Analysis

  • max time kernel
    146s
  • max time network
    131s
  • platform
    windows10-1703_x64
  • resource
    win10-20230703-en
  • resource tags

    arch:x64arch:x86image:win10-20230703-enlocale:en-usos:windows10-1703-x64system
  • submitted
    14/07/2023, 13:38

General

  • Target

    sample.exe

  • Size

    318KB

  • MD5

    f9fed70bc6fc45963c2df36bbe878671

  • SHA1

    ed438defe81324a0cd334ff918ffd2ad67baf141

  • SHA256

    bad65480d4b645263f39ab76311339498ebe84af0cae8dfc2472a15c5f64c1a6

  • SHA512

    b0376190784db236dfce6cd9882ec606c2fce189732c58618081b16f93cfb7ed308abc7a5ee9b8eb01592124b956d26b557f19d4a56fea9b567098739c3cb16d

  • SSDEEP

    6144:sUzicKsfwzUy7Yiro9za0SwqZeNCPIhq+pteQVrLvmgQavC:DzicRfwzLinbCPIhq+pteQpvC

Malware Config

Extracted

Family

mylobot

C2

pqrqtaz.ru:9879

pickcas.ru:6464

quwkbin.ru:3496

rkbupij.ru:6653

pcqmayq.ru:3629

mmuliwe.ru:3541

stoizji.ru:5189

sfdfrhh.ru:3511

ynciazz.ru:4127

mkglhnw.ru:1946

njeeili.ru:9987

dldzeoo.ru:7525

tkbiqjq.ru:5145

uenosbl.ru:2935

faayshc.ru:9865

nttfazc.ru:6761

nfwsyog.ru:7172

uyfusxm.ru:7372

hxkclwx.ru:1294

zgoysam.ru:2338

Signatures

  • Mylobot

    Botnet which first appeared in 2017 written in C++.

  • Deletes itself 1 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Checks SCSI registry key(s) 3 TTPs 2 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Modifies registry class 3 IoCs
  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious behavior: MapViewOfSection 1 IoCs
  • Suspicious use of WriteProcessMemory 20 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\sample.exe
    "C:\Users\Admin\AppData\Local\Temp\sample.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:1632
    • C:\Users\Admin\AppData\Local\Temp\sample.exe
      "C:\Users\Admin\AppData\Local\Temp\sample.exe"
      2⤵
      • Checks SCSI registry key(s)
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: MapViewOfSection
      • Suspicious use of WriteProcessMemory
      PID:2512
      • C:\Windows\SysWOW64\svchost.exe
        "C:\Windows\system32\svchost.exe"
        3⤵
        • Deletes itself
        • Adds Run key to start application
        • Modifies registry class
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of WriteProcessMemory
        PID:5112
        • C:\Windows\SysWOW64\notepad.exe
          "C:\Windows\system32\notepad.exe"
          4⤵
            PID:1420

    Network

    MITRE ATT&CK Enterprise v6

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\ProgramData\{E8BAE61D-C1E1-9667-A062-21A5DF02EF73}\45053682.exe

      Filesize

      318KB

      MD5

      f9fed70bc6fc45963c2df36bbe878671

      SHA1

      ed438defe81324a0cd334ff918ffd2ad67baf141

      SHA256

      bad65480d4b645263f39ab76311339498ebe84af0cae8dfc2472a15c5f64c1a6

      SHA512

      b0376190784db236dfce6cd9882ec606c2fce189732c58618081b16f93cfb7ed308abc7a5ee9b8eb01592124b956d26b557f19d4a56fea9b567098739c3cb16d

    • memory/1420-133-0x0000000000C30000-0x0000000000C31000-memory.dmp

      Filesize

      4KB

    • memory/1632-130-0x00000000001E0000-0x00000000001E1000-memory.dmp

      Filesize

      4KB

    • memory/1632-117-0x00000000001D0000-0x00000000001D1000-memory.dmp

      Filesize

      4KB

    • memory/2512-128-0x0000000000400000-0x0000000000436000-memory.dmp

      Filesize

      216KB

    • memory/2512-118-0x0000000000400000-0x0000000000436000-memory.dmp

      Filesize

      216KB

    • memory/2512-119-0x0000000000400000-0x0000000000436000-memory.dmp

      Filesize

      216KB

    • memory/2512-120-0x0000000000400000-0x0000000000436000-memory.dmp

      Filesize

      216KB

    • memory/2512-121-0x0000000000400000-0x0000000000436000-memory.dmp

      Filesize

      216KB

    • memory/5112-125-0x00000000024D0000-0x0000000002506000-memory.dmp

      Filesize

      216KB

    • memory/5112-124-0x00000000024D0000-0x0000000002506000-memory.dmp

      Filesize

      216KB

    • memory/5112-131-0x00000000024D0000-0x0000000002506000-memory.dmp

      Filesize

      216KB

    • memory/5112-127-0x00000000024D0000-0x0000000002506000-memory.dmp

      Filesize

      216KB

    • memory/5112-126-0x00000000024D0000-0x0000000002506000-memory.dmp

      Filesize

      216KB

    • memory/5112-123-0x00000000024D0000-0x0000000002506000-memory.dmp

      Filesize

      216KB

    • memory/5112-134-0x00000000024D0000-0x0000000002506000-memory.dmp

      Filesize

      216KB

    • memory/5112-122-0x00000000024D0000-0x0000000002506000-memory.dmp

      Filesize

      216KB