mylobot | f9f42884c2ab1389bfd72744d0966d90dd9e7b2678feed102962dc217fc4d772

Analysis

max time kernel
598s
max time network
447s
platform
windows10-2004_x64
resource
win10v2004-20230703-en
resource tags

arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
submitted
08-08-2023 03:15

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

013377c709a1a12da2c17dff933f77a9221923a8acbda2105cb3ff1cf727ab1c.exe
Size

212KB
MD5

c14dcdce694dafc6a81971f9cea546cf
SHA1

7942afd9026704780cbc98f8ea4d66f7cf790b09
SHA256

013377c709a1a12da2c17dff933f77a9221923a8acbda2105cb3ff1cf727ab1c
SHA512

1f2939723f743d3183163acfd434e5735e7d8d3bedbc1c4e4391ce74c0fd5c682f063b1c7738993e6d651f3d1a5592bc2af347cbd63bc73e1e82c36c5e7e8ac4
SSDEEP

3072:Glo6aFcGrvov59zOLgR7fUn5VVccPnWfFzHpUeSS:L6aLov516gs32Wej

Score

10^/10

mylobot botnet persistence

Malware Config

Extracted

Family

mylobot

eakalra.ru:1281

op17.ru:6006

ad21822.ru:8742

urtuifc.ru:1692

nmernrh.ru:4163

bjbhtsc.ru:6239

jmbfgpn.ru:1344

hoebfle.ru:9593

okllxlr.ru:8335

klqzrze.ru:6999

xwstyrt.ru:8627

qgfhmmm.ru:1886

ygdgryq.ru:5843

unsyisl.ru:7365

snzglco.ru:3268

fchbwme.ru:7533

iqaagar.ru:2919

flkpuod.ru:5796

zuenhrs.ru:9439

lqejyjg.ru:4627

Signatures

Mylobot
Botnet which first appeared in 2017 written in C++.
botnet mylobot

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

svchost.exe

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1722984668-1829624581-3022101259-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\{48898391-7E30-D830-1A7A-0EC2C6AEEF0C} = "c:\\programdata\\{D499ABA1-5600-4420-1A7A-0EC2C6AEEF0C}\\79267b3e.exe"	svchost.exe

Modifies registry class 3 IoCs

Processes:

svchost.exe

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1722984668-1829624581-3022101259-1000_Classes\CLSID\{8EBC8C5C-71FD-1E05-1A7A-0EC2C6AEEF0C}	svchost.exe
Key created	\REGISTRY\USER\S-1-5-21-1722984668-1829624581-3022101259-1000_Classes\CLSID\{D499ABA2-5603-4420-1A7A-0EC2C6AEEF0C}	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1722984668-1829624581-3022101259-1000_Classes\CLSID\{D499ABA2-5603-4420-1A7A-0EC2C6AEEF0C}\ = "1691464674"	svchost.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

013377c709a1a12da2c17dff933f77a9221923a8acbda2105cb3ff1cf727ab1c.exesvchost.exe

pid	Process
4480	013377c709a1a12da2c17dff933f77a9221923a8acbda2105cb3ff1cf727ab1c.exe
4480	013377c709a1a12da2c17dff933f77a9221923a8acbda2105cb3ff1cf727ab1c.exe
3048	svchost.exe
3048	svchost.exe

Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

013377c709a1a12da2c17dff933f77a9221923a8acbda2105cb3ff1cf727ab1c.exe

pid	Process
4480	013377c709a1a12da2c17dff933f77a9221923a8acbda2105cb3ff1cf727ab1c.exe

Suspicious use of WriteProcessMemory 10 IoCs

Processes:

013377c709a1a12da2c17dff933f77a9221923a8acbda2105cb3ff1cf727ab1c.exesvchost.exe

description	pid	Process	procid_target
PID 4480 wrote to memory of 3048	4480	013377c709a1a12da2c17dff933f77a9221923a8acbda2105cb3ff1cf727ab1c.exe	81
PID 4480 wrote to memory of 3048	4480	013377c709a1a12da2c17dff933f77a9221923a8acbda2105cb3ff1cf727ab1c.exe	81
PID 4480 wrote to memory of 3048	4480	013377c709a1a12da2c17dff933f77a9221923a8acbda2105cb3ff1cf727ab1c.exe	81
PID 4480 wrote to memory of 3048	4480	013377c709a1a12da2c17dff933f77a9221923a8acbda2105cb3ff1cf727ab1c.exe	81
PID 3048 wrote to memory of 4480	3048	svchost.exe	80
PID 3048 wrote to memory of 3404	3048	svchost.exe	82
PID 3048 wrote to memory of 3404	3048	svchost.exe	82
PID 3048 wrote to memory of 3404	3048	svchost.exe	82
PID 3048 wrote to memory of 3404	3048	svchost.exe	82
PID 3048 wrote to memory of 3404	3048	svchost.exe	82

C:\Users\Admin\AppData\Local\Temp\013377c709a1a12da2c17dff933f77a9221923a8acbda2105cb3ff1cf727ab1c.exe
"C:\Users\Admin\AppData\Local\Temp\013377c709a1a12da2c17dff933f77a9221923a8acbda2105cb3ff1cf727ab1c.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:4480
- C:\Windows\SysWOW64\svchost.exe
  "C:\Windows\system32\svchost.exe"
  2⤵
  - Adds Run key to start application
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:3048
- - C:\Windows\SysWOW64\notepad.exe
    "C:\Windows\system32\notepad.exe"
    3⤵
    PID:3404

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\{D499ABA1-5600-4420-1A7A-0EC2C6AEEF0C}\79267b3e.exe

Filesize
212KB

MD5
c14dcdce694dafc6a81971f9cea546cf

SHA1
7942afd9026704780cbc98f8ea4d66f7cf790b09

SHA256
013377c709a1a12da2c17dff933f77a9221923a8acbda2105cb3ff1cf727ab1c

SHA512
1f2939723f743d3183163acfd434e5735e7d8d3bedbc1c4e4391ce74c0fd5c682f063b1c7738993e6d651f3d1a5592bc2af347cbd63bc73e1e82c36c5e7e8ac4

Download Submit
memory/3048-133-0x0000000000450000-0x0000000000485000-memory.dmp

Filesize
212KB

Download
memory/3048-134-0x0000000000450000-0x0000000000485000-memory.dmp

Filesize
212KB

Download
memory/3048-135-0x0000000000450000-0x0000000000485000-memory.dmp

Filesize
212KB

Download
memory/3048-136-0x0000000000450000-0x0000000000485000-memory.dmp

Filesize
212KB

Download
memory/3048-137-0x0000000000450000-0x0000000000485000-memory.dmp

Filesize
212KB

Download
memory/3048-138-0x0000000000450000-0x0000000000485000-memory.dmp

Filesize
212KB

Download
memory/3048-140-0x0000000000450000-0x0000000000485000-memory.dmp

Filesize
212KB

Download
memory/3404-139-0x0000000000D30000-0x0000000000D31000-memory.dmp

Filesize
4KB

Download