mylobot | f9f42884c2ab1389bfd72744d0966d90dd9e7b2678feed102962dc217fc4d772

General

Target

013377c709a1a12da2c17dff933f77a9221923a8acbda2105cb3ff1cf727ab1c.exe
Size

212KB
MD5

c14dcdce694dafc6a81971f9cea546cf
SHA1

7942afd9026704780cbc98f8ea4d66f7cf790b09
SHA256

013377c709a1a12da2c17dff933f77a9221923a8acbda2105cb3ff1cf727ab1c
SHA512

1f2939723f743d3183163acfd434e5735e7d8d3bedbc1c4e4391ce74c0fd5c682f063b1c7738993e6d651f3d1a5592bc2af347cbd63bc73e1e82c36c5e7e8ac4
SSDEEP

3072:Glo6aFcGrvov59zOLgR7fUn5VVccPnWfFzHpUeSS:L6aLov516gs32Wej

Score

10^/10

mylobot botnet persistence

Malware Config

Extracted

Family

mylobot

C2

eakalra.ru:1281

op17.ru:6006

ad21822.ru:8742

urtuifc.ru:1692

nmernrh.ru:4163

bjbhtsc.ru:6239

jmbfgpn.ru:1344

hoebfle.ru:9593

okllxlr.ru:8335

klqzrze.ru:6999

xwstyrt.ru:8627

qgfhmmm.ru:1886

ygdgryq.ru:5843

unsyisl.ru:7365

snzglco.ru:3268

fchbwme.ru:7533

iqaagar.ru:2919

flkpuod.ru:5796

zuenhrs.ru:9439

lqejyjg.ru:4627

Signatures

Mylobot
Botnet which first appeared in 2017 written in C++.
botnet mylobot

Deletes itself 1 IoCs

pid	Process
2196	svchost.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-4159544280-4273523227-683900707-1000\Software\Microsoft\Windows\CurrentVersion\Run\{85CEE487-FF7E-39EA-FA21-4682026567C0} = "c:\\programdata\\{19DECCB7-D74E-A5FA-FA21-4682026567C0}\\b4611c28.exe"	svchost.exe

Modifies registry class 3 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-4159544280-4273523227-683900707-1000_CLASSES\CLSID\{19DECCB4-D74D-A5FA-FA21-4682026567C0}\ = "1691464674"	svchost.exe
Key created	\REGISTRY\USER\S-1-5-21-4159544280-4273523227-683900707-1000_CLASSES\CLSID\{43FBEB4A-F0B3-FFDF-FA21-4682026567C0}	svchost.exe
Key created	\REGISTRY\USER\S-1-5-21-4159544280-4273523227-683900707-1000_CLASSES\CLSID\{19DECCB4-D74D-A5FA-FA21-4682026567C0}	svchost.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
2516	013377c709a1a12da2c17dff933f77a9221923a8acbda2105cb3ff1cf727ab1c.exe
2516	013377c709a1a12da2c17dff933f77a9221923a8acbda2105cb3ff1cf727ab1c.exe
2196	svchost.exe

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
2516	013377c709a1a12da2c17dff933f77a9221923a8acbda2105cb3ff1cf727ab1c.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2516 wrote to memory of 2196	2516	013377c709a1a12da2c17dff933f77a9221923a8acbda2105cb3ff1cf727ab1c.exe	2
PID 2516 wrote to memory of 2196	2516	013377c709a1a12da2c17dff933f77a9221923a8acbda2105cb3ff1cf727ab1c.exe	2
PID 2516 wrote to memory of 2196	2516	013377c709a1a12da2c17dff933f77a9221923a8acbda2105cb3ff1cf727ab1c.exe	2
PID 2516 wrote to memory of 2196	2516	013377c709a1a12da2c17dff933f77a9221923a8acbda2105cb3ff1cf727ab1c.exe	2
PID 2516 wrote to memory of 2196	2516	013377c709a1a12da2c17dff933f77a9221923a8acbda2105cb3ff1cf727ab1c.exe	2
PID 2196 wrote to memory of 2472	2196	svchost.exe	1
PID 2196 wrote to memory of 2472	2196	svchost.exe	1
PID 2196 wrote to memory of 2472	2196	svchost.exe	1
PID 2196 wrote to memory of 2472	2196	svchost.exe	1
PID 2196 wrote to memory of 2472	2196	svchost.exe	1
PID 2196 wrote to memory of 2472	2196	svchost.exe	1

C:\Windows\SysWOW64\notepad.exe
"C:\Windows\system32\notepad.exe"
1⤵
PID:2472

C:\Windows\SysWOW64\svchost.exe
"C:\Windows\system32\svchost.exe"
1⤵
- Deletes itself
- Adds Run key to start application
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2196

C:\Users\Admin\AppData\Local\Temp\013377c709a1a12da2c17dff933f77a9221923a8acbda2105cb3ff1cf727ab1c.exe
"C:\Users\Admin\AppData\Local\Temp\013377c709a1a12da2c17dff933f77a9221923a8acbda2105cb3ff1cf727ab1c.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:2516

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\{19DECCB7-D74E-A5FA-FA21-4682026567C0}\b4611c28.exe

Filesize
212KB

MD5
c14dcdce694dafc6a81971f9cea546cf

SHA1
7942afd9026704780cbc98f8ea4d66f7cf790b09

SHA256
013377c709a1a12da2c17dff933f77a9221923a8acbda2105cb3ff1cf727ab1c

SHA512
1f2939723f743d3183163acfd434e5735e7d8d3bedbc1c4e4391ce74c0fd5c682f063b1c7738993e6d651f3d1a5592bc2af347cbd63bc73e1e82c36c5e7e8ac4

Download Submit
memory/2196-65-0x0000000000130000-0x0000000000165000-memory.dmp

Filesize
212KB

Download
memory/2196-59-0x0000000000130000-0x0000000000165000-memory.dmp

Filesize
212KB

Download
memory/2196-58-0x0000000000130000-0x0000000000165000-memory.dmp

Filesize
212KB

Download
memory/2196-57-0x0000000000130000-0x0000000000165000-memory.dmp

Filesize
212KB

Download
memory/2196-56-0x0000000000130000-0x0000000000165000-memory.dmp

Filesize
212KB

Download
memory/2196-55-0x0000000000130000-0x0000000000165000-memory.dmp

Filesize
212KB

Download
memory/2196-54-0x0000000000130000-0x0000000000165000-memory.dmp

Filesize
212KB

Download
memory/2196-53-0x00000000000F0000-0x0000000000125000-memory.dmp

Filesize
212KB

Download
memory/2472-64-0x0000000000080000-0x0000000000081000-memory.dmp

Filesize
4KB

Download
memory/2472-60-0x0000000000090000-0x0000000000091000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads