mylobot | 1a50f4aa07d15f3d7681d9e86bab49f1a095cbb321968d224689f4361431cfae

Analysis

max time kernel
30s
max time network
19s
platform
windows7_x64
resource
win7-20230712-en
resource tags

arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system
submitted
14/08/2023, 17:11

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1a50f4aa07d15f3d7681d9e86bab49f1a095cbb321968d224689f4361431cfae.exe
Size

316KB
MD5

b73f3f8f53bb20019e43d989295c6f0f
SHA1

8a8a9a3018b956cffeab92e2c586acdb11bd064e
SHA256

1a50f4aa07d15f3d7681d9e86bab49f1a095cbb321968d224689f4361431cfae
SHA512

3a05827d9812b7e70262e6ce09e0c7408db2add0d84f0dcbfcd62ba07d977bf3d4adfc8c9fefc036ab121b7103bcc249461f7dd13afde86798399f699f08325b
SSDEEP

6144:o2AXMEuLy5czapUCkzJrWqQxXVf1zD5+o2Lv2J:oOEuLMIzlr2Vf1/5D6+J

Score

10^/10

mylobot botnet persistence

Malware Config

Extracted

Family

mylobot

op17.ru:6006

eakalra.ru:1281

zgclgdb.ru:8518

hpifnad.ru:3721

lbjcwix.ru:8326

rykacfb.ru:8483

benkofx.ru:3333

fpzskbc.ru:9364

ouxtjzd.ru:8658

schwpxp.ru:2956

pspkgya.ru:2675

lmlwtdm.ru:2768

rzwnsph.ru:5898

awtiwzk.ru:9816

pzljenb.ru:3486

yhjtpyf.ru:3565

ogkbsoq.ru:2553

rjngcbj.ru:5655

jlfeopz.ru:4698

wqcruiz.ru:2165

Signatures

Mylobot
Botnet which first appeared in 2017 written in C++.
botnet mylobot

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-4219371764-2579186923-3390623117-1000\Software\Microsoft\Windows\CurrentVersion\Run\{3268EFB8-F527-1B70-3910-7EC87F4C1DCE} = "c:\\programdata\\{AE78C788-DD17-8760-3910-7EC87F4C1DCE}\\03c71717.exe"	svchost.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2664 set thread context of 2392	2664	1a50f4aa07d15f3d7681d9e86bab49f1a095cbb321968d224689f4361431cfae.exe	30

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-4219371764-2579186923-3390623117-1000_CLASSES\CLSID\{F45DE075-FAEA-DD45-3910-7EC87F4C1DCE}	svchost.exe
Key created	\REGISTRY\USER\S-1-5-21-4219371764-2579186923-3390623117-1000_CLASSES\CLSID\{AE78C78B-DD14-8760-3910-7EC87F4C1DCE}	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4219371764-2579186923-3390623117-1000_CLASSES\CLSID\{AE78C78B-DD14-8760-3910-7EC87F4C1DCE}\ = "1692033124"	svchost.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
2392	1a50f4aa07d15f3d7681d9e86bab49f1a095cbb321968d224689f4361431cfae.exe
2392	1a50f4aa07d15f3d7681d9e86bab49f1a095cbb321968d224689f4361431cfae.exe
2016	svchost.exe

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
2392	1a50f4aa07d15f3d7681d9e86bab49f1a095cbb321968d224689f4361431cfae.exe

Suspicious use of WriteProcessMemory 30 IoCs

description	pid	Process	procid_target
PID 2664 wrote to memory of 2392	2664	1a50f4aa07d15f3d7681d9e86bab49f1a095cbb321968d224689f4361431cfae.exe	30
PID 2664 wrote to memory of 2392	2664	1a50f4aa07d15f3d7681d9e86bab49f1a095cbb321968d224689f4361431cfae.exe	30
PID 2664 wrote to memory of 2392	2664	1a50f4aa07d15f3d7681d9e86bab49f1a095cbb321968d224689f4361431cfae.exe	30
PID 2664 wrote to memory of 2392	2664	1a50f4aa07d15f3d7681d9e86bab49f1a095cbb321968d224689f4361431cfae.exe	30
PID 2664 wrote to memory of 456	2664	1a50f4aa07d15f3d7681d9e86bab49f1a095cbb321968d224689f4361431cfae.exe	28
PID 2664 wrote to memory of 456	2664	1a50f4aa07d15f3d7681d9e86bab49f1a095cbb321968d224689f4361431cfae.exe	28
PID 2664 wrote to memory of 456	2664	1a50f4aa07d15f3d7681d9e86bab49f1a095cbb321968d224689f4361431cfae.exe	28
PID 2664 wrote to memory of 456	2664	1a50f4aa07d15f3d7681d9e86bab49f1a095cbb321968d224689f4361431cfae.exe	28
PID 2664 wrote to memory of 2392	2664	1a50f4aa07d15f3d7681d9e86bab49f1a095cbb321968d224689f4361431cfae.exe	30
PID 2664 wrote to memory of 456	2664	1a50f4aa07d15f3d7681d9e86bab49f1a095cbb321968d224689f4361431cfae.exe	28
PID 2664 wrote to memory of 2392	2664	1a50f4aa07d15f3d7681d9e86bab49f1a095cbb321968d224689f4361431cfae.exe	30
PID 2664 wrote to memory of 2392	2664	1a50f4aa07d15f3d7681d9e86bab49f1a095cbb321968d224689f4361431cfae.exe	30
PID 2664 wrote to memory of 456	2664	1a50f4aa07d15f3d7681d9e86bab49f1a095cbb321968d224689f4361431cfae.exe	28
PID 2664 wrote to memory of 2392	2664	1a50f4aa07d15f3d7681d9e86bab49f1a095cbb321968d224689f4361431cfae.exe	30
PID 2664 wrote to memory of 2392	2664	1a50f4aa07d15f3d7681d9e86bab49f1a095cbb321968d224689f4361431cfae.exe	30
PID 2664 wrote to memory of 456	2664	1a50f4aa07d15f3d7681d9e86bab49f1a095cbb321968d224689f4361431cfae.exe	28
PID 2664 wrote to memory of 456	2664	1a50f4aa07d15f3d7681d9e86bab49f1a095cbb321968d224689f4361431cfae.exe	28
PID 2664 wrote to memory of 2636	2664	1a50f4aa07d15f3d7681d9e86bab49f1a095cbb321968d224689f4361431cfae.exe	29
PID 2664 wrote to memory of 2636	2664	1a50f4aa07d15f3d7681d9e86bab49f1a095cbb321968d224689f4361431cfae.exe	29
PID 2664 wrote to memory of 2636	2664	1a50f4aa07d15f3d7681d9e86bab49f1a095cbb321968d224689f4361431cfae.exe	29
PID 2664 wrote to memory of 2636	2664	1a50f4aa07d15f3d7681d9e86bab49f1a095cbb321968d224689f4361431cfae.exe	29
PID 2664 wrote to memory of 456	2664	1a50f4aa07d15f3d7681d9e86bab49f1a095cbb321968d224689f4361431cfae.exe	28
PID 2664 wrote to memory of 2392	2664	1a50f4aa07d15f3d7681d9e86bab49f1a095cbb321968d224689f4361431cfae.exe	30
PID 2392 wrote to memory of 2016	2392	1a50f4aa07d15f3d7681d9e86bab49f1a095cbb321968d224689f4361431cfae.exe	31
PID 2392 wrote to memory of 2016	2392	1a50f4aa07d15f3d7681d9e86bab49f1a095cbb321968d224689f4361431cfae.exe	31
PID 2392 wrote to memory of 2016	2392	1a50f4aa07d15f3d7681d9e86bab49f1a095cbb321968d224689f4361431cfae.exe	31
PID 2392 wrote to memory of 2016	2392	1a50f4aa07d15f3d7681d9e86bab49f1a095cbb321968d224689f4361431cfae.exe	31
PID 2392 wrote to memory of 2016	2392	1a50f4aa07d15f3d7681d9e86bab49f1a095cbb321968d224689f4361431cfae.exe	31
PID 2016 wrote to memory of 456	2016	svchost.exe	28
PID 2016 wrote to memory of 456	2016	svchost.exe	28

C:\Users\Admin\AppData\Local\Temp\1a50f4aa07d15f3d7681d9e86bab49f1a095cbb321968d224689f4361431cfae.exe
"C:\Users\Admin\AppData\Local\Temp\1a50f4aa07d15f3d7681d9e86bab49f1a095cbb321968d224689f4361431cfae.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2664
- C:\Users\Admin\AppData\Local\Temp\1a50f4aa07d15f3d7681d9e86bab49f1a095cbb321968d224689f4361431cfae.exe
  "C:\Users\Admin\AppData\Local\Temp\1a50f4aa07d15f3d7681d9e86bab49f1a095cbb321968d224689f4361431cfae.exe"
  2⤵
  PID:456
- C:\Users\Admin\AppData\Local\Temp\1a50f4aa07d15f3d7681d9e86bab49f1a095cbb321968d224689f4361431cfae.exe
  "C:\Users\Admin\AppData\Local\Temp\1a50f4aa07d15f3d7681d9e86bab49f1a095cbb321968d224689f4361431cfae.exe"
  2⤵
  PID:2636
- C:\Users\Admin\AppData\Local\Temp\1a50f4aa07d15f3d7681d9e86bab49f1a095cbb321968d224689f4361431cfae.exe
  "C:\Users\Admin\AppData\Local\Temp\1a50f4aa07d15f3d7681d9e86bab49f1a095cbb321968d224689f4361431cfae.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of WriteProcessMemory
  PID:2392
- - C:\Windows\SysWOW64\svchost.exe
    "C:\Windows\system32\svchost.exe"
    3⤵
    - Adds Run key to start application
    - Modifies registry class
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:2016

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/456-82-0x00000000001C0000-0x00000000001C1000-memory.dmp

Filesize
4KB

Download
memory/456-86-0x00000000001B0000-0x00000000001B1000-memory.dmp

Filesize
4KB

Download
memory/2016-80-0x0000000000110000-0x000000000013B000-memory.dmp

Filesize
172KB

Download
memory/2016-74-0x0000000000080000-0x00000000000D0000-memory.dmp

Filesize
320KB

Download
memory/2016-87-0x0000000000110000-0x000000000013B000-memory.dmp

Filesize
172KB

Download
memory/2016-79-0x0000000000110000-0x000000000013B000-memory.dmp

Filesize
172KB

Download
memory/2016-78-0x0000000000110000-0x000000000013B000-memory.dmp

Filesize
172KB

Download
memory/2016-77-0x0000000000110000-0x000000000013B000-memory.dmp

Filesize
172KB

Download
memory/2016-76-0x0000000000110000-0x000000000013B000-memory.dmp

Filesize
172KB

Download
memory/2016-75-0x0000000000110000-0x000000000013B000-memory.dmp

Filesize
172KB

Download
memory/2392-68-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/2392-73-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/2392-72-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/2392-62-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/2392-55-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/2392-81-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/2392-60-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/2392-59-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/2392-57-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/2392-63-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2664-54-0x0000000000530000-0x0000000000531000-memory.dmp

Filesize
4KB

Download