lobshot | 15ec54cd2b2605ec8395645fe545204a89ddfe6fef656c98c0578006184d0228

Analysis

max time kernel
147s
max time network
152s
platform
windows7_x64
resource
win7-20230712-en
resource tags

arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system
submitted
23/08/2023, 15:48

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

HVNC.exe
Size

96KB
MD5

9315eb6ecab91d17c13e8e12c850fd1a
SHA1

412eed3de0dd1714b4b27d77dec8d653e6d604cf
SHA256

15ec54cd2b2605ec8395645fe545204a89ddfe6fef656c98c0578006184d0228
SHA512

c41bd3d7df65388927c5d8a46bcaa5d329741c9e690ef26e3a2a03021949a67ddda01c8f50d78b5faff8c0911ffaae33d3cf891de4b8b28360e3c3726827a216
SSDEEP

1536:QX1tIEY/6mS2I4bD7jrFgkfTeXslrYNJJpnPEqQFXB00Gdhp4VjlK+I/QX205eBj:QX1tIM2IOXjdfTeXsirnPgu4PK+Iocc

Score

10^/10

lobshot backdoor persistence

Malware Config

Signatures

Detects Lobshot family 3 IoCs

resource	yara_rule
behavioral1/files/0x00090000000120c4-8.dat	family_lobshot
behavioral1/files/0x00090000000120c4-9.dat	family_lobshot
behavioral1/files/0x00090000000120c4-10.dat	family_lobshot

Lobshot
Lobshot is a backdoor module written in c++.
backdoor lobshot

Deletes itself 1 IoCs

pid	Process
3012	cmd.exe

Executes dropped EXE 1 IoCs

pid	Process
2852	service.exe

Loads dropped DLL 1 IoCs

pid	Process
3012	cmd.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-4219371764-2579186923-3390623117-1000\Software\Microsoft\Windows\CurrentVersion\Run\Shell Extension = "C:\\ProgramData\\service.exe"	HVNC.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
2304	PING.EXE

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2788	HVNC.exe
2852	service.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 2788 wrote to memory of 3012	2788	HVNC.exe	28
PID 2788 wrote to memory of 3012	2788	HVNC.exe	28
PID 2788 wrote to memory of 3012	2788	HVNC.exe	28
PID 2788 wrote to memory of 3012	2788	HVNC.exe	28
PID 3012 wrote to memory of 2304	3012	cmd.exe	30
PID 3012 wrote to memory of 2304	3012	cmd.exe	30
PID 3012 wrote to memory of 2304	3012	cmd.exe	30
PID 3012 wrote to memory of 2304	3012	cmd.exe	30
PID 3012 wrote to memory of 2852	3012	cmd.exe	31
PID 3012 wrote to memory of 2852	3012	cmd.exe	31
PID 3012 wrote to memory of 2852	3012	cmd.exe	31
PID 3012 wrote to memory of 2852	3012	cmd.exe	31

C:\Users\Admin\AppData\Local\Temp\HVNC.exe
"C:\Users\Admin\AppData\Local\Temp\HVNC.exe"
1⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2788
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c (ping 127.0.0.1) & (del /F /Q "C:\Users\Admin\AppData\Local\Temp\HVNC.exe") & (start "" "C:\ProgramData\service.exe")
  2⤵
  - Deletes itself
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:3012
- - C:\Windows\SysWOW64\PING.EXE
    ping 127.0.0.1
    3⤵
    - Runs ping.exe
    PID:2304
- - C:\ProgramData\service.exe
    "C:\ProgramData\service.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    PID:2852

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Remote System Discovery

T1018

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\cln_log.txt

Filesize
350B

MD5
84210a6a1ca2434c6d932eb4c5098b90

SHA1
f3158d32bd02cb56623c1838397261931c2ece4e

SHA256
0b2e749ce9e1727166800904d3b16322e03af465e0310cd43b4e25007439fd8d

SHA512
b2736672adb946c477d86ef4dc3c0431b01ac0d3728f36d538dc297b81c9ed212ca073297ee64294db703578cad447e89aeb5c7d4a56b2f20215397983c3e5bf

Download Submit
C:\ProgramData\cln_log.txt

Filesize
4KB

MD5
f37cf3eecce087a92e4b1983ee34ad2f

SHA1
dad9531ade87d9d5acb9665587c6e9bcf5ebeb2e

SHA256
316f4d8e8c808cd17dd2e75020a846f5b04afcd8a091a207f5d5de63ee316ea6

SHA512
6c555898d467cadaae2b85d8a830e048814ff834b991a1cb4db59fb19f81c27cbae9ca8455291738d4d87bba10e50bc9016833fb1d942ee2b52cdebc53e04df3

Download Submit
C:\ProgramData\service.exe

Filesize
96KB

MD5
9315eb6ecab91d17c13e8e12c850fd1a

SHA1
412eed3de0dd1714b4b27d77dec8d653e6d604cf

SHA256
15ec54cd2b2605ec8395645fe545204a89ddfe6fef656c98c0578006184d0228

SHA512
c41bd3d7df65388927c5d8a46bcaa5d329741c9e690ef26e3a2a03021949a67ddda01c8f50d78b5faff8c0911ffaae33d3cf891de4b8b28360e3c3726827a216

Download Submit
C:\ProgramData\service.exe

Filesize
96KB

MD5
9315eb6ecab91d17c13e8e12c850fd1a

SHA1
412eed3de0dd1714b4b27d77dec8d653e6d604cf

SHA256
15ec54cd2b2605ec8395645fe545204a89ddfe6fef656c98c0578006184d0228

SHA512
c41bd3d7df65388927c5d8a46bcaa5d329741c9e690ef26e3a2a03021949a67ddda01c8f50d78b5faff8c0911ffaae33d3cf891de4b8b28360e3c3726827a216

Download Submit
\ProgramData\service.exe

Filesize
96KB

MD5
9315eb6ecab91d17c13e8e12c850fd1a

SHA1
412eed3de0dd1714b4b27d77dec8d653e6d604cf

SHA256
15ec54cd2b2605ec8395645fe545204a89ddfe6fef656c98c0578006184d0228

SHA512
c41bd3d7df65388927c5d8a46bcaa5d329741c9e690ef26e3a2a03021949a67ddda01c8f50d78b5faff8c0911ffaae33d3cf891de4b8b28360e3c3726827a216

Download Submit