plaguebot | 81cb1fa3507209f360261e795cc68622c4163cbb0c6082dc7d8358a04492f961

Analysis

max time kernel
106s
max time network
153s
platform
windows10-1703_x64
resource
win10-20220812-en
resource tags

arch:x64arch:x86image:win10-20220812-enlocale:en-usos:windows10-1703-x64system
submitted
19-10-2022 06:05

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

81cb1fa3507209f360261e795cc68622c4163cbb0c6082dc7d8358a04492f961.exe
Size

967KB
MD5

b03ccade490854df220914c4430967e2
SHA1

1911a59e8c4b427d3fbc8fc9c794886bd2d81305
SHA256

81cb1fa3507209f360261e795cc68622c4163cbb0c6082dc7d8358a04492f961
SHA512

0c05ff99f2d2f448c431073b9a339e6dc1ccab43c9442be44edfd493c3d4d9bd604a0deb792b91295571817113c309bafc6d230b470a4874493561bd5aa9bc36
SSDEEP

24576:xNxsglIPAtgV+rnEQBg2AdqgwGd9OCPltP0gxkR3dCqJO5VxQ75Sf1:57uKrnEQi2Ad/wQPLP0gx1qt5Sf1

Score

10^/10

plaguebot botnet

Malware Config

Signatures

PlagueBot
PlagueBot is an open source Bot written in Pascal.
botnet plaguebot

PlagueBot Executable 4 IoCs

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Roaming\discordnitro\winmgr.exe	plaguebot
C:\Users\Admin\AppData\Roaming\discordnitro\winmgr.exe	plaguebot
C:\Users\Admin\AppData\Roaming\discordnitro\winmgr.exe	plaguebot
C:\Users\Admin\AppData\Roaming\discordnitro\winmgr.exe	plaguebot

Executes dropped EXE 3 IoCs

Processes:

winmgr.exewinmgr.exewinmgr.exe

pid process

3380 winmgr.exe
4104 winmgr.exe
3144 winmgr.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

5116 schtasks.exe

pid	process
3380	winmgr.exe
4104	winmgr.exe
3144	winmgr.exe

pid	process
5116	schtasks.exe

Suspicious use of WriteProcessMemory 9 IoCs

Processes:

81cb1fa3507209f360261e795cc68622c4163cbb0c6082dc7d8358a04492f961.exe

description	pid	process	target process
PID 1524 wrote to memory of 5116	1524	81cb1fa3507209f360261e795cc68622c4163cbb0c6082dc7d8358a04492f961.exe	schtasks.exe
PID 1524 wrote to memory of 5116	1524	81cb1fa3507209f360261e795cc68622c4163cbb0c6082dc7d8358a04492f961.exe	schtasks.exe
PID 1524 wrote to memory of 5116	1524	81cb1fa3507209f360261e795cc68622c4163cbb0c6082dc7d8358a04492f961.exe	schtasks.exe
PID 1524 wrote to memory of 1932	1524	81cb1fa3507209f360261e795cc68622c4163cbb0c6082dc7d8358a04492f961.exe	schtasks.exe
PID 1524 wrote to memory of 1932	1524	81cb1fa3507209f360261e795cc68622c4163cbb0c6082dc7d8358a04492f961.exe	schtasks.exe
PID 1524 wrote to memory of 1932	1524	81cb1fa3507209f360261e795cc68622c4163cbb0c6082dc7d8358a04492f961.exe	schtasks.exe
PID 1524 wrote to memory of 3380	1524	81cb1fa3507209f360261e795cc68622c4163cbb0c6082dc7d8358a04492f961.exe	winmgr.exe
PID 1524 wrote to memory of 3380	1524	81cb1fa3507209f360261e795cc68622c4163cbb0c6082dc7d8358a04492f961.exe	winmgr.exe
PID 1524 wrote to memory of 3380	1524	81cb1fa3507209f360261e795cc68622c4163cbb0c6082dc7d8358a04492f961.exe	winmgr.exe

C:\Users\Admin\AppData\Local\Temp\81cb1fa3507209f360261e795cc68622c4163cbb0c6082dc7d8358a04492f961.exe
"C:\Users\Admin\AppData\Local\Temp\81cb1fa3507209f360261e795cc68622c4163cbb0c6082dc7d8358a04492f961.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1524

C:\Windows\SysWOW64\schtasks.exe
schtasks /Query /FO "LIST" /TN "WinManager"
2⤵
PID:1932

C:\Windows\SysWOW64\schtasks.exe
schtasks /Create /TN "WinManager" /XML "C:\Users\Admin\AppData\Local\Temp\NewTask.xml"
2⤵
- Creates scheduled task(s)
PID:5116

C:\Users\Admin\AppData\Roaming\discordnitro\winmgr.exe
"C:\Users\Admin\AppData\Roaming\discordnitro\winmgr.exe" /wait
2⤵
- Executes dropped EXE
PID:3380

C:\Users\Admin\AppData\Roaming\discordnitro\winmgr.exe
C:\Users\Admin\AppData\Roaming\discordnitro\winmgr.exe
1⤵
- Executes dropped EXE
PID:4104

C:\Users\Admin\AppData\Roaming\discordnitro\winmgr.exe
C:\Users\Admin\AppData\Roaming\discordnitro\winmgr.exe
1⤵
- Executes dropped EXE
PID:3144

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\NewTask.xml
Filesize
1KB

MD5
c5d8937d8884e931d679989e8c499735

SHA1
3e477bd722abfd54324c4bc33c261d32f88f670b

SHA256
287f452b65878996817bb60bcd7e59072ffa095cee338590ccdb8ce4f29618b5

SHA512
ffdb42a4935045e249d0cac96cae50c3c9922664f591fcfece3de41ca8bf2175d3a4390830ad077531d85391844ba328a31104a795de6169de57e26ef3be98b9

Download Submit
C:\Users\Admin\AppData\Roaming\discordnitro\winmgr.exe
Filesize
967KB

MD5
b63bb68654e7be72058398809d6c4754

SHA1
4a7b43488029a2d4c960c9ee4431b99c8640a4b0

SHA256
8db43542d501e7d65d0f1db96785d875bc7da5a51a76ae943fcd3222b66412fe

SHA512
c67280896aa63894933a6058d17a2eb9cea484f5293c095704baaf9f177d9e2779951d803548294584070eb95a3428b52eec9fd5fc1a7da74a6305e7c496e48a

Download Submit
C:\Users\Admin\AppData\Roaming\discordnitro\winmgr.exe
Filesize
967KB

MD5
b63bb68654e7be72058398809d6c4754

SHA1
4a7b43488029a2d4c960c9ee4431b99c8640a4b0

SHA256
8db43542d501e7d65d0f1db96785d875bc7da5a51a76ae943fcd3222b66412fe

SHA512
c67280896aa63894933a6058d17a2eb9cea484f5293c095704baaf9f177d9e2779951d803548294584070eb95a3428b52eec9fd5fc1a7da74a6305e7c496e48a

Download Submit
C:\Users\Admin\AppData\Roaming\discordnitro\winmgr.exe
Filesize
967KB

MD5
b63bb68654e7be72058398809d6c4754

SHA1
4a7b43488029a2d4c960c9ee4431b99c8640a4b0

SHA256
8db43542d501e7d65d0f1db96785d875bc7da5a51a76ae943fcd3222b66412fe

SHA512
c67280896aa63894933a6058d17a2eb9cea484f5293c095704baaf9f177d9e2779951d803548294584070eb95a3428b52eec9fd5fc1a7da74a6305e7c496e48a

Download Submit
C:\Users\Admin\AppData\Roaming\discordnitro\winmgr.exe
Filesize
967KB

MD5
b63bb68654e7be72058398809d6c4754

SHA1
4a7b43488029a2d4c960c9ee4431b99c8640a4b0

SHA256
8db43542d501e7d65d0f1db96785d875bc7da5a51a76ae943fcd3222b66412fe

SHA512
c67280896aa63894933a6058d17a2eb9cea484f5293c095704baaf9f177d9e2779951d803548294584070eb95a3428b52eec9fd5fc1a7da74a6305e7c496e48a

Download Submit
memory/1524-154-0x0000000077290000-0x000000007741E000-memory.dmp

Filesize
1.6MB

Download
memory/1524-136-0x0000000077290000-0x000000007741E000-memory.dmp

Filesize
1.6MB

Download
memory/1524-123-0x0000000077290000-0x000000007741E000-memory.dmp

Filesize
1.6MB

Download
memory/1524-125-0x0000000077290000-0x000000007741E000-memory.dmp

Filesize
1.6MB

Download
memory/1524-128-0x0000000077290000-0x000000007741E000-memory.dmp

Filesize
1.6MB

Download
memory/1524-130-0x0000000077290000-0x000000007741E000-memory.dmp

Filesize
1.6MB

Download
memory/1524-132-0x0000000077290000-0x000000007741E000-memory.dmp

Filesize
1.6MB

Download
memory/1524-144-0x0000000077290000-0x000000007741E000-memory.dmp

Filesize
1.6MB

Download
memory/1524-137-0x0000000077290000-0x000000007741E000-memory.dmp

Filesize
1.6MB

Download
memory/1524-140-0x0000000077290000-0x000000007741E000-memory.dmp

Filesize
1.6MB

Download
memory/1524-141-0x0000000077290000-0x000000007741E000-memory.dmp

Filesize
1.6MB

Download
memory/1524-139-0x0000000077290000-0x000000007741E000-memory.dmp

Filesize
1.6MB

Download
memory/1524-138-0x0000000077290000-0x000000007741E000-memory.dmp

Filesize
1.6MB

Download
memory/1524-118-0x0000000077290000-0x000000007741E000-memory.dmp

Filesize
1.6MB

Download
memory/1524-134-0x0000000077290000-0x000000007741E000-memory.dmp

Filesize
1.6MB

Download
memory/1524-133-0x0000000077290000-0x000000007741E000-memory.dmp

Filesize
1.6MB

Download
memory/1524-131-0x0000000077290000-0x000000007741E000-memory.dmp

Filesize
1.6MB

Download
memory/1524-119-0x0000000077290000-0x000000007741E000-memory.dmp

Filesize
1.6MB

Download
memory/1524-127-0x0000000077290000-0x000000007741E000-memory.dmp

Filesize
1.6MB

Download
memory/1524-126-0x0000000077290000-0x000000007741E000-memory.dmp

Filesize
1.6MB

Download
memory/1524-124-0x0000000077290000-0x000000007741E000-memory.dmp

Filesize
1.6MB

Download
memory/1524-122-0x0000000077290000-0x000000007741E000-memory.dmp

Filesize
1.6MB

Download
memory/1524-145-0x0000000077290000-0x000000007741E000-memory.dmp

Filesize
1.6MB

Download
memory/1524-147-0x0000000077290000-0x000000007741E000-memory.dmp

Filesize
1.6MB

Download
memory/1524-146-0x0000000077290000-0x000000007741E000-memory.dmp

Filesize
1.6MB

Download
memory/1524-149-0x0000000077290000-0x000000007741E000-memory.dmp

Filesize
1.6MB

Download
memory/1524-148-0x0000000077290000-0x000000007741E000-memory.dmp

Filesize
1.6MB

Download
memory/1524-150-0x0000000077290000-0x000000007741E000-memory.dmp

Filesize
1.6MB

Download
memory/1524-151-0x0000000077290000-0x000000007741E000-memory.dmp

Filesize
1.6MB

Download
memory/1524-152-0x0000000077290000-0x000000007741E000-memory.dmp

Filesize
1.6MB

Download
memory/1524-153-0x0000000077290000-0x000000007741E000-memory.dmp

Filesize
1.6MB

Download
memory/1524-116-0x0000000077290000-0x000000007741E000-memory.dmp

Filesize
1.6MB

Download
memory/1524-135-0x0000000077290000-0x000000007741E000-memory.dmp

Filesize
1.6MB

Download
memory/1524-121-0x0000000077290000-0x000000007741E000-memory.dmp

Filesize
1.6MB

Download
memory/1524-129-0x0000000077290000-0x000000007741E000-memory.dmp

Filesize
1.6MB

Download
memory/1524-120-0x0000000077290000-0x000000007741E000-memory.dmp

Filesize
1.6MB

Download
memory/1524-117-0x0000000077290000-0x000000007741E000-memory.dmp

Filesize
1.6MB

Download
memory/1524-142-0x0000000077290000-0x000000007741E000-memory.dmp

Filesize
1.6MB

Download
memory/1524-143-0x0000000077290000-0x000000007741E000-memory.dmp

Filesize
1.6MB

Download
memory/1932-175-0x0000000077290000-0x000000007741E000-memory.dmp

Filesize
1.6MB

Download
memory/1932-174-0x0000000000000000-mapping.dmp

Download
memory/1932-178-0x0000000077290000-0x000000007741E000-memory.dmp

Filesize
1.6MB

Download
memory/1932-179-0x0000000077290000-0x000000007741E000-memory.dmp

Filesize
1.6MB

Download
memory/1932-181-0x0000000077290000-0x000000007741E000-memory.dmp

Filesize
1.6MB

Download
memory/1932-176-0x0000000077290000-0x000000007741E000-memory.dmp

Filesize
1.6MB

Download
memory/1932-180-0x0000000077290000-0x000000007741E000-memory.dmp

Filesize
1.6MB

Download
memory/1932-182-0x0000000077290000-0x000000007741E000-memory.dmp

Filesize
1.6MB

Download
memory/1932-177-0x0000000077290000-0x000000007741E000-memory.dmp

Filesize
1.6MB

Download
memory/3380-202-0x0000000000000000-mapping.dmp

Download
memory/5116-166-0x0000000077290000-0x000000007741E000-memory.dmp

Filesize
1.6MB

Download
memory/5116-157-0x0000000077290000-0x000000007741E000-memory.dmp

Filesize
1.6MB

Download
memory/5116-171-0x0000000077290000-0x000000007741E000-memory.dmp

Filesize
1.6MB

Download
memory/5116-161-0x0000000077290000-0x000000007741E000-memory.dmp

Filesize
1.6MB

Download
memory/5116-159-0x0000000077290000-0x000000007741E000-memory.dmp

Filesize
1.6MB

Download
memory/5116-167-0x0000000077290000-0x000000007741E000-memory.dmp

Filesize
1.6MB

Download
memory/5116-164-0x0000000077290000-0x000000007741E000-memory.dmp

Filesize
1.6MB

Download
memory/5116-162-0x0000000077290000-0x000000007741E000-memory.dmp

Filesize
1.6MB

Download
memory/5116-160-0x0000000077290000-0x000000007741E000-memory.dmp

Filesize
1.6MB

Download
memory/5116-165-0x0000000077290000-0x000000007741E000-memory.dmp

Filesize
1.6MB

Download
memory/5116-155-0x0000000000000000-mapping.dmp

Download
memory/5116-158-0x0000000077290000-0x000000007741E000-memory.dmp

Filesize
1.6MB

Download
memory/5116-156-0x0000000077290000-0x000000007741E000-memory.dmp

Filesize
1.6MB

Download
memory/5116-168-0x0000000077290000-0x000000007741E000-memory.dmp

Filesize
1.6MB

Download
memory/5116-169-0x0000000077290000-0x000000007741E000-memory.dmp

Filesize
1.6MB

Download
memory/5116-170-0x0000000077290000-0x000000007741E000-memory.dmp

Filesize
1.6MB

Download
memory/5116-163-0x0000000077290000-0x000000007741E000-memory.dmp

Filesize
1.6MB

Download
memory/5116-172-0x0000000077290000-0x000000007741E000-memory.dmp

Filesize
1.6MB

Download