Analysis
-
max time kernel
17s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20230703-en -
resource tags
arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system -
submitted
27-07-2023 14:19
Behavioral task
behavioral1
Sample
0x0009000000017559-78.exe
Resource
win7-20230712-en
Behavioral task
behavioral2
Sample
0x0009000000017559-78.exe
Resource
win10v2004-20230703-en
General
-
Target
0x0009000000017559-78.exe
-
Size
4.0MB
-
MD5
d0cc6d35827351c327a72dbd86542d2f
-
SHA1
ebd3d0bf770e05e0f93c4241e7169d39cc86e5fd
-
SHA256
3a662fa4c1c6b1b2e4ee8ae6ef9f6c3e8d0c9c19644a8cab9f8b5ec803614bc8
-
SHA512
7c10261f20ededeaf1c1df7609040d91affbfcc2b7a2b2d7ef88d78c66efd1767e1c9c79fbcc5889e397d078337c40ab902088c99e20fc6258695103fed56ea4
-
SSDEEP
49152:ZNDFFPJu8fBsVE6ij+RNg+UKpBvtqB3m1RC3:PzP88fBsnZTgOtqB3m1RC3
Malware Config
Signatures
-
LoaderBot executable 1 IoCs
resource yara_rule behavioral2/memory/1304-134-0x0000000000660000-0x0000000000A5E000-memory.dmp loaderbot -
XMRig Miner payload 19 IoCs
resource yara_rule behavioral2/memory/4336-151-0x0000000140000000-0x0000000140B75000-memory.dmp xmrig behavioral2/memory/4172-157-0x0000000140000000-0x0000000140B75000-memory.dmp xmrig behavioral2/memory/4172-158-0x0000000140000000-0x0000000140B75000-memory.dmp xmrig behavioral2/memory/4172-159-0x0000000140000000-0x0000000140B75000-memory.dmp xmrig behavioral2/memory/4172-164-0x0000000140000000-0x0000000140B75000-memory.dmp xmrig behavioral2/memory/4172-169-0x0000000140000000-0x0000000140B75000-memory.dmp xmrig behavioral2/memory/4172-170-0x0000000140000000-0x0000000140B75000-memory.dmp xmrig behavioral2/memory/4172-171-0x0000000140000000-0x0000000140B75000-memory.dmp xmrig behavioral2/memory/4172-172-0x0000000140000000-0x0000000140B75000-memory.dmp xmrig behavioral2/memory/2288-179-0x0000000140000000-0x0000000140B75000-memory.dmp xmrig behavioral2/memory/2288-180-0x0000000140000000-0x0000000140B75000-memory.dmp xmrig behavioral2/memory/2288-181-0x0000000140000000-0x0000000140B75000-memory.dmp xmrig behavioral2/memory/2288-185-0x0000000140000000-0x0000000140B75000-memory.dmp xmrig behavioral2/memory/628-191-0x0000000140000000-0x0000000140B75000-memory.dmp xmrig behavioral2/memory/628-192-0x0000000140000000-0x0000000140B75000-memory.dmp xmrig behavioral2/memory/628-193-0x0000000140000000-0x0000000140B75000-memory.dmp xmrig behavioral2/memory/628-200-0x0000000140000000-0x0000000140B75000-memory.dmp xmrig behavioral2/memory/628-203-0x0000000140000000-0x0000000140B75000-memory.dmp xmrig behavioral2/memory/628-204-0x0000000140000000-0x0000000140B75000-memory.dmp xmrig -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-1420546310-613437930-2990200354-1000\Control Panel\International\Geo\Nation 0x0009000000017559-78.exe -
Drops startup file 1 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Driver.url 0x0009000000017559-78.exe -
Executes dropped EXE 2 IoCs
pid Process 4336 Driver.exe 4172 Driver.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1420546310-613437930-2990200354-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Driver = "C:\\Users\\Admin\\AppData\\Roaming\\Sysfiles\\0x0009000000017559-78.exe" 0x0009000000017559-78.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 2 IoCs
pid pid_target Process procid_target 3868 4336 WerFault.exe 95 3136 4172 WerFault.exe 101 -
Suspicious behavior: EnumeratesProcesses 46 IoCs
pid Process 1304 0x0009000000017559-78.exe 1304 0x0009000000017559-78.exe 1304 0x0009000000017559-78.exe 1304 0x0009000000017559-78.exe 1304 0x0009000000017559-78.exe 1304 0x0009000000017559-78.exe 1304 0x0009000000017559-78.exe 1304 0x0009000000017559-78.exe 1304 0x0009000000017559-78.exe 1304 0x0009000000017559-78.exe 1304 0x0009000000017559-78.exe 1304 0x0009000000017559-78.exe 1304 0x0009000000017559-78.exe 1304 0x0009000000017559-78.exe 1304 0x0009000000017559-78.exe 1304 0x0009000000017559-78.exe 1304 0x0009000000017559-78.exe 1304 0x0009000000017559-78.exe 1304 0x0009000000017559-78.exe 1304 0x0009000000017559-78.exe 1304 0x0009000000017559-78.exe 1304 0x0009000000017559-78.exe 1304 0x0009000000017559-78.exe 1304 0x0009000000017559-78.exe 1304 0x0009000000017559-78.exe 1304 0x0009000000017559-78.exe 1304 0x0009000000017559-78.exe 1304 0x0009000000017559-78.exe 1304 0x0009000000017559-78.exe 1304 0x0009000000017559-78.exe 1304 0x0009000000017559-78.exe 1304 0x0009000000017559-78.exe 1304 0x0009000000017559-78.exe 1304 0x0009000000017559-78.exe 1304 0x0009000000017559-78.exe 1304 0x0009000000017559-78.exe 1304 0x0009000000017559-78.exe 1304 0x0009000000017559-78.exe 1304 0x0009000000017559-78.exe 1304 0x0009000000017559-78.exe 1304 0x0009000000017559-78.exe 1304 0x0009000000017559-78.exe 1304 0x0009000000017559-78.exe 1304 0x0009000000017559-78.exe 1304 0x0009000000017559-78.exe 1304 0x0009000000017559-78.exe -
Suspicious behavior: LoadsDriver 1 IoCs
pid Process 656 Process not Found -
Suspicious behavior: RenamesItself 1 IoCs
pid Process 1304 0x0009000000017559-78.exe -
Suspicious use of AdjustPrivilegeToken 5 IoCs
description pid Process Token: SeDebugPrivilege 1304 0x0009000000017559-78.exe Token: SeLockMemoryPrivilege 4336 Driver.exe Token: SeLockMemoryPrivilege 4336 Driver.exe Token: SeLockMemoryPrivilege 4172 Driver.exe Token: SeLockMemoryPrivilege 4172 Driver.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1304 wrote to memory of 4336 1304 0x0009000000017559-78.exe 95 PID 1304 wrote to memory of 4336 1304 0x0009000000017559-78.exe 95 PID 1304 wrote to memory of 4172 1304 0x0009000000017559-78.exe 101 PID 1304 wrote to memory of 4172 1304 0x0009000000017559-78.exe 101
Processes
-
C:\Users\Admin\AppData\Local\Temp\0x0009000000017559-78.exe"C:\Users\Admin\AppData\Local\Temp\0x0009000000017559-78.exe"1⤵
- Checks computer location settings
- Drops startup file
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1304 -
C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe"C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe" -o pool.supportxmr.com:3333 -u 48yPCPrhTDZ97kRwGzi3DLBQGM8xv77vBAArH3ZfG8dM45UfAUSVHzWZLWnAJSssGGftYqUGSAS8kKWQGpd5o1C7FvNFkNy -p x -k -v=0 --donate-level=1 -t 42⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4336 -
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 4336 -s 7603⤵
- Program crash
PID:3868
-
-
-
C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe"C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe" -o pool.supportxmr.com:3333 -u 48yPCPrhTDZ97kRwGzi3DLBQGM8xv77vBAArH3ZfG8dM45UfAUSVHzWZLWnAJSssGGftYqUGSAS8kKWQGpd5o1C7FvNFkNy -p x -k -v=0 --donate-level=1 -t 42⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4172 -
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 4172 -s 8763⤵
- Program crash
PID:3136
-
-
-
C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe"C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe" -o pool.supportxmr.com:3333 -u 48yPCPrhTDZ97kRwGzi3DLBQGM8xv77vBAArH3ZfG8dM45UfAUSVHzWZLWnAJSssGGftYqUGSAS8kKWQGpd5o1C7FvNFkNy -p x -k -v=0 --donate-level=1 -t 42⤵PID:2288
-
-
C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe"C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe" -o pool.supportxmr.com:3333 -u 48yPCPrhTDZ97kRwGzi3DLBQGM8xv77vBAArH3ZfG8dM45UfAUSVHzWZLWnAJSssGGftYqUGSAS8kKWQGpd5o1C7FvNFkNy -p x -k -v=0 --donate-level=1 -t 42⤵PID:628
-
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -pss -s 444 -p 4336 -ip 43361⤵PID:4364
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -pss -s 520 -p 4172 -ip 41721⤵PID:2620
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3.9MB
MD502569a7a91a71133d4a1023bf32aa6f4
SHA10f16bcb3f3f085d3d3be912195558e9f9680d574
SHA2568d6abba9b216172cfc64b8802db0d20a1c634c96e1049f451eddba2363966bf0
SHA512534be1fe93ee556a14cfd8fad5377f57fb056ab4cd2bca14e4f376f4a25d3d4d270917d68a90b3c40d8a8daaeba6f592fa095ecff478332ba23405d1df728322
-
Filesize
3.9MB
MD502569a7a91a71133d4a1023bf32aa6f4
SHA10f16bcb3f3f085d3d3be912195558e9f9680d574
SHA2568d6abba9b216172cfc64b8802db0d20a1c634c96e1049f451eddba2363966bf0
SHA512534be1fe93ee556a14cfd8fad5377f57fb056ab4cd2bca14e4f376f4a25d3d4d270917d68a90b3c40d8a8daaeba6f592fa095ecff478332ba23405d1df728322
-
Filesize
3.9MB
MD502569a7a91a71133d4a1023bf32aa6f4
SHA10f16bcb3f3f085d3d3be912195558e9f9680d574
SHA2568d6abba9b216172cfc64b8802db0d20a1c634c96e1049f451eddba2363966bf0
SHA512534be1fe93ee556a14cfd8fad5377f57fb056ab4cd2bca14e4f376f4a25d3d4d270917d68a90b3c40d8a8daaeba6f592fa095ecff478332ba23405d1df728322
-
Filesize
3.9MB
MD502569a7a91a71133d4a1023bf32aa6f4
SHA10f16bcb3f3f085d3d3be912195558e9f9680d574
SHA2568d6abba9b216172cfc64b8802db0d20a1c634c96e1049f451eddba2363966bf0
SHA512534be1fe93ee556a14cfd8fad5377f57fb056ab4cd2bca14e4f376f4a25d3d4d270917d68a90b3c40d8a8daaeba6f592fa095ecff478332ba23405d1df728322
-
Filesize
3.9MB
MD502569a7a91a71133d4a1023bf32aa6f4
SHA10f16bcb3f3f085d3d3be912195558e9f9680d574
SHA2568d6abba9b216172cfc64b8802db0d20a1c634c96e1049f451eddba2363966bf0
SHA512534be1fe93ee556a14cfd8fad5377f57fb056ab4cd2bca14e4f376f4a25d3d4d270917d68a90b3c40d8a8daaeba6f592fa095ecff478332ba23405d1df728322
-
Filesize
3.9MB
MD502569a7a91a71133d4a1023bf32aa6f4
SHA10f16bcb3f3f085d3d3be912195558e9f9680d574
SHA2568d6abba9b216172cfc64b8802db0d20a1c634c96e1049f451eddba2363966bf0
SHA512534be1fe93ee556a14cfd8fad5377f57fb056ab4cd2bca14e4f376f4a25d3d4d270917d68a90b3c40d8a8daaeba6f592fa095ecff478332ba23405d1df728322