e4ddf47458643ed2.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\551b7d95d82018d8e33d47267059b30da2863acdb7cab642e4ddf47458643ed2.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\551b7d95d82018d8e33d47267059b30da2863acdb7cab642e4ddf47458643ed2.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\551b7d95d82018d8e33d47267059b30da2863acdb7cab642e4ddf47458643ed2.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\551b7d95d82018d8e33d47267059b30da2863acdb7cab642e4ddf47458643ed2.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\551b7d95d82018d8e33d47267059b30da2863acdb7cab642e4ddf47458643ed2.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\551b7d95d82018d8e33d47267059b30da2863acdb7cab642e4ddf47458643ed2.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\551b7d95d82018d8e33d47267059b30da2863acdb7cab642e4ddf47458643ed2.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\551b7d95d82018d8e33d47267059b30da2863acdb7cab642e4ddf47458643ed2.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\551b7d95d82018d8e33d47267059b30da2863acdb7cab642e4ddf47458643ed2.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\551b7d95d82018d8e33d47267059b30da2863acdb7cab642e4ddf47458643ed2.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\551b7d95d82018d8e33d47267059b30da2863acdb7cab642e4ddf47458643ed2.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\551b7d95d82018d8e33d47267059b30da2863acdb7cab642e4ddf47458643ed2.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\551b7d95d82018d8e33d47267059b30da2863acdb7cab642e4ddf47458643ed2.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\551b7d95d82018d8e33d47267059b30da2863acdb7cab642e4ddf47458643ed2.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\551b7d95d82018d8e33d47267059b30da2863acdb7cab642e4ddf47458643ed2.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\551b7d95d82018d8e33d47267059b30da2863acdb7cab642e4ddf47458643ed2.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\551b7d95d82018d8e33d47267059b30da2863acdb7cab642e4ddf47458643ed2.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\551b7d95d82018d8e33d47267059b30da2863acdb7cab642e4ddf47458643ed2.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\551b7d95d82018d8e33d47267059b30da2863acdb7cab642e4ddf47458643ed2.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\551b7d95d82018d8e33d47267059b30da2863acdb7cab642e4ddf47458643ed2.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\551b7d95d82018d8e33d47267059b30da2863acdb7cab642e4ddf47458643ed2.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\551b7d95d82018d8e33d47267059b30da2863acdb7cab642e4ddf47458643ed2.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\551b7d95d82018d8e33d47267059b30da2863acdb7cab642e4ddf47458643ed2.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\551b7d95d82018d8e33d47267059b30da2863acdb7cab642e4ddf47458643ed2.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\551b7d95d82018d8e33d47267059b30da2863acdb7cab642e4ddf47458643ed2.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\551b7d95d82018d8e33d47267059b30da2863acdb7cab642e4ddf47458643ed2.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\551b7d95d82018d8e33d47267059b30da2863acdb7cab642e4ddf47458643ed2.exe N/A

Suspicious behavior: LoadsDriver

Description Indicator Process Target
N/A N/A N/A N/A

Suspicious behavior: RenamesItself

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\551b7d95d82018d8e33d47267059b30da2863acdb7cab642e4ddf47458643ed2.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\551b7d95d82018d8e33d47267059b30da2863acdb7cab642e4ddf47458643ed2.exe N/A
Token: SeLockMemoryPrivilege N/A C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe N/A
Token: SeLockMemoryPrivilege N/A C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\551b7d95d82018d8e33d47267059b30da2863acdb7cab642e4ddf47458643ed2.exe

"C:\Users\Admin\AppData\Local\Temp\551b7d95d82018d8e33d47267059b30da2863acdb7cab642e4ddf47458643ed2.exe"

C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe

"C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe" -o gulf.moneroocean.stream:10128 -u 4AtkMz9HEF6QawKvDu1ZyU8covdLT1geJMCpUQRYEofDh6rZxTkcpCoVRrrFrC1BVdH7H9u1szcxsQWDoXyuciuQLmYCWCF -p x -k -v=0 --donate-level=1 -t 1

C:\Windows\System32\svchost.exe

C:\Windows\System32\svchost.exe -k netsvcs -p

Network

Country Destination Domain Proto
US 131.253.33.200:443 tcp
US 8.8.8.8:53 gulf.moneroocean.stream udp
DE 51.75.64.249:10128 gulf.moneroocean.stream tcp

Files

memory/4324-130-0x00000000001E0000-0x0000000000640000-memory.dmp

memory/4324-131-0x00000000052D0000-0x0000000005336000-memory.dmp

memory/1872-132-0x0000000000000000-mapping.dmp

C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe

MD5 c58b9de8d4554c6718264f55c9861cfd
SHA1 2e120be3d952d9deefc8972519d452bab8814156
SHA256 c371d06d30f5afea4fa0bf62f7ea104d3073c688802cdac21d33b4464e9beff4
SHA512 2d64f80a507b6bb6001b1c8eea09e5d7c7ede93ae3b670ec2db809b46ebead1758abe9b485ce4bb28440b8ad7164594fca08d28198f2c8cd807dbc9eb36d0335

memory/1872-134-0x0000000000400000-0x000000000108D000-memory.dmp

memory/1872-135-0x00000000001A0000-0x00000000001B4000-memory.dmp

memory/1872-136-0x0000000001390000-0x00000000013D0000-memory.dmp

memory/1872-137-0x0000000000400000-0x000000000108D000-memory.dmp

memory/1872-138-0x0000000000000000-0x0000000000200000-memory.dmp

memory/1872-139-0x0000000000000000-0x0000000000200000-memory.dmp