Analysis
-
max time kernel
149s -
max time network
148s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
19-12-2023 17:59
Behavioral task
behavioral1
Sample
707ba8dca9b7d9c717d33e102cd80cae.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
707ba8dca9b7d9c717d33e102cd80cae.exe
Resource
win10v2004-20231215-en
General
-
Target
707ba8dca9b7d9c717d33e102cd80cae.exe
-
Size
4.3MB
-
MD5
707ba8dca9b7d9c717d33e102cd80cae
-
SHA1
cf6edd3ae5df41a07c6df335836a292028739b98
-
SHA256
25f1d3238d50fcbe2c26b743197e2ae319bf61fc927ca5e5cf3c009ba35512d9
-
SHA512
945c3481c7388e814210a5d1fa42cbb5c9e8833f30c3089991f309171c563f1d036b0bb8cf067d28862747179334be5c283e4c8586a92c1ce2f82af498456b3f
-
SSDEEP
98304:kNNaf55cH3Bj1JkxjOejrq8lVwOro1bbyOFb0hjB4+81TC:kNNa4HxDe/GDhFb0lB4+
Malware Config
Extracted
loaderbot
http://jokerkqc.beget.tech/cmd.php
Signatures
-
LoaderBot executable 2 IoCs
Processes:
resource yara_rule behavioral1/memory/3056-1-0x00000000010D0000-0x0000000001530000-memory.dmp loaderbot behavioral1/memory/3056-9-0x00000000062A0000-0x0000000006F2D000-memory.dmp loaderbot -
XMRig Miner payload 14 IoCs
Processes:
resource yara_rule behavioral1/memory/2956-16-0x0000000000400000-0x000000000108D000-memory.dmp xmrig behavioral1/memory/2956-18-0x0000000000400000-0x000000000108D000-memory.dmp xmrig behavioral1/memory/2956-19-0x0000000000400000-0x000000000108D000-memory.dmp xmrig behavioral1/memory/2956-20-0x0000000000400000-0x000000000108D000-memory.dmp xmrig behavioral1/memory/2956-23-0x0000000000400000-0x000000000108D000-memory.dmp xmrig behavioral1/memory/2956-24-0x0000000000400000-0x000000000108D000-memory.dmp xmrig behavioral1/memory/2956-25-0x0000000000400000-0x000000000108D000-memory.dmp xmrig behavioral1/memory/2956-27-0x0000000000400000-0x000000000108D000-memory.dmp xmrig behavioral1/memory/2956-30-0x0000000000400000-0x000000000108D000-memory.dmp xmrig behavioral1/memory/2956-31-0x0000000000400000-0x000000000108D000-memory.dmp xmrig behavioral1/memory/2956-33-0x0000000000400000-0x000000000108D000-memory.dmp xmrig behavioral1/memory/2956-34-0x0000000000400000-0x000000000108D000-memory.dmp xmrig behavioral1/memory/2956-35-0x0000000000400000-0x000000000108D000-memory.dmp xmrig behavioral1/memory/2956-36-0x0000000000400000-0x000000000108D000-memory.dmp xmrig -
Drops startup file 1 IoCs
Processes:
707ba8dca9b7d9c717d33e102cd80cae.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Driver.url 707ba8dca9b7d9c717d33e102cd80cae.exe -
Executes dropped EXE 1 IoCs
Processes:
Driver.exepid process 2956 Driver.exe -
Loads dropped DLL 1 IoCs
Processes:
707ba8dca9b7d9c717d33e102cd80cae.exepid process 3056 707ba8dca9b7d9c717d33e102cd80cae.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
707ba8dca9b7d9c717d33e102cd80cae.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Windows\CurrentVersion\Run\Driver = "C:\\Users\\Admin\\AppData\\Roaming\\Sysfiles\\707ba8dca9b7d9c717d33e102cd80cae.exe" 707ba8dca9b7d9c717d33e102cd80cae.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
707ba8dca9b7d9c717d33e102cd80cae.exepid process 3056 707ba8dca9b7d9c717d33e102cd80cae.exe 3056 707ba8dca9b7d9c717d33e102cd80cae.exe 3056 707ba8dca9b7d9c717d33e102cd80cae.exe 3056 707ba8dca9b7d9c717d33e102cd80cae.exe 3056 707ba8dca9b7d9c717d33e102cd80cae.exe 3056 707ba8dca9b7d9c717d33e102cd80cae.exe 3056 707ba8dca9b7d9c717d33e102cd80cae.exe 3056 707ba8dca9b7d9c717d33e102cd80cae.exe 3056 707ba8dca9b7d9c717d33e102cd80cae.exe 3056 707ba8dca9b7d9c717d33e102cd80cae.exe 3056 707ba8dca9b7d9c717d33e102cd80cae.exe 3056 707ba8dca9b7d9c717d33e102cd80cae.exe 3056 707ba8dca9b7d9c717d33e102cd80cae.exe 3056 707ba8dca9b7d9c717d33e102cd80cae.exe 3056 707ba8dca9b7d9c717d33e102cd80cae.exe 3056 707ba8dca9b7d9c717d33e102cd80cae.exe 3056 707ba8dca9b7d9c717d33e102cd80cae.exe 3056 707ba8dca9b7d9c717d33e102cd80cae.exe 3056 707ba8dca9b7d9c717d33e102cd80cae.exe 3056 707ba8dca9b7d9c717d33e102cd80cae.exe 3056 707ba8dca9b7d9c717d33e102cd80cae.exe 3056 707ba8dca9b7d9c717d33e102cd80cae.exe 3056 707ba8dca9b7d9c717d33e102cd80cae.exe 3056 707ba8dca9b7d9c717d33e102cd80cae.exe 3056 707ba8dca9b7d9c717d33e102cd80cae.exe 3056 707ba8dca9b7d9c717d33e102cd80cae.exe 3056 707ba8dca9b7d9c717d33e102cd80cae.exe 3056 707ba8dca9b7d9c717d33e102cd80cae.exe 3056 707ba8dca9b7d9c717d33e102cd80cae.exe 3056 707ba8dca9b7d9c717d33e102cd80cae.exe 3056 707ba8dca9b7d9c717d33e102cd80cae.exe 3056 707ba8dca9b7d9c717d33e102cd80cae.exe 3056 707ba8dca9b7d9c717d33e102cd80cae.exe 3056 707ba8dca9b7d9c717d33e102cd80cae.exe 3056 707ba8dca9b7d9c717d33e102cd80cae.exe 3056 707ba8dca9b7d9c717d33e102cd80cae.exe 3056 707ba8dca9b7d9c717d33e102cd80cae.exe 3056 707ba8dca9b7d9c717d33e102cd80cae.exe 3056 707ba8dca9b7d9c717d33e102cd80cae.exe 3056 707ba8dca9b7d9c717d33e102cd80cae.exe 3056 707ba8dca9b7d9c717d33e102cd80cae.exe 3056 707ba8dca9b7d9c717d33e102cd80cae.exe 3056 707ba8dca9b7d9c717d33e102cd80cae.exe 3056 707ba8dca9b7d9c717d33e102cd80cae.exe 3056 707ba8dca9b7d9c717d33e102cd80cae.exe 3056 707ba8dca9b7d9c717d33e102cd80cae.exe 3056 707ba8dca9b7d9c717d33e102cd80cae.exe 3056 707ba8dca9b7d9c717d33e102cd80cae.exe 3056 707ba8dca9b7d9c717d33e102cd80cae.exe 3056 707ba8dca9b7d9c717d33e102cd80cae.exe 3056 707ba8dca9b7d9c717d33e102cd80cae.exe 3056 707ba8dca9b7d9c717d33e102cd80cae.exe 3056 707ba8dca9b7d9c717d33e102cd80cae.exe 3056 707ba8dca9b7d9c717d33e102cd80cae.exe 3056 707ba8dca9b7d9c717d33e102cd80cae.exe 3056 707ba8dca9b7d9c717d33e102cd80cae.exe 3056 707ba8dca9b7d9c717d33e102cd80cae.exe 3056 707ba8dca9b7d9c717d33e102cd80cae.exe 3056 707ba8dca9b7d9c717d33e102cd80cae.exe 3056 707ba8dca9b7d9c717d33e102cd80cae.exe 3056 707ba8dca9b7d9c717d33e102cd80cae.exe 3056 707ba8dca9b7d9c717d33e102cd80cae.exe 3056 707ba8dca9b7d9c717d33e102cd80cae.exe 3056 707ba8dca9b7d9c717d33e102cd80cae.exe -
Suspicious behavior: LoadsDriver 1 IoCs
Processes:
pid process 468 -
Suspicious behavior: RenamesItself 1 IoCs
Processes:
707ba8dca9b7d9c717d33e102cd80cae.exepid process 3056 707ba8dca9b7d9c717d33e102cd80cae.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
707ba8dca9b7d9c717d33e102cd80cae.exeDriver.exedescription pid process Token: SeDebugPrivilege 3056 707ba8dca9b7d9c717d33e102cd80cae.exe Token: SeLockMemoryPrivilege 2956 Driver.exe Token: SeLockMemoryPrivilege 2956 Driver.exe -
Suspicious use of WriteProcessMemory 4 IoCs
Processes:
707ba8dca9b7d9c717d33e102cd80cae.exedescription pid process target process PID 3056 wrote to memory of 2956 3056 707ba8dca9b7d9c717d33e102cd80cae.exe Driver.exe PID 3056 wrote to memory of 2956 3056 707ba8dca9b7d9c717d33e102cd80cae.exe Driver.exe PID 3056 wrote to memory of 2956 3056 707ba8dca9b7d9c717d33e102cd80cae.exe Driver.exe PID 3056 wrote to memory of 2956 3056 707ba8dca9b7d9c717d33e102cd80cae.exe Driver.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\707ba8dca9b7d9c717d33e102cd80cae.exe"C:\Users\Admin\AppData\Local\Temp\707ba8dca9b7d9c717d33e102cd80cae.exe"1⤵
- Drops startup file
- Loads dropped DLL
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe"C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe" -o pool.supportxmr.com:3333 -u 49YFQi8yvD2aPA6d5yT5FVbzQoG8uzYN8CnXnYc5Rnu4MyAVN3MtWMUVa5d5un4nAoE1wsUxEGKKdds1mN6UV1zd1zxNKUi -p x -k -v=0 --donate-level=1 -t 42⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
\Users\Admin\AppData\Roaming\Sysfiles\Driver.exeFilesize
4.3MB
MD5c58b9de8d4554c6718264f55c9861cfd
SHA12e120be3d952d9deefc8972519d452bab8814156
SHA256c371d06d30f5afea4fa0bf62f7ea104d3073c688802cdac21d33b4464e9beff4
SHA5122d64f80a507b6bb6001b1c8eea09e5d7c7ede93ae3b670ec2db809b46ebead1758abe9b485ce4bb28440b8ad7164594fca08d28198f2c8cd807dbc9eb36d0335
-
memory/2956-29-0x0000000002AE0000-0x0000000002B00000-memory.dmpFilesize
128KB
-
memory/2956-36-0x0000000000400000-0x000000000108D000-memory.dmpFilesize
12.6MB
-
memory/2956-20-0x0000000000400000-0x000000000108D000-memory.dmpFilesize
12.6MB
-
memory/2956-35-0x0000000000400000-0x000000000108D000-memory.dmpFilesize
12.6MB
-
memory/2956-10-0x0000000000400000-0x000000000108D000-memory.dmpFilesize
12.6MB
-
memory/2956-11-0x0000000000280000-0x0000000000294000-memory.dmpFilesize
80KB
-
memory/2956-13-0x00000000011A0000-0x00000000011C0000-memory.dmpFilesize
128KB
-
memory/2956-12-0x0000000001100000-0x0000000001120000-memory.dmpFilesize
128KB
-
memory/2956-14-0x0000000002AE0000-0x0000000002B00000-memory.dmpFilesize
128KB
-
memory/2956-15-0x0000000002B00000-0x0000000002B20000-memory.dmpFilesize
128KB
-
memory/2956-16-0x0000000000400000-0x000000000108D000-memory.dmpFilesize
12.6MB
-
memory/2956-34-0x0000000000400000-0x000000000108D000-memory.dmpFilesize
12.6MB
-
memory/2956-18-0x0000000000400000-0x000000000108D000-memory.dmpFilesize
12.6MB
-
memory/2956-19-0x0000000000400000-0x000000000108D000-memory.dmpFilesize
12.6MB
-
memory/2956-33-0x0000000000400000-0x000000000108D000-memory.dmpFilesize
12.6MB
-
memory/2956-31-0x0000000000400000-0x000000000108D000-memory.dmpFilesize
12.6MB
-
memory/2956-32-0x0000000002B00000-0x0000000002B20000-memory.dmpFilesize
128KB
-
memory/2956-23-0x0000000000400000-0x000000000108D000-memory.dmpFilesize
12.6MB
-
memory/2956-24-0x0000000000400000-0x000000000108D000-memory.dmpFilesize
12.6MB
-
memory/2956-25-0x0000000000400000-0x000000000108D000-memory.dmpFilesize
12.6MB
-
memory/2956-26-0x00000000011A0000-0x00000000011C0000-memory.dmpFilesize
128KB
-
memory/2956-27-0x0000000000400000-0x000000000108D000-memory.dmpFilesize
12.6MB
-
memory/2956-28-0x0000000001100000-0x0000000001120000-memory.dmpFilesize
128KB
-
memory/2956-30-0x0000000000400000-0x000000000108D000-memory.dmpFilesize
12.6MB
-
memory/3056-1-0x00000000010D0000-0x0000000001530000-memory.dmpFilesize
4.4MB
-
memory/3056-4-0x0000000004C70000-0x0000000004CB0000-memory.dmpFilesize
256KB
-
memory/3056-22-0x00000000062A0000-0x0000000006F2D000-memory.dmpFilesize
12.6MB
-
memory/3056-0-0x0000000073FD0000-0x00000000746BE000-memory.dmpFilesize
6.9MB
-
memory/3056-17-0x0000000073FD0000-0x00000000746BE000-memory.dmpFilesize
6.9MB
-
memory/3056-9-0x00000000062A0000-0x0000000006F2D000-memory.dmpFilesize
12.6MB
-
memory/3056-21-0x0000000004C70000-0x0000000004CB0000-memory.dmpFilesize
256KB