mylobot | f865e7eddcdd476f8e2f6baa3ff80d2309ca04934ee21127399c392b1913b0d1

General

Target

NEAS.NEAS78250987584b2394fb1590f587bc9f6fexe_JC.exe
Size

724KB
MD5

78250987584b2394fb1590f587bc9f6f
SHA1

18290c77501235f5f7b8f5728e076aef6b7fd567
SHA256

f865e7eddcdd476f8e2f6baa3ff80d2309ca04934ee21127399c392b1913b0d1
SHA512

74cd48a6abfdf4014c1330445cab16fd36c9e7c9c2eb6b5ab262950bcc49091ab45a6fc022a634ee8628d6991dc7b9d48d45878d89074418914e5ac8231e6278
SSDEEP

12288:9Mxx8WihpUDm/7DIuY0IlkNzbGKoS54TCCWvFD/cfUV:C8WinWm/7UuY0IlkNz6mkCC4Z/cS

Score

10^/10

mylobot botnet persistence

Malware Config

Extracted

Family

mylobot

C2

op17.ru:6006

eakalra.ru:1281

zgclgdb.ru:8518

hpifnad.ru:3721

lbjcwix.ru:8326

rykacfb.ru:8483

benkofx.ru:3333

fpzskbc.ru:9364

ouxtjzd.ru:8658

schwpxp.ru:2956

pspkgya.ru:2675

lmlwtdm.ru:2768

rzwnsph.ru:5898

awtiwzk.ru:9816

pzljenb.ru:3486

yhjtpyf.ru:3565

ogkbsoq.ru:2553

rjngcbj.ru:5655

jlfeopz.ru:4698

wqcruiz.ru:2165

Signatures

Mylobot
Botnet which first appeared in 2017 written in C++.
botnet mylobot

Deletes itself 1 IoCs

Processes:

svchost.exe

pid	Process
5628	svchost.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

NEAS.NEAS78250987584b2394fb1590f587bc9f6fexe_JC.exe

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Windows\CurrentVersion\Run\{04F19B28-CA8F-BDF1-0F38-E7C80C537BA8} = "c:\\users\\admin\\appdata\\roaming\\{98E1B318-E2BF-21E1-0F38-E7C80C537BA8}\\355e6387.exe"	NEAS.NEAS78250987584b2394fb1590f587bc9f6fexe_JC.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

NEAS.NEAS78250987584b2394fb1590f587bc9f6fexe_JC.exe

description	pid	Process	procid_target
PID 1920 set thread context of 5528	1920	NEAS.NEAS78250987584b2394fb1590f587bc9f6fexe_JC.exe	28

Modifies registry class 1 IoCs

Processes:

svchost.exe

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000_CLASSES\CLSID\{C2C494E5-C542-7BC4-0F38-E7C80C537BA8}	svchost.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

Processes:

NEAS.NEAS78250987584b2394fb1590f587bc9f6fexe_JC.exesvchost.exe

pid	Process
5528	NEAS.NEAS78250987584b2394fb1590f587bc9f6fexe_JC.exe
5528	NEAS.NEAS78250987584b2394fb1590f587bc9f6fexe_JC.exe
5628	svchost.exe

Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

NEAS.NEAS78250987584b2394fb1590f587bc9f6fexe_JC.exe

pid	Process
5528	NEAS.NEAS78250987584b2394fb1590f587bc9f6fexe_JC.exe

Suspicious use of WriteProcessMemory 15 IoCs

Processes:

NEAS.NEAS78250987584b2394fb1590f587bc9f6fexe_JC.exeNEAS.NEAS78250987584b2394fb1590f587bc9f6fexe_JC.exe

description	pid	Process	procid_target
PID 1920 wrote to memory of 5528	1920	NEAS.NEAS78250987584b2394fb1590f587bc9f6fexe_JC.exe	28
PID 1920 wrote to memory of 5528	1920	NEAS.NEAS78250987584b2394fb1590f587bc9f6fexe_JC.exe	28
PID 1920 wrote to memory of 5528	1920	NEAS.NEAS78250987584b2394fb1590f587bc9f6fexe_JC.exe	28
PID 1920 wrote to memory of 5528	1920	NEAS.NEAS78250987584b2394fb1590f587bc9f6fexe_JC.exe	28
PID 1920 wrote to memory of 5528	1920	NEAS.NEAS78250987584b2394fb1590f587bc9f6fexe_JC.exe	28
PID 1920 wrote to memory of 5528	1920	NEAS.NEAS78250987584b2394fb1590f587bc9f6fexe_JC.exe	28
PID 1920 wrote to memory of 5528	1920	NEAS.NEAS78250987584b2394fb1590f587bc9f6fexe_JC.exe	28
PID 1920 wrote to memory of 5528	1920	NEAS.NEAS78250987584b2394fb1590f587bc9f6fexe_JC.exe	28
PID 1920 wrote to memory of 5528	1920	NEAS.NEAS78250987584b2394fb1590f587bc9f6fexe_JC.exe	28
PID 1920 wrote to memory of 5528	1920	NEAS.NEAS78250987584b2394fb1590f587bc9f6fexe_JC.exe	28
PID 5528 wrote to memory of 5628	5528	NEAS.NEAS78250987584b2394fb1590f587bc9f6fexe_JC.exe	29
PID 5528 wrote to memory of 5628	5528	NEAS.NEAS78250987584b2394fb1590f587bc9f6fexe_JC.exe	29
PID 5528 wrote to memory of 5628	5528	NEAS.NEAS78250987584b2394fb1590f587bc9f6fexe_JC.exe	29
PID 5528 wrote to memory of 5628	5528	NEAS.NEAS78250987584b2394fb1590f587bc9f6fexe_JC.exe	29
PID 5528 wrote to memory of 5628	5528	NEAS.NEAS78250987584b2394fb1590f587bc9f6fexe_JC.exe	29

C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS78250987584b2394fb1590f587bc9f6fexe_JC.exe
"C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS78250987584b2394fb1590f587bc9f6fexe_JC.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1920
- C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS78250987584b2394fb1590f587bc9f6fexe_JC.exe
  "C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS78250987584b2394fb1590f587bc9f6fexe_JC.exe"
  2⤵
  - Adds Run key to start application
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of WriteProcessMemory
  PID:5528
- - C:\Windows\SysWOW64\svchost.exe
    "C:\Windows\system32\svchost.exe"
    3⤵
    - Deletes itself
    - Modifies registry class
    - Suspicious behavior: EnumeratesProcesses
    PID:5628

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\??\c:\users\admin\appdata\roaming\{98E1B318-E2BF-21E1-0F38-E7C80C537BA8}\355e6387.exe

Filesize
724KB

MD5
78250987584b2394fb1590f587bc9f6f

SHA1
18290c77501235f5f7b8f5728e076aef6b7fd567

SHA256
f865e7eddcdd476f8e2f6baa3ff80d2309ca04934ee21127399c392b1913b0d1

SHA512
74cd48a6abfdf4014c1330445cab16fd36c9e7c9c2eb6b5ab262950bcc49091ab45a6fc022a634ee8628d6991dc7b9d48d45878d89074418914e5ac8231e6278

Download Submit
memory/1920-9-0x0000000051000000-0x0000000051071000-memory.dmp

Filesize
452KB

Download
memory/1920-1-0x00000000002A0000-0x00000000002A1000-memory.dmp

Filesize
4KB

Download
memory/1920-0-0x0000000000400000-0x0000000000471000-memory.dmp

Filesize
452KB

Download
memory/1920-17-0x0000000000400000-0x0000000000471000-memory.dmp

Filesize
452KB

Download
memory/5528-19-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/5528-29-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/5528-11-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/5528-13-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/5528-15-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/5528-6-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/5528-18-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/5528-4-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/5528-30-0x0000000000280000-0x0000000000281000-memory.dmp

Filesize
4KB

Download
memory/5528-8-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/5528-2-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/5628-23-0x00000000000C0000-0x00000000000EB000-memory.dmp

Filesize
172KB

Download
memory/5628-26-0x00000000000C0000-0x00000000000EB000-memory.dmp

Filesize
172KB

Download
memory/5628-27-0x00000000000C0000-0x00000000000EB000-memory.dmp

Filesize
172KB

Download
memory/5628-25-0x00000000000C0000-0x00000000000EB000-memory.dmp

Filesize
172KB

Download
memory/5628-28-0x00000000000C0000-0x00000000000EB000-memory.dmp

Filesize
172KB

Download
memory/5628-24-0x00000000000C0000-0x00000000000EB000-memory.dmp

Filesize
172KB

Download
memory/5628-22-0x0000000000160000-0x0000000000215000-memory.dmp

Filesize
724KB

Download
memory/5628-34-0x00000000000C0000-0x00000000000EB000-memory.dmp

Filesize
172KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads