loaderbot | 91723a9ace6dfdf0edbb50cc4f45336e7830d92d3199df875301be79a83ba0c3

Analysis

max time kernel
38s
max time network
62s
platform
windows10-1703_x64
resource
win10-20220812-en
resource tags

arch:x64arch:x86image:win10-20220812-enlocale:en-usos:windows10-1703-x64system
submitted
09-09-2022 04:19

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

91723a9ace6dfdf0edbb50cc4f45336e7830d92d3199df875301be79a83ba0c3.exe
Size

4.0MB
MD5

dd4022cf436e30b6f6c6df7d27a6fa8e
SHA1

5ca8d97c078b65202cada04bcad4111f6cfa9be6
SHA256

91723a9ace6dfdf0edbb50cc4f45336e7830d92d3199df875301be79a83ba0c3
SHA512

272133fa1e7278a03a97b37f8b93df2ee11c721448e1c6025c5409ef35a945c32d91e7dd3aed33fce5c229da38ede3d5b2adf6ef772296257db4be088bdcca1f
SSDEEP

49152:VNDFFPJu8fBsVE6ij+RNg+UKpBvtqB3m1RC3:TzP88fBsnZTgOtqB3m1RC3

Score

10^/10

loaderbot xmrig loader miner persistence

Malware Config

Extracted

Family

loaderbot

http://cr71642.tmweb.ru/cmd.php

Signatures

LoaderBot
LoaderBot is a loader written in .NET downloading and executing miners.
loader miner loaderbot
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

LoaderBot executable 1 IoCs

resource	yara_rule
behavioral2/memory/4248-151-0x0000000000AD0000-0x0000000000ECE000-memory.dmp	loaderbot

XMRig Miner payload 2 IoCs

miner

resource	yara_rule
behavioral2/memory/3436-195-0x0000000140000000-0x0000000140B75000-memory.dmp	xmrig
behavioral2/memory/3436-208-0x0000000140000000-0x0000000140B75000-memory.dmp	xmrig

Executes dropped EXE 1 IoCs

pid	Process
3436	Driver.exe

Drops startup file 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Driver.url	91723a9ace6dfdf0edbb50cc4f45336e7830d92d3199df875301be79a83ba0c3.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000\Software\Microsoft\Windows\CurrentVersion\Run\Driver = "C:\\Users\\Admin\\AppData\\Roaming\\Sysfiles\\91723a9ace6dfdf0edbb50cc4f45336e7830d92d3199df875301be79a83ba0c3.exe"	91723a9ace6dfdf0edbb50cc4f45336e7830d92d3199df875301be79a83ba0c3.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4248	91723a9ace6dfdf0edbb50cc4f45336e7830d92d3199df875301be79a83ba0c3.exe
4248	91723a9ace6dfdf0edbb50cc4f45336e7830d92d3199df875301be79a83ba0c3.exe
4248	91723a9ace6dfdf0edbb50cc4f45336e7830d92d3199df875301be79a83ba0c3.exe
4248	91723a9ace6dfdf0edbb50cc4f45336e7830d92d3199df875301be79a83ba0c3.exe
4248	91723a9ace6dfdf0edbb50cc4f45336e7830d92d3199df875301be79a83ba0c3.exe
4248	91723a9ace6dfdf0edbb50cc4f45336e7830d92d3199df875301be79a83ba0c3.exe
4248	91723a9ace6dfdf0edbb50cc4f45336e7830d92d3199df875301be79a83ba0c3.exe
4248	91723a9ace6dfdf0edbb50cc4f45336e7830d92d3199df875301be79a83ba0c3.exe
4248	91723a9ace6dfdf0edbb50cc4f45336e7830d92d3199df875301be79a83ba0c3.exe
4248	91723a9ace6dfdf0edbb50cc4f45336e7830d92d3199df875301be79a83ba0c3.exe
4248	91723a9ace6dfdf0edbb50cc4f45336e7830d92d3199df875301be79a83ba0c3.exe
4248	91723a9ace6dfdf0edbb50cc4f45336e7830d92d3199df875301be79a83ba0c3.exe
4248	91723a9ace6dfdf0edbb50cc4f45336e7830d92d3199df875301be79a83ba0c3.exe
4248	91723a9ace6dfdf0edbb50cc4f45336e7830d92d3199df875301be79a83ba0c3.exe
4248	91723a9ace6dfdf0edbb50cc4f45336e7830d92d3199df875301be79a83ba0c3.exe
4248	91723a9ace6dfdf0edbb50cc4f45336e7830d92d3199df875301be79a83ba0c3.exe
4248	91723a9ace6dfdf0edbb50cc4f45336e7830d92d3199df875301be79a83ba0c3.exe
4248	91723a9ace6dfdf0edbb50cc4f45336e7830d92d3199df875301be79a83ba0c3.exe
4248	91723a9ace6dfdf0edbb50cc4f45336e7830d92d3199df875301be79a83ba0c3.exe
4248	91723a9ace6dfdf0edbb50cc4f45336e7830d92d3199df875301be79a83ba0c3.exe
4248	91723a9ace6dfdf0edbb50cc4f45336e7830d92d3199df875301be79a83ba0c3.exe
4248	91723a9ace6dfdf0edbb50cc4f45336e7830d92d3199df875301be79a83ba0c3.exe
4248	91723a9ace6dfdf0edbb50cc4f45336e7830d92d3199df875301be79a83ba0c3.exe
4248	91723a9ace6dfdf0edbb50cc4f45336e7830d92d3199df875301be79a83ba0c3.exe
4248	91723a9ace6dfdf0edbb50cc4f45336e7830d92d3199df875301be79a83ba0c3.exe
4248	91723a9ace6dfdf0edbb50cc4f45336e7830d92d3199df875301be79a83ba0c3.exe
4248	91723a9ace6dfdf0edbb50cc4f45336e7830d92d3199df875301be79a83ba0c3.exe
4248	91723a9ace6dfdf0edbb50cc4f45336e7830d92d3199df875301be79a83ba0c3.exe
4248	91723a9ace6dfdf0edbb50cc4f45336e7830d92d3199df875301be79a83ba0c3.exe
4248	91723a9ace6dfdf0edbb50cc4f45336e7830d92d3199df875301be79a83ba0c3.exe
4248	91723a9ace6dfdf0edbb50cc4f45336e7830d92d3199df875301be79a83ba0c3.exe
4248	91723a9ace6dfdf0edbb50cc4f45336e7830d92d3199df875301be79a83ba0c3.exe
4248	91723a9ace6dfdf0edbb50cc4f45336e7830d92d3199df875301be79a83ba0c3.exe
4248	91723a9ace6dfdf0edbb50cc4f45336e7830d92d3199df875301be79a83ba0c3.exe
4248	91723a9ace6dfdf0edbb50cc4f45336e7830d92d3199df875301be79a83ba0c3.exe
4248	91723a9ace6dfdf0edbb50cc4f45336e7830d92d3199df875301be79a83ba0c3.exe
4248	91723a9ace6dfdf0edbb50cc4f45336e7830d92d3199df875301be79a83ba0c3.exe
4248	91723a9ace6dfdf0edbb50cc4f45336e7830d92d3199df875301be79a83ba0c3.exe
4248	91723a9ace6dfdf0edbb50cc4f45336e7830d92d3199df875301be79a83ba0c3.exe
4248	91723a9ace6dfdf0edbb50cc4f45336e7830d92d3199df875301be79a83ba0c3.exe
4248	91723a9ace6dfdf0edbb50cc4f45336e7830d92d3199df875301be79a83ba0c3.exe
4248	91723a9ace6dfdf0edbb50cc4f45336e7830d92d3199df875301be79a83ba0c3.exe
4248	91723a9ace6dfdf0edbb50cc4f45336e7830d92d3199df875301be79a83ba0c3.exe
4248	91723a9ace6dfdf0edbb50cc4f45336e7830d92d3199df875301be79a83ba0c3.exe
4248	91723a9ace6dfdf0edbb50cc4f45336e7830d92d3199df875301be79a83ba0c3.exe
4248	91723a9ace6dfdf0edbb50cc4f45336e7830d92d3199df875301be79a83ba0c3.exe
4248	91723a9ace6dfdf0edbb50cc4f45336e7830d92d3199df875301be79a83ba0c3.exe
4248	91723a9ace6dfdf0edbb50cc4f45336e7830d92d3199df875301be79a83ba0c3.exe
4248	91723a9ace6dfdf0edbb50cc4f45336e7830d92d3199df875301be79a83ba0c3.exe
4248	91723a9ace6dfdf0edbb50cc4f45336e7830d92d3199df875301be79a83ba0c3.exe
4248	91723a9ace6dfdf0edbb50cc4f45336e7830d92d3199df875301be79a83ba0c3.exe
4248	91723a9ace6dfdf0edbb50cc4f45336e7830d92d3199df875301be79a83ba0c3.exe
4248	91723a9ace6dfdf0edbb50cc4f45336e7830d92d3199df875301be79a83ba0c3.exe
4248	91723a9ace6dfdf0edbb50cc4f45336e7830d92d3199df875301be79a83ba0c3.exe
4248	91723a9ace6dfdf0edbb50cc4f45336e7830d92d3199df875301be79a83ba0c3.exe
4248	91723a9ace6dfdf0edbb50cc4f45336e7830d92d3199df875301be79a83ba0c3.exe
4248	91723a9ace6dfdf0edbb50cc4f45336e7830d92d3199df875301be79a83ba0c3.exe
4248	91723a9ace6dfdf0edbb50cc4f45336e7830d92d3199df875301be79a83ba0c3.exe
4248	91723a9ace6dfdf0edbb50cc4f45336e7830d92d3199df875301be79a83ba0c3.exe
4248	91723a9ace6dfdf0edbb50cc4f45336e7830d92d3199df875301be79a83ba0c3.exe
4248	91723a9ace6dfdf0edbb50cc4f45336e7830d92d3199df875301be79a83ba0c3.exe
4248	91723a9ace6dfdf0edbb50cc4f45336e7830d92d3199df875301be79a83ba0c3.exe
4248	91723a9ace6dfdf0edbb50cc4f45336e7830d92d3199df875301be79a83ba0c3.exe
4248	91723a9ace6dfdf0edbb50cc4f45336e7830d92d3199df875301be79a83ba0c3.exe

Suspicious behavior: LoadsDriver 1 IoCs

pid	Process
624	Process not Found

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
4248	91723a9ace6dfdf0edbb50cc4f45336e7830d92d3199df875301be79a83ba0c3.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	4248	91723a9ace6dfdf0edbb50cc4f45336e7830d92d3199df875301be79a83ba0c3.exe
Token: SeLockMemoryPrivilege	3436	Driver.exe
Token: SeLockMemoryPrivilege	3436	Driver.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 4248 wrote to memory of 3436	4248	91723a9ace6dfdf0edbb50cc4f45336e7830d92d3199df875301be79a83ba0c3.exe	68
PID 4248 wrote to memory of 3436	4248	91723a9ace6dfdf0edbb50cc4f45336e7830d92d3199df875301be79a83ba0c3.exe	68

C:\Users\Admin\AppData\Local\Temp\91723a9ace6dfdf0edbb50cc4f45336e7830d92d3199df875301be79a83ba0c3.exe
"C:\Users\Admin\AppData\Local\Temp\91723a9ace6dfdf0edbb50cc4f45336e7830d92d3199df875301be79a83ba0c3.exe"
1⤵
- Drops startup file
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4248
- C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe
  "C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe" -o pool.supportxmr.com:3333 -u 4A6YbBqeVz2Hd8WXVCBy9MEvTyKebGFkS1Nz169ZpjpHfM3UDEcmsQ5ik7cETwGAHaahsx85dx5QxXkTjBKftvm3SfLLr17 -p x -k -v=0 --donate-level=1 -t 1
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:3436

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe

Filesize
3.9MB

MD5
02569a7a91a71133d4a1023bf32aa6f4

SHA1
0f16bcb3f3f085d3d3be912195558e9f9680d574

SHA256
8d6abba9b216172cfc64b8802db0d20a1c634c96e1049f451eddba2363966bf0

SHA512
534be1fe93ee556a14cfd8fad5377f57fb056ab4cd2bca14e4f376f4a25d3d4d270917d68a90b3c40d8a8daaeba6f592fa095ecff478332ba23405d1df728322

Download Submit
C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe

Filesize
3.9MB

MD5
02569a7a91a71133d4a1023bf32aa6f4

SHA1
0f16bcb3f3f085d3d3be912195558e9f9680d574

SHA256
8d6abba9b216172cfc64b8802db0d20a1c634c96e1049f451eddba2363966bf0

SHA512
534be1fe93ee556a14cfd8fad5377f57fb056ab4cd2bca14e4f376f4a25d3d4d270917d68a90b3c40d8a8daaeba6f592fa095ecff478332ba23405d1df728322

Download Submit
memory/3436-195-0x0000000140000000-0x0000000140B75000-memory.dmp

Filesize
11.5MB

Download
memory/3436-207-0x0000000000000000-0x0000000001000000-memory.dmp

Filesize
16.0MB

Download
memory/3436-208-0x0000000140000000-0x0000000140B75000-memory.dmp

Filesize
11.5MB

Download
memory/4248-150-0x0000000076E80000-0x000000007700E000-memory.dmp

Filesize
1.6MB

Download
memory/4248-133-0x0000000076E80000-0x000000007700E000-memory.dmp

Filesize
1.6MB

Download
memory/4248-122-0x0000000076E80000-0x000000007700E000-memory.dmp

Filesize
1.6MB

Download
memory/4248-123-0x0000000076E80000-0x000000007700E000-memory.dmp

Filesize
1.6MB

Download
memory/4248-124-0x0000000076E80000-0x000000007700E000-memory.dmp

Filesize
1.6MB

Download
memory/4248-125-0x0000000076E80000-0x000000007700E000-memory.dmp

Filesize
1.6MB

Download
memory/4248-126-0x0000000076E80000-0x000000007700E000-memory.dmp

Filesize
1.6MB

Download
memory/4248-127-0x0000000076E80000-0x000000007700E000-memory.dmp

Filesize
1.6MB

Download
memory/4248-128-0x0000000076E80000-0x000000007700E000-memory.dmp

Filesize
1.6MB

Download
memory/4248-129-0x0000000076E80000-0x000000007700E000-memory.dmp

Filesize
1.6MB

Download
memory/4248-130-0x0000000076E80000-0x000000007700E000-memory.dmp

Filesize
1.6MB

Download
memory/4248-131-0x0000000076E80000-0x000000007700E000-memory.dmp

Filesize
1.6MB

Download
memory/4248-132-0x0000000076E80000-0x000000007700E000-memory.dmp

Filesize
1.6MB

Download
memory/4248-153-0x0000000076E80000-0x000000007700E000-memory.dmp

Filesize
1.6MB

Download
memory/4248-134-0x0000000076E80000-0x000000007700E000-memory.dmp

Filesize
1.6MB

Download
memory/4248-135-0x0000000076E80000-0x000000007700E000-memory.dmp

Filesize
1.6MB

Download
memory/4248-136-0x0000000076E80000-0x000000007700E000-memory.dmp

Filesize
1.6MB

Download
memory/4248-137-0x0000000076E80000-0x000000007700E000-memory.dmp

Filesize
1.6MB

Download
memory/4248-138-0x0000000076E80000-0x000000007700E000-memory.dmp

Filesize
1.6MB

Download
memory/4248-139-0x0000000076E80000-0x000000007700E000-memory.dmp

Filesize
1.6MB

Download
memory/4248-140-0x0000000076E80000-0x000000007700E000-memory.dmp

Filesize
1.6MB

Download
memory/4248-141-0x0000000076E80000-0x000000007700E000-memory.dmp

Filesize
1.6MB

Download
memory/4248-142-0x0000000076E80000-0x000000007700E000-memory.dmp

Filesize
1.6MB

Download
memory/4248-143-0x0000000076E80000-0x000000007700E000-memory.dmp

Filesize
1.6MB

Download
memory/4248-144-0x0000000076E80000-0x000000007700E000-memory.dmp

Filesize
1.6MB

Download
memory/4248-145-0x0000000076E80000-0x000000007700E000-memory.dmp

Filesize
1.6MB

Download
memory/4248-146-0x0000000076E80000-0x000000007700E000-memory.dmp

Filesize
1.6MB

Download
memory/4248-147-0x0000000076E80000-0x000000007700E000-memory.dmp

Filesize
1.6MB

Download
memory/4248-148-0x0000000076E80000-0x000000007700E000-memory.dmp

Filesize
1.6MB

Download
memory/4248-149-0x0000000076E80000-0x000000007700E000-memory.dmp

Filesize
1.6MB

Download
memory/4248-154-0x0000000076E80000-0x000000007700E000-memory.dmp

Filesize
1.6MB

Download
memory/4248-151-0x0000000000AD0000-0x0000000000ECE000-memory.dmp

Filesize
4.0MB

Download
memory/4248-157-0x0000000076E80000-0x000000007700E000-memory.dmp

Filesize
1.6MB

Download
memory/4248-121-0x0000000076E80000-0x000000007700E000-memory.dmp

Filesize
1.6MB

Download
memory/4248-120-0x0000000076E80000-0x000000007700E000-memory.dmp

Filesize
1.6MB

Download
memory/4248-155-0x0000000076E80000-0x000000007700E000-memory.dmp

Filesize
1.6MB

Download
memory/4248-156-0x0000000076E80000-0x000000007700E000-memory.dmp

Filesize
1.6MB

Download
memory/4248-152-0x0000000076E80000-0x000000007700E000-memory.dmp

Filesize
1.6MB

Download
memory/4248-158-0x0000000076E80000-0x000000007700E000-memory.dmp

Filesize
1.6MB

Download
memory/4248-159-0x0000000076E80000-0x000000007700E000-memory.dmp

Filesize
1.6MB

Download
memory/4248-160-0x0000000076E80000-0x000000007700E000-memory.dmp

Filesize
1.6MB

Download
memory/4248-161-0x0000000076E80000-0x000000007700E000-memory.dmp

Filesize
1.6MB

Download
memory/4248-162-0x00000000059F0000-0x0000000005A56000-memory.dmp

Filesize
408KB

Download
memory/4248-163-0x0000000076E80000-0x000000007700E000-memory.dmp

Filesize
1.6MB

Download
memory/4248-164-0x0000000076E80000-0x000000007700E000-memory.dmp

Filesize
1.6MB

Download
memory/4248-165-0x0000000076E80000-0x000000007700E000-memory.dmp

Filesize
1.6MB

Download
memory/4248-166-0x0000000076E80000-0x000000007700E000-memory.dmp

Filesize
1.6MB

Download
memory/4248-167-0x0000000076E80000-0x000000007700E000-memory.dmp

Filesize
1.6MB

Download
memory/4248-169-0x0000000076E80000-0x000000007700E000-memory.dmp

Filesize
1.6MB

Download
memory/4248-168-0x0000000076E80000-0x000000007700E000-memory.dmp

Filesize
1.6MB

Download
memory/4248-170-0x0000000076E80000-0x000000007700E000-memory.dmp

Filesize
1.6MB

Download
memory/4248-171-0x0000000076E80000-0x000000007700E000-memory.dmp

Filesize
1.6MB

Download
memory/4248-172-0x0000000076E80000-0x000000007700E000-memory.dmp

Filesize
1.6MB

Download
memory/4248-173-0x0000000076E80000-0x000000007700E000-memory.dmp

Filesize
1.6MB

Download
memory/4248-174-0x0000000076E80000-0x000000007700E000-memory.dmp

Filesize
1.6MB

Download
memory/4248-175-0x0000000076E80000-0x000000007700E000-memory.dmp

Filesize
1.6MB

Download
memory/4248-176-0x0000000076E80000-0x000000007700E000-memory.dmp

Filesize
1.6MB

Download
memory/4248-177-0x0000000076E80000-0x000000007700E000-memory.dmp

Filesize
1.6MB

Download
memory/4248-178-0x0000000076E80000-0x000000007700E000-memory.dmp

Filesize
1.6MB

Download
memory/4248-179-0x0000000076E80000-0x000000007700E000-memory.dmp

Filesize
1.6MB

Download
memory/4248-180-0x0000000076E80000-0x000000007700E000-memory.dmp

Filesize
1.6MB

Download
memory/4248-181-0x0000000076E80000-0x000000007700E000-memory.dmp

Filesize
1.6MB

Download
memory/4248-119-0x0000000076E80000-0x000000007700E000-memory.dmp

Filesize
1.6MB

Download
memory/4248-184-0x0000000076E80000-0x000000007700E000-memory.dmp

Filesize
1.6MB

Download
memory/4248-185-0x0000000076E80000-0x000000007700E000-memory.dmp

Filesize
1.6MB

Download
memory/4248-187-0x0000000076E80000-0x000000007700E000-memory.dmp

Filesize
1.6MB

Download