mylobot | 6c1ae6d646dd7a7bde8d44df53cce9786b3c4e80dd8f521c4fb52afab84e3d32

Analysis

max time kernel
30s
max time network
20s
platform
windows7_x64
resource
win7-20230712-en
resource tags

arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system
submitted
14-08-2023 17:05

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6c1ae6d646dd7a7bde8d44df53cce9786b3c4e80dd8f521c4fb52afab84e3d32.exe
Size

341KB
MD5

745883407bb6296970af2fb650b04312
SHA1

fc84f5d8e989929eef50379f7f62ed26662b4512
SHA256

6c1ae6d646dd7a7bde8d44df53cce9786b3c4e80dd8f521c4fb52afab84e3d32
SHA512

809640cdc63eefe406dc5f7cb1531536363d56801e4c940cc19d16aa5c67e3054f0b77aefe9812638c3842cc2ddef0e66da93c64c58f4fde49f0461237ac1aa1
SSDEEP

6144:GwQqSygIGPB5nAORZLc/4/IVs8mqqWTKlSJv+2zsb:GwQqXGPfnro4/IZfqWeXb

Score

10^/10

mylobot botnet persistence

Malware Config

Extracted

Family

mylobot

op17.ru:6006

eakalra.ru:1281

zgclgdb.ru:8518

hpifnad.ru:3721

lbjcwix.ru:8326

rykacfb.ru:8483

benkofx.ru:3333

fpzskbc.ru:9364

ouxtjzd.ru:8658

schwpxp.ru:2956

pspkgya.ru:2675

lmlwtdm.ru:2768

rzwnsph.ru:5898

awtiwzk.ru:9816

pzljenb.ru:3486

yhjtpyf.ru:3565

ogkbsoq.ru:2553

rjngcbj.ru:5655

jlfeopz.ru:4698

wqcruiz.ru:2165

Signatures

Mylobot
Botnet which first appeared in 2017 written in C++.
botnet mylobot

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

svchost.exe

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-4219371764-2579186923-3390623117-1000\Software\Microsoft\Windows\CurrentVersion\Run\{90D631C9-2BA5-1BEB-BB8F-7B031D076200} = "c:\\programdata\\{0CC619F9-0395-87FB-BB8F-7B031D076200}\\a179c966.exe"	svchost.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

6c1ae6d646dd7a7bde8d44df53cce9786b3c4e80dd8f521c4fb52afab84e3d32.exe

description	pid	Process	procid_target
PID 1532 set thread context of 2444	1532	6c1ae6d646dd7a7bde8d44df53cce9786b3c4e80dd8f521c4fb52afab84e3d32.exe	28

Modifies registry class 1 IoCs

Processes:

svchost.exe

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-4219371764-2579186923-3390623117-1000_CLASSES\CLSID\{56E33E04-2468-DDDE-BB8F-7B031D076200}	svchost.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

Processes:

6c1ae6d646dd7a7bde8d44df53cce9786b3c4e80dd8f521c4fb52afab84e3d32.exesvchost.exe

pid	Process
2444	6c1ae6d646dd7a7bde8d44df53cce9786b3c4e80dd8f521c4fb52afab84e3d32.exe
2444	6c1ae6d646dd7a7bde8d44df53cce9786b3c4e80dd8f521c4fb52afab84e3d32.exe
2392	svchost.exe

Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

6c1ae6d646dd7a7bde8d44df53cce9786b3c4e80dd8f521c4fb52afab84e3d32.exe

pid	Process
2444	6c1ae6d646dd7a7bde8d44df53cce9786b3c4e80dd8f521c4fb52afab84e3d32.exe

Suspicious use of WriteProcessMemory 31 IoCs

Processes:

6c1ae6d646dd7a7bde8d44df53cce9786b3c4e80dd8f521c4fb52afab84e3d32.exe6c1ae6d646dd7a7bde8d44df53cce9786b3c4e80dd8f521c4fb52afab84e3d32.exesvchost.exe

description	pid	Process	procid_target
PID 1532 wrote to memory of 2444	1532	6c1ae6d646dd7a7bde8d44df53cce9786b3c4e80dd8f521c4fb52afab84e3d32.exe	28
PID 1532 wrote to memory of 2444	1532	6c1ae6d646dd7a7bde8d44df53cce9786b3c4e80dd8f521c4fb52afab84e3d32.exe	28
PID 1532 wrote to memory of 2444	1532	6c1ae6d646dd7a7bde8d44df53cce9786b3c4e80dd8f521c4fb52afab84e3d32.exe	28
PID 1532 wrote to memory of 2444	1532	6c1ae6d646dd7a7bde8d44df53cce9786b3c4e80dd8f521c4fb52afab84e3d32.exe	28
PID 1532 wrote to memory of 2432	1532	6c1ae6d646dd7a7bde8d44df53cce9786b3c4e80dd8f521c4fb52afab84e3d32.exe	29
PID 1532 wrote to memory of 2432	1532	6c1ae6d646dd7a7bde8d44df53cce9786b3c4e80dd8f521c4fb52afab84e3d32.exe	29
PID 1532 wrote to memory of 2432	1532	6c1ae6d646dd7a7bde8d44df53cce9786b3c4e80dd8f521c4fb52afab84e3d32.exe	29
PID 1532 wrote to memory of 2432	1532	6c1ae6d646dd7a7bde8d44df53cce9786b3c4e80dd8f521c4fb52afab84e3d32.exe	29
PID 1532 wrote to memory of 2444	1532	6c1ae6d646dd7a7bde8d44df53cce9786b3c4e80dd8f521c4fb52afab84e3d32.exe	28
PID 1532 wrote to memory of 2432	1532	6c1ae6d646dd7a7bde8d44df53cce9786b3c4e80dd8f521c4fb52afab84e3d32.exe	29
PID 1532 wrote to memory of 2444	1532	6c1ae6d646dd7a7bde8d44df53cce9786b3c4e80dd8f521c4fb52afab84e3d32.exe	28
PID 1532 wrote to memory of 2432	1532	6c1ae6d646dd7a7bde8d44df53cce9786b3c4e80dd8f521c4fb52afab84e3d32.exe	29
PID 1532 wrote to memory of 3024	1532	6c1ae6d646dd7a7bde8d44df53cce9786b3c4e80dd8f521c4fb52afab84e3d32.exe	30
PID 1532 wrote to memory of 3024	1532	6c1ae6d646dd7a7bde8d44df53cce9786b3c4e80dd8f521c4fb52afab84e3d32.exe	30
PID 1532 wrote to memory of 3024	1532	6c1ae6d646dd7a7bde8d44df53cce9786b3c4e80dd8f521c4fb52afab84e3d32.exe	30
PID 1532 wrote to memory of 3024	1532	6c1ae6d646dd7a7bde8d44df53cce9786b3c4e80dd8f521c4fb52afab84e3d32.exe	30
PID 1532 wrote to memory of 2444	1532	6c1ae6d646dd7a7bde8d44df53cce9786b3c4e80dd8f521c4fb52afab84e3d32.exe	28
PID 1532 wrote to memory of 2444	1532	6c1ae6d646dd7a7bde8d44df53cce9786b3c4e80dd8f521c4fb52afab84e3d32.exe	28
PID 1532 wrote to memory of 2444	1532	6c1ae6d646dd7a7bde8d44df53cce9786b3c4e80dd8f521c4fb52afab84e3d32.exe	28
PID 1532 wrote to memory of 2432	1532	6c1ae6d646dd7a7bde8d44df53cce9786b3c4e80dd8f521c4fb52afab84e3d32.exe	29
PID 1532 wrote to memory of 3024	1532	6c1ae6d646dd7a7bde8d44df53cce9786b3c4e80dd8f521c4fb52afab84e3d32.exe	30
PID 1532 wrote to memory of 2432	1532	6c1ae6d646dd7a7bde8d44df53cce9786b3c4e80dd8f521c4fb52afab84e3d32.exe	29
PID 1532 wrote to memory of 2444	1532	6c1ae6d646dd7a7bde8d44df53cce9786b3c4e80dd8f521c4fb52afab84e3d32.exe	28
PID 1532 wrote to memory of 2432	1532	6c1ae6d646dd7a7bde8d44df53cce9786b3c4e80dd8f521c4fb52afab84e3d32.exe	29
PID 1532 wrote to memory of 3024	1532	6c1ae6d646dd7a7bde8d44df53cce9786b3c4e80dd8f521c4fb52afab84e3d32.exe	30
PID 2444 wrote to memory of 2392	2444	6c1ae6d646dd7a7bde8d44df53cce9786b3c4e80dd8f521c4fb52afab84e3d32.exe	31
PID 2444 wrote to memory of 2392	2444	6c1ae6d646dd7a7bde8d44df53cce9786b3c4e80dd8f521c4fb52afab84e3d32.exe	31
PID 2444 wrote to memory of 2392	2444	6c1ae6d646dd7a7bde8d44df53cce9786b3c4e80dd8f521c4fb52afab84e3d32.exe	31
PID 2444 wrote to memory of 2392	2444	6c1ae6d646dd7a7bde8d44df53cce9786b3c4e80dd8f521c4fb52afab84e3d32.exe	31
PID 2444 wrote to memory of 2392	2444	6c1ae6d646dd7a7bde8d44df53cce9786b3c4e80dd8f521c4fb52afab84e3d32.exe	31
PID 2392 wrote to memory of 2444	2392	svchost.exe	28

C:\Users\Admin\AppData\Local\Temp\6c1ae6d646dd7a7bde8d44df53cce9786b3c4e80dd8f521c4fb52afab84e3d32.exe
"C:\Users\Admin\AppData\Local\Temp\6c1ae6d646dd7a7bde8d44df53cce9786b3c4e80dd8f521c4fb52afab84e3d32.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1532
- C:\Users\Admin\AppData\Local\Temp\6c1ae6d646dd7a7bde8d44df53cce9786b3c4e80dd8f521c4fb52afab84e3d32.exe
  "C:\Users\Admin\AppData\Local\Temp\6c1ae6d646dd7a7bde8d44df53cce9786b3c4e80dd8f521c4fb52afab84e3d32.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of WriteProcessMemory
  PID:2444
- - C:\Windows\SysWOW64\svchost.exe
    "C:\Windows\system32\svchost.exe"
    3⤵
    - Adds Run key to start application
    - Modifies registry class
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:2392
- C:\Users\Admin\AppData\Local\Temp\6c1ae6d646dd7a7bde8d44df53cce9786b3c4e80dd8f521c4fb52afab84e3d32.exe
  "C:\Users\Admin\AppData\Local\Temp\6c1ae6d646dd7a7bde8d44df53cce9786b3c4e80dd8f521c4fb52afab84e3d32.exe"
  2⤵
  PID:2432
- C:\Users\Admin\AppData\Local\Temp\6c1ae6d646dd7a7bde8d44df53cce9786b3c4e80dd8f521c4fb52afab84e3d32.exe
  "C:\Users\Admin\AppData\Local\Temp\6c1ae6d646dd7a7bde8d44df53cce9786b3c4e80dd8f521c4fb52afab84e3d32.exe"
  2⤵
  PID:3024

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1532-54-0x0000000000460000-0x0000000000461000-memory.dmp

Filesize
4KB

Download
memory/2392-87-0x0000000000080000-0x00000000000AB000-memory.dmp

Filesize
172KB

Download
memory/2392-88-0x0000000000080000-0x00000000000AB000-memory.dmp

Filesize
172KB

Download
memory/2392-83-0x00000000000F0000-0x0000000000146000-memory.dmp

Filesize
344KB

Download
memory/2392-89-0x0000000000080000-0x00000000000AB000-memory.dmp

Filesize
172KB

Download
memory/2392-86-0x0000000000080000-0x00000000000AB000-memory.dmp

Filesize
172KB

Download
memory/2392-84-0x0000000000080000-0x00000000000AB000-memory.dmp

Filesize
172KB

Download
memory/2392-85-0x0000000000080000-0x00000000000AB000-memory.dmp

Filesize
172KB

Download
memory/2392-95-0x0000000000080000-0x00000000000AB000-memory.dmp

Filesize
172KB

Download
memory/2432-92-0x00000000001C0000-0x00000000001C1000-memory.dmp

Filesize
4KB

Download
memory/2444-62-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/2444-81-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/2444-77-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/2444-71-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2444-68-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/2444-58-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/2444-55-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/2444-66-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/2444-90-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/2444-82-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download