loaderbot | d83eb977fd0bf85f46a32cae0bf864202325ee1b2897aeb6f879da84a18db365

Analysis

max time kernel
22s
max time network
45s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
07-12-2022 06:12

Target

1140-55-0x000000001BD20000-0x000000001C11E000-memory.exe
Size

4.0MB
MD5

18cd1c070e1512dad36082a6db5a1f5d
SHA1

a3658f25e283e3df1be4a3deab4eae8435aeeef7
SHA256

d83eb977fd0bf85f46a32cae0bf864202325ee1b2897aeb6f879da84a18db365
SHA512

4a8aac1e5f58cd15c260fe5bf884cda5b59ac892daa1e948e24311353c8759985c0ae3036a8c4883c70273ad9764f6df7fea1086bede2d59a2e4f03701baa23a
SSDEEP

49152:VNDFFPJu8fBsVE6ij+RNg+UKpBvtqB3m1RC3:TzP88fBsnZTgOtqB3m1RC3

Score

10^/10

LoaderBot
LoaderBot is a loader written in .NET downloading and executing miners.
loader miner loaderbot

LoaderBot executable 1 IoCs

resource	yara_rule
behavioral1/memory/1852-54-0x000000013F0F0000-0x000000013F4EE000-memory.dmp	loaderbot

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1728	1852	WerFault.exe	27

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1852 wrote to memory of 1728	1852	1140-55-0x000000001BD20000-0x000000001C11E000-memory.exe	28
PID 1852 wrote to memory of 1728	1852	1140-55-0x000000001BD20000-0x000000001C11E000-memory.exe	28
PID 1852 wrote to memory of 1728	1852	1140-55-0x000000001BD20000-0x000000001C11E000-memory.exe	28

C:\Users\Admin\AppData\Local\Temp\1140-55-0x000000001BD20000-0x000000001C11E000-memory.exe
"C:\Users\Admin\AppData\Local\Temp\1140-55-0x000000001BD20000-0x000000001C11E000-memory.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1852
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 1852 -s 528
  2⤵
  - Program crash
  PID:1728

memory/1852-54-0x000000013F0F0000-0x000000013F4EE000-memory.dmp

Filesize
4.0MB

Download