loaderbot | bd98741688cd682de40435bf3acc408f069f83a6643e8ba2140b65d48d76f8cc

Analysis

max time kernel
62s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20230703-en
resource tags

arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
submitted
28-07-2023 17:51

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

bd98741688cd682de40435bf3_JC.exe
Size

2.1MB
MD5

33c0e224d30d6a384b0a65ed6841db46
SHA1

4212a034fb0f8d348a67af07950a113a00ecbe46
SHA256

bd98741688cd682de40435bf3acc408f069f83a6643e8ba2140b65d48d76f8cc
SHA512

cefafd4e94f0bf43749b3f86a26047d5f00fd2567ba1a8cbae5f5b0c5338885b4393750aa2694e4dbdbffbace0520bf9fae138dabb0bae5791c7d131b834cb5b
SSDEEP

49152:kBqk0bbljM7cERDkZ6tFd+hHZdSlDzKu2MTEsQWeW2Zn:uN0va7XRDdUdGDzKu9Tt92Zn

Score

10^/10

loaderbot xmrig loader miner persistence

Malware Config

Signatures

LoaderBot
LoaderBot is a loader written in .NET downloading and executing miners.
loader miner loaderbot
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

LoaderBot executable 4 IoCs

resource	yara_rule
behavioral2/files/0x000800000002320b-147.dat	loaderbot
behavioral2/files/0x000800000002320b-153.dat	loaderbot
behavioral2/files/0x000800000002320b-154.dat	loaderbot
behavioral2/memory/3520-155-0x0000000000840000-0x0000000000C3E000-memory.dmp	loaderbot

XMRig Miner payload 15 IoCs

miner

resource	yara_rule
behavioral2/memory/5072-173-0x0000000140000000-0x0000000140B75000-memory.dmp	xmrig
behavioral2/memory/3512-179-0x0000000140000000-0x0000000140B75000-memory.dmp	xmrig
behavioral2/memory/3512-180-0x0000000140000000-0x0000000140B75000-memory.dmp	xmrig
behavioral2/memory/3512-181-0x0000000140000000-0x0000000140B75000-memory.dmp	xmrig
behavioral2/memory/3512-186-0x0000000140000000-0x0000000140B75000-memory.dmp	xmrig
behavioral2/memory/3512-191-0x0000000140000000-0x0000000140B75000-memory.dmp	xmrig
behavioral2/memory/3512-192-0x0000000140000000-0x0000000140B75000-memory.dmp	xmrig
behavioral2/memory/3512-193-0x0000000140000000-0x0000000140B75000-memory.dmp	xmrig
behavioral2/memory/3512-194-0x0000000140000000-0x0000000140B75000-memory.dmp	xmrig
behavioral2/memory/3512-195-0x0000000140000000-0x0000000140B75000-memory.dmp	xmrig
behavioral2/memory/3512-196-0x0000000140000000-0x0000000140B75000-memory.dmp	xmrig
behavioral2/memory/3512-197-0x0000000140000000-0x0000000140B75000-memory.dmp	xmrig
behavioral2/memory/3512-198-0x0000000140000000-0x0000000140B75000-memory.dmp	xmrig
behavioral2/memory/3512-199-0x0000000140000000-0x0000000140B75000-memory.dmp	xmrig
behavioral2/memory/3512-200-0x0000000140000000-0x0000000140B75000-memory.dmp	xmrig

Checks computer location settings 2 TTPs 3 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3195054982-4292022746-1467505928-1000\Control Panel\International\Geo\Nation	bd98741688cd682de40435bf3_JC.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3195054982-4292022746-1467505928-1000\Control Panel\International\Geo\Nation	work.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3195054982-4292022746-1467505928-1000\Control Panel\International\Geo\Nation	dwa.exe

Drops startup file 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Driver.url	dwa.exe

Executes dropped EXE 4 IoCs

pid	Process
4068	work.exe
3520	dwa.exe
5072	Driver.exe
3512	Driver.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3195054982-4292022746-1467505928-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Driver = "C:\\Users\\Admin\\AppData\\Roaming\\Sysfiles\\dwa.exe"	dwa.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1980	5072	WerFault.exe	99

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3520	dwa.exe
3520	dwa.exe
3520	dwa.exe
3520	dwa.exe
3520	dwa.exe
3520	dwa.exe
3520	dwa.exe
3520	dwa.exe
3520	dwa.exe
3520	dwa.exe
3520	dwa.exe
3520	dwa.exe
3520	dwa.exe
3520	dwa.exe
3520	dwa.exe
3520	dwa.exe
3520	dwa.exe
3520	dwa.exe
3520	dwa.exe
3520	dwa.exe
3520	dwa.exe
3520	dwa.exe
3520	dwa.exe
3520	dwa.exe
3520	dwa.exe
3520	dwa.exe
3520	dwa.exe
3520	dwa.exe
3520	dwa.exe
3520	dwa.exe
3520	dwa.exe
3520	dwa.exe
3520	dwa.exe
3520	dwa.exe
3520	dwa.exe
3520	dwa.exe
3520	dwa.exe
3520	dwa.exe
3520	dwa.exe
3520	dwa.exe
3520	dwa.exe
3520	dwa.exe
3520	dwa.exe
3520	dwa.exe
3520	dwa.exe
3520	dwa.exe
3520	dwa.exe
3520	dwa.exe
3520	dwa.exe
3520	dwa.exe
3520	dwa.exe
3520	dwa.exe
3520	dwa.exe
3520	dwa.exe
3520	dwa.exe
3520	dwa.exe
3520	dwa.exe
3520	dwa.exe
3520	dwa.exe
3520	dwa.exe
3520	dwa.exe
3520	dwa.exe
3520	dwa.exe
3520	dwa.exe

Suspicious behavior: LoadsDriver 1 IoCs

pid	Process
668	Process not Found

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeDebugPrivilege	3520	dwa.exe
Token: SeLockMemoryPrivilege	5072	Driver.exe
Token: SeLockMemoryPrivilege	5072	Driver.exe
Token: SeLockMemoryPrivilege	3512	Driver.exe
Token: SeLockMemoryPrivilege	3512	Driver.exe

Suspicious use of WriteProcessMemory 13 IoCs

description	pid	Process	procid_target
PID 2108 wrote to memory of 3852	2108	bd98741688cd682de40435bf3_JC.exe	87
PID 2108 wrote to memory of 3852	2108	bd98741688cd682de40435bf3_JC.exe	87
PID 2108 wrote to memory of 3852	2108	bd98741688cd682de40435bf3_JC.exe	87
PID 3852 wrote to memory of 4068	3852	cmd.exe	90
PID 3852 wrote to memory of 4068	3852	cmd.exe	90
PID 3852 wrote to memory of 4068	3852	cmd.exe	90
PID 4068 wrote to memory of 3520	4068	work.exe	91
PID 4068 wrote to memory of 3520	4068	work.exe	91
PID 4068 wrote to memory of 3520	4068	work.exe	91
PID 3520 wrote to memory of 5072	3520	dwa.exe	99
PID 3520 wrote to memory of 5072	3520	dwa.exe	99
PID 3520 wrote to memory of 3512	3520	dwa.exe	106
PID 3520 wrote to memory of 3512	3520	dwa.exe	106

C:\Users\Admin\AppData\Local\Temp\bd98741688cd682de40435bf3_JC.exe
"C:\Users\Admin\AppData\Local\Temp\bd98741688cd682de40435bf3_JC.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:2108
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\RarSFX0\1.bat" "
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3852
- - C:\Users\Admin\AppData\Local\Temp\RarSFX0\work.exe
    work.exe -priverdD
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:4068
  - - C:\Users\Admin\AppData\Local\Temp\RarSFX1\dwa.exe
      "C:\Users\Admin\AppData\Local\Temp\RarSFX1\dwa.exe"
      4⤵
      Checks computer location settings
      Drops startup file
      Executes dropped EXE
      Adds Run key to start application
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:3520
    - - C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe
        
        "C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe" -o pool.supportxmr.com:3333 -u 48yPCPrhTDZ97kRwGzi3DLBQGM8xv77vBAArH3ZfG8dM45UfAUSVHzWZLWnAJSssGGftYqUGSAS8kKWQGpd5o1C7FvNFkNy -p x -k -v=0 --donate-level=1 -t 4
        5⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:5072
      - C:\Windows\system32\WerFault.exe
        
        C:\Windows\system32\WerFault.exe -u -p 5072 -s 760
        6⤵
        Program crash
        
        PID:1980
    - - C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe
        
        "C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe" -o pool.supportxmr.com:3333 -u 48yPCPrhTDZ97kRwGzi3DLBQGM8xv77vBAArH3ZfG8dM45UfAUSVHzWZLWnAJSssGGftYqUGSAS8kKWQGpd5o1C7FvNFkNy -p x -k -v=0 --donate-level=1 -t 4
        5⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:3512

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 424 -p 5072 -ip 5072
1⤵
PID:4840

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\RarSFX0\1.bat

Filesize
35B

MD5
ff59d999beb970447667695ce3273f75

SHA1
316fa09f467ba90ac34a054daf2e92e6e2854ff8

SHA256
065d2b17ad499587dc9de7ee9ecda4938b45da1df388bc72e6627dff220f64d2

SHA512
d5ac72cb065a3cd3cb118a69a2f356314eeed24dcb4880751e1a3683895e66cedc62607967e29f77a0c27adf1c9fe0efd86e804f693f0a63a5b51b0bf0056b5d

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX0\work.exe

Filesize
1.9MB

MD5
9f57a7f949f176935f64330bf6fbf5ff

SHA1
7daeb0f5489d0cab2bf8fa45b5e7fdd18ec06972

SHA256
f7c677268101c552a72c8d224b24cf7a2b42d9bcf90722dc12529b3c1e3d455b

SHA512
a63bab0bb0b646e31a95b53344b183a4fb9809926530d2c27fd410c69e093fdf3e23f51dd51a935ce3c2d63d9cf2210dd9a3a250644fc6d68ac7326946908632

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX0\work.exe

Filesize
1.9MB

MD5
9f57a7f949f176935f64330bf6fbf5ff

SHA1
7daeb0f5489d0cab2bf8fa45b5e7fdd18ec06972

SHA256
f7c677268101c552a72c8d224b24cf7a2b42d9bcf90722dc12529b3c1e3d455b

SHA512
a63bab0bb0b646e31a95b53344b183a4fb9809926530d2c27fd410c69e093fdf3e23f51dd51a935ce3c2d63d9cf2210dd9a3a250644fc6d68ac7326946908632

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX1\dwa.exe

Filesize
4.0MB

MD5
d0cc6d35827351c327a72dbd86542d2f

SHA1
ebd3d0bf770e05e0f93c4241e7169d39cc86e5fd

SHA256
3a662fa4c1c6b1b2e4ee8ae6ef9f6c3e8d0c9c19644a8cab9f8b5ec803614bc8

SHA512
7c10261f20ededeaf1c1df7609040d91affbfcc2b7a2b2d7ef88d78c66efd1767e1c9c79fbcc5889e397d078337c40ab902088c99e20fc6258695103fed56ea4

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX1\dwa.exe

Filesize
4.0MB

MD5
d0cc6d35827351c327a72dbd86542d2f

SHA1
ebd3d0bf770e05e0f93c4241e7169d39cc86e5fd

SHA256
3a662fa4c1c6b1b2e4ee8ae6ef9f6c3e8d0c9c19644a8cab9f8b5ec803614bc8

SHA512
7c10261f20ededeaf1c1df7609040d91affbfcc2b7a2b2d7ef88d78c66efd1767e1c9c79fbcc5889e397d078337c40ab902088c99e20fc6258695103fed56ea4

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX1\dwa.exe

Filesize
4.0MB

MD5
d0cc6d35827351c327a72dbd86542d2f

SHA1
ebd3d0bf770e05e0f93c4241e7169d39cc86e5fd

SHA256
3a662fa4c1c6b1b2e4ee8ae6ef9f6c3e8d0c9c19644a8cab9f8b5ec803614bc8

SHA512
7c10261f20ededeaf1c1df7609040d91affbfcc2b7a2b2d7ef88d78c66efd1767e1c9c79fbcc5889e397d078337c40ab902088c99e20fc6258695103fed56ea4

Download Submit
C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe

Filesize
3.9MB

MD5
02569a7a91a71133d4a1023bf32aa6f4

SHA1
0f16bcb3f3f085d3d3be912195558e9f9680d574

SHA256
8d6abba9b216172cfc64b8802db0d20a1c634c96e1049f451eddba2363966bf0

SHA512
534be1fe93ee556a14cfd8fad5377f57fb056ab4cd2bca14e4f376f4a25d3d4d270917d68a90b3c40d8a8daaeba6f592fa095ecff478332ba23405d1df728322

Download Submit
C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe

Filesize
3.9MB

MD5
02569a7a91a71133d4a1023bf32aa6f4

SHA1
0f16bcb3f3f085d3d3be912195558e9f9680d574

SHA256
8d6abba9b216172cfc64b8802db0d20a1c634c96e1049f451eddba2363966bf0

SHA512
534be1fe93ee556a14cfd8fad5377f57fb056ab4cd2bca14e4f376f4a25d3d4d270917d68a90b3c40d8a8daaeba6f592fa095ecff478332ba23405d1df728322

Download Submit
C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe

Filesize
3.9MB

MD5
02569a7a91a71133d4a1023bf32aa6f4

SHA1
0f16bcb3f3f085d3d3be912195558e9f9680d574

SHA256
8d6abba9b216172cfc64b8802db0d20a1c634c96e1049f451eddba2363966bf0

SHA512
534be1fe93ee556a14cfd8fad5377f57fb056ab4cd2bca14e4f376f4a25d3d4d270917d68a90b3c40d8a8daaeba6f592fa095ecff478332ba23405d1df728322

Download Submit
C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe

Filesize
3.9MB

MD5
02569a7a91a71133d4a1023bf32aa6f4

SHA1
0f16bcb3f3f085d3d3be912195558e9f9680d574

SHA256
8d6abba9b216172cfc64b8802db0d20a1c634c96e1049f451eddba2363966bf0

SHA512
534be1fe93ee556a14cfd8fad5377f57fb056ab4cd2bca14e4f376f4a25d3d4d270917d68a90b3c40d8a8daaeba6f592fa095ecff478332ba23405d1df728322

Download Submit
memory/3512-179-0x0000000140000000-0x0000000140B75000-memory.dmp

Filesize
11.5MB

Download
memory/3512-184-0x0000000002040000-0x0000000002060000-memory.dmp

Filesize
128KB

Download
memory/3512-200-0x0000000140000000-0x0000000140B75000-memory.dmp

Filesize
11.5MB

Download
memory/3512-199-0x0000000140000000-0x0000000140B75000-memory.dmp

Filesize
11.5MB

Download
memory/3512-198-0x0000000140000000-0x0000000140B75000-memory.dmp

Filesize
11.5MB

Download
memory/3512-197-0x0000000140000000-0x0000000140B75000-memory.dmp

Filesize
11.5MB

Download
memory/3512-196-0x0000000140000000-0x0000000140B75000-memory.dmp

Filesize
11.5MB

Download
memory/3512-195-0x0000000140000000-0x0000000140B75000-memory.dmp

Filesize
11.5MB

Download
memory/3512-177-0x0000000000540000-0x0000000000560000-memory.dmp

Filesize
128KB

Download
memory/3512-194-0x0000000140000000-0x0000000140B75000-memory.dmp

Filesize
11.5MB

Download
memory/3512-193-0x0000000140000000-0x0000000140B75000-memory.dmp

Filesize
11.5MB

Download
memory/3512-180-0x0000000140000000-0x0000000140B75000-memory.dmp

Filesize
11.5MB

Download
memory/3512-181-0x0000000140000000-0x0000000140B75000-memory.dmp

Filesize
11.5MB

Download
memory/3512-182-0x0000000000560000-0x0000000000580000-memory.dmp

Filesize
128KB

Download
memory/3512-183-0x0000000000580000-0x00000000005A0000-memory.dmp

Filesize
128KB

Download
memory/3512-192-0x0000000140000000-0x0000000140B75000-memory.dmp

Filesize
11.5MB

Download
memory/3512-185-0x0000000002060000-0x0000000002080000-memory.dmp

Filesize
128KB

Download
memory/3512-186-0x0000000140000000-0x0000000140B75000-memory.dmp

Filesize
11.5MB

Download
memory/3512-187-0x0000000000560000-0x0000000000580000-memory.dmp

Filesize
128KB

Download
memory/3512-188-0x0000000000580000-0x00000000005A0000-memory.dmp

Filesize
128KB

Download
memory/3512-189-0x0000000002040000-0x0000000002060000-memory.dmp

Filesize
128KB

Download
memory/3512-190-0x0000000002060000-0x0000000002080000-memory.dmp

Filesize
128KB

Download
memory/3512-191-0x0000000140000000-0x0000000140B75000-memory.dmp

Filesize
11.5MB

Download
memory/3520-159-0x00000000057A0000-0x0000000005806000-memory.dmp

Filesize
408KB

Download
memory/3520-155-0x0000000000840000-0x0000000000C3E000-memory.dmp

Filesize
4.0MB

Download
memory/3520-178-0x0000000002DB0000-0x0000000002DC0000-memory.dmp

Filesize
64KB

Download
memory/3520-156-0x0000000072C60000-0x0000000073410000-memory.dmp

Filesize
7.7MB

Download
memory/3520-174-0x0000000072C60000-0x0000000073410000-memory.dmp

Filesize
7.7MB

Download
memory/3520-160-0x0000000002DB0000-0x0000000002DC0000-memory.dmp

Filesize
64KB

Download
memory/5072-173-0x0000000140000000-0x0000000140B75000-memory.dmp

Filesize
11.5MB

Download
memory/5072-172-0x00000000004D0000-0x00000000004E4000-memory.dmp

Filesize
80KB

Download
memory/5072-171-0x0000000140000000-0x0000000140B75000-memory.dmp

Filesize
11.5MB

Download