Analysis
-
max time kernel
153s -
max time network
158s -
platform
windows10-2004_x64 -
resource
win10v2004-20220721-en -
submitted
02-08-2022 01:18
Behavioral task
behavioral1
Sample
5b0b780a1caa13c737099f0d389e682cb74e63e62ae53eeed29167e74833977d.exe
Resource
win7-20220718-en
Behavioral task
behavioral2
Sample
5b0b780a1caa13c737099f0d389e682cb74e63e62ae53eeed29167e74833977d.exe
Resource
win10v2004-20220721-en
General
-
Target
5b0b780a1caa13c737099f0d389e682cb74e63e62ae53eeed29167e74833977d.exe
-
Size
16KB
-
MD5
8f9db1d76c8ebcd539121678fd28554d
-
SHA1
446d66da8b0978f6d51cf20cf992a05356c9185a
-
SHA256
5b0b780a1caa13c737099f0d389e682cb74e63e62ae53eeed29167e74833977d
-
SHA512
553382301e7510ba6e461b918ad2c5397ee754ac8128359021b4b6f148a65eae99c022a7a2b53820bed304992f9fc873650d0cf90c40ff9f24d20e30f1f8c20c
-
SSDEEP
384:bm9vAPDVH19GTXjdhiMuujYcV6AUwJFZb:bgyRV9Ah/fYcV6Dw9b
Malware Config
Extracted
loaderbot
http://ih894017.myihor.ru/cmd.php
Signatures
-
LoaderBot executable 1 IoCs
Processes:
resource yara_rule behavioral2/memory/4984-130-0x0000000000EB0000-0x0000000000EBA000-memory.dmp loaderbot -
Drops startup file 1 IoCs
Processes:
5b0b780a1caa13c737099f0d389e682cb74e63e62ae53eeed29167e74833977d.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Webhost.url 5b0b780a1caa13c737099f0d389e682cb74e63e62ae53eeed29167e74833977d.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
5b0b780a1caa13c737099f0d389e682cb74e63e62ae53eeed29167e74833977d.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-1101907861-274115917-2188613224-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Webhost = "C:\\Users\\Admin\\AppData\\Roaming\\Windows\\5b0b780a1caa13c737099f0d389e682cb74e63e62ae53eeed29167e74833977d.exe" 5b0b780a1caa13c737099f0d389e682cb74e63e62ae53eeed29167e74833977d.exe -
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
5b0b780a1caa13c737099f0d389e682cb74e63e62ae53eeed29167e74833977d.exepid process 4984 5b0b780a1caa13c737099f0d389e682cb74e63e62ae53eeed29167e74833977d.exe -
Suspicious behavior: RenamesItself 1 IoCs
Processes:
5b0b780a1caa13c737099f0d389e682cb74e63e62ae53eeed29167e74833977d.exepid process 4984 5b0b780a1caa13c737099f0d389e682cb74e63e62ae53eeed29167e74833977d.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
5b0b780a1caa13c737099f0d389e682cb74e63e62ae53eeed29167e74833977d.exedescription pid process Token: SeDebugPrivilege 4984 5b0b780a1caa13c737099f0d389e682cb74e63e62ae53eeed29167e74833977d.exe -
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
5b0b780a1caa13c737099f0d389e682cb74e63e62ae53eeed29167e74833977d.execmd.exedescription pid process target process PID 4984 wrote to memory of 2092 4984 5b0b780a1caa13c737099f0d389e682cb74e63e62ae53eeed29167e74833977d.exe cmd.exe PID 4984 wrote to memory of 2092 4984 5b0b780a1caa13c737099f0d389e682cb74e63e62ae53eeed29167e74833977d.exe cmd.exe PID 4984 wrote to memory of 2092 4984 5b0b780a1caa13c737099f0d389e682cb74e63e62ae53eeed29167e74833977d.exe cmd.exe PID 2092 wrote to memory of 4608 2092 cmd.exe schtasks.exe PID 2092 wrote to memory of 4608 2092 cmd.exe schtasks.exe PID 2092 wrote to memory of 4608 2092 cmd.exe schtasks.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\5b0b780a1caa13c737099f0d389e682cb74e63e62ae53eeed29167e74833977d.exe"C:\Users\Admin\AppData\Local\Temp\5b0b780a1caa13c737099f0d389e682cb74e63e62ae53eeed29167e74833977d.exe"1⤵
- Drops startup file
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4984 -
C:\Windows\SysWOW64\cmd.exe"cmd" /C schtasks /create /tn \System\SecurityServiceUpdate /tr %userprofile%\AppData\Roaming\Windows\5b0b780a1caa13c737099f0d389e682cb74e63e62ae53eeed29167e74833977d.exe /st 00:00 /du 9999:59 /sc daily /ri 5 /f2⤵
- Suspicious use of WriteProcessMemory
PID:2092 -
C:\Windows\SysWOW64\schtasks.exeschtasks /create /tn \System\SecurityServiceUpdate /tr C:\Users\Admin\AppData\Roaming\Windows\5b0b780a1caa13c737099f0d389e682cb74e63e62ae53eeed29167e74833977d.exe /st 00:00 /du 9999:59 /sc daily /ri 5 /f3⤵
- Creates scheduled task(s)
PID:4608