loaderbot | 25f1d3238d50fcbe2c26b743197e2ae319bf61fc927ca5e5cf3c009ba35512d9

General

Target

707ba8dca9b7d9c717d33e102cd80cae.exe
Size

4.3MB
MD5

707ba8dca9b7d9c717d33e102cd80cae
SHA1

cf6edd3ae5df41a07c6df335836a292028739b98
SHA256

25f1d3238d50fcbe2c26b743197e2ae319bf61fc927ca5e5cf3c009ba35512d9
SHA512

945c3481c7388e814210a5d1fa42cbb5c9e8833f30c3089991f309171c563f1d036b0bb8cf067d28862747179334be5c283e4c8586a92c1ce2f82af498456b3f
SSDEEP

98304:kNNaf55cH3Bj1JkxjOejrq8lVwOro1bbyOFb0hjB4+81TC:kNNa4HxDe/GDhFb0lB4+

Score

10^/10

loaderbot xmrig loader miner persistence

Malware Config

Extracted

Family

loaderbot

C2

http://jokerkqc.beget.tech/cmd.php

Signatures

LoaderBot
LoaderBot is a loader written in .NET downloading and executing miners.
loader miner loaderbot
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

LoaderBot executable 1 IoCs

Processes:

resource	yara_rule
behavioral2/memory/4872-1-0x0000000000700000-0x0000000000B60000-memory.dmp	loaderbot

XMRig Miner payload 15 IoCs

miner

Processes:

resource	yara_rule
behavioral2/memory/456-18-0x0000000000400000-0x000000000108D000-memory.dmp	xmrig
behavioral2/memory/456-23-0x0000000000400000-0x000000000108D000-memory.dmp	xmrig
behavioral2/memory/456-26-0x0000000000400000-0x000000000108D000-memory.dmp	xmrig
behavioral2/memory/456-27-0x0000000000400000-0x000000000108D000-memory.dmp	xmrig
behavioral2/memory/456-28-0x0000000000400000-0x000000000108D000-memory.dmp	xmrig
behavioral2/memory/456-33-0x0000000000400000-0x000000000108D000-memory.dmp	xmrig
behavioral2/memory/456-34-0x0000000000400000-0x000000000108D000-memory.dmp	xmrig
behavioral2/memory/456-35-0x0000000000400000-0x000000000108D000-memory.dmp	xmrig
behavioral2/memory/456-36-0x0000000000400000-0x000000000108D000-memory.dmp	xmrig
behavioral2/memory/456-37-0x0000000000400000-0x000000000108D000-memory.dmp	xmrig
behavioral2/memory/456-38-0x0000000000400000-0x000000000108D000-memory.dmp	xmrig
behavioral2/memory/456-39-0x0000000000400000-0x000000000108D000-memory.dmp	xmrig
behavioral2/memory/456-40-0x0000000000400000-0x000000000108D000-memory.dmp	xmrig
behavioral2/memory/456-41-0x0000000000400000-0x000000000108D000-memory.dmp	xmrig
behavioral2/memory/456-42-0x0000000000400000-0x000000000108D000-memory.dmp	xmrig

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

707ba8dca9b7d9c717d33e102cd80cae.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-2398549320-3657759451-817663969-1000\Control Panel\International\Geo\Nation	707ba8dca9b7d9c717d33e102cd80cae.exe

Drops startup file 1 IoCs

Processes:

707ba8dca9b7d9c717d33e102cd80cae.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Driver.url	707ba8dca9b7d9c717d33e102cd80cae.exe

Executes dropped EXE 1 IoCs

Processes:

Driver.exe

pid process

456 Driver.exe

pid	process
456	Driver.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

707ba8dca9b7d9c717d33e102cd80cae.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-2398549320-3657759451-817663969-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Driver = "C:\\Users\\Admin\\AppData\\Roaming\\Sysfiles\\707ba8dca9b7d9c717d33e102cd80cae.exe"	707ba8dca9b7d9c717d33e102cd80cae.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

707ba8dca9b7d9c717d33e102cd80cae.exe

pid	process
4872	707ba8dca9b7d9c717d33e102cd80cae.exe
4872	707ba8dca9b7d9c717d33e102cd80cae.exe
4872	707ba8dca9b7d9c717d33e102cd80cae.exe
4872	707ba8dca9b7d9c717d33e102cd80cae.exe
4872	707ba8dca9b7d9c717d33e102cd80cae.exe
4872	707ba8dca9b7d9c717d33e102cd80cae.exe
4872	707ba8dca9b7d9c717d33e102cd80cae.exe
4872	707ba8dca9b7d9c717d33e102cd80cae.exe
4872	707ba8dca9b7d9c717d33e102cd80cae.exe
4872	707ba8dca9b7d9c717d33e102cd80cae.exe
4872	707ba8dca9b7d9c717d33e102cd80cae.exe
4872	707ba8dca9b7d9c717d33e102cd80cae.exe
4872	707ba8dca9b7d9c717d33e102cd80cae.exe
4872	707ba8dca9b7d9c717d33e102cd80cae.exe
4872	707ba8dca9b7d9c717d33e102cd80cae.exe
4872	707ba8dca9b7d9c717d33e102cd80cae.exe
4872	707ba8dca9b7d9c717d33e102cd80cae.exe
4872	707ba8dca9b7d9c717d33e102cd80cae.exe
4872	707ba8dca9b7d9c717d33e102cd80cae.exe
4872	707ba8dca9b7d9c717d33e102cd80cae.exe
4872	707ba8dca9b7d9c717d33e102cd80cae.exe
4872	707ba8dca9b7d9c717d33e102cd80cae.exe
4872	707ba8dca9b7d9c717d33e102cd80cae.exe
4872	707ba8dca9b7d9c717d33e102cd80cae.exe
4872	707ba8dca9b7d9c717d33e102cd80cae.exe
4872	707ba8dca9b7d9c717d33e102cd80cae.exe
4872	707ba8dca9b7d9c717d33e102cd80cae.exe
4872	707ba8dca9b7d9c717d33e102cd80cae.exe
4872	707ba8dca9b7d9c717d33e102cd80cae.exe
4872	707ba8dca9b7d9c717d33e102cd80cae.exe
4872	707ba8dca9b7d9c717d33e102cd80cae.exe
4872	707ba8dca9b7d9c717d33e102cd80cae.exe
4872	707ba8dca9b7d9c717d33e102cd80cae.exe
4872	707ba8dca9b7d9c717d33e102cd80cae.exe
4872	707ba8dca9b7d9c717d33e102cd80cae.exe
4872	707ba8dca9b7d9c717d33e102cd80cae.exe
4872	707ba8dca9b7d9c717d33e102cd80cae.exe
4872	707ba8dca9b7d9c717d33e102cd80cae.exe
4872	707ba8dca9b7d9c717d33e102cd80cae.exe
4872	707ba8dca9b7d9c717d33e102cd80cae.exe
4872	707ba8dca9b7d9c717d33e102cd80cae.exe
4872	707ba8dca9b7d9c717d33e102cd80cae.exe
4872	707ba8dca9b7d9c717d33e102cd80cae.exe
4872	707ba8dca9b7d9c717d33e102cd80cae.exe
4872	707ba8dca9b7d9c717d33e102cd80cae.exe
4872	707ba8dca9b7d9c717d33e102cd80cae.exe
4872	707ba8dca9b7d9c717d33e102cd80cae.exe
4872	707ba8dca9b7d9c717d33e102cd80cae.exe
4872	707ba8dca9b7d9c717d33e102cd80cae.exe
4872	707ba8dca9b7d9c717d33e102cd80cae.exe
4872	707ba8dca9b7d9c717d33e102cd80cae.exe
4872	707ba8dca9b7d9c717d33e102cd80cae.exe
4872	707ba8dca9b7d9c717d33e102cd80cae.exe
4872	707ba8dca9b7d9c717d33e102cd80cae.exe
4872	707ba8dca9b7d9c717d33e102cd80cae.exe
4872	707ba8dca9b7d9c717d33e102cd80cae.exe
4872	707ba8dca9b7d9c717d33e102cd80cae.exe
4872	707ba8dca9b7d9c717d33e102cd80cae.exe
4872	707ba8dca9b7d9c717d33e102cd80cae.exe
4872	707ba8dca9b7d9c717d33e102cd80cae.exe
4872	707ba8dca9b7d9c717d33e102cd80cae.exe
4872	707ba8dca9b7d9c717d33e102cd80cae.exe
4872	707ba8dca9b7d9c717d33e102cd80cae.exe
4872	707ba8dca9b7d9c717d33e102cd80cae.exe

Suspicious behavior: LoadsDriver 1 IoCs

Processes:

pid process

656
Suspicious behavior: RenamesItself 1 IoCs

Processes:

707ba8dca9b7d9c717d33e102cd80cae.exe

pid process

4872 707ba8dca9b7d9c717d33e102cd80cae.exe

pid	process
656

Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

707ba8dca9b7d9c717d33e102cd80cae.exeDriver.exe

description	pid	process
Token: SeDebugPrivilege	4872	707ba8dca9b7d9c717d33e102cd80cae.exe
Token: SeLockMemoryPrivilege	456	Driver.exe
Token: SeLockMemoryPrivilege	456	Driver.exe

Suspicious use of WriteProcessMemory 2 IoCs

Processes:

707ba8dca9b7d9c717d33e102cd80cae.exe

description	pid	process	target process
PID 4872 wrote to memory of 456	4872	707ba8dca9b7d9c717d33e102cd80cae.exe	Driver.exe
PID 4872 wrote to memory of 456	4872	707ba8dca9b7d9c717d33e102cd80cae.exe	Driver.exe

C:\Users\Admin\AppData\Local\Temp\707ba8dca9b7d9c717d33e102cd80cae.exe
"C:\Users\Admin\AppData\Local\Temp\707ba8dca9b7d9c717d33e102cd80cae.exe"
1⤵
- Checks computer location settings
- Drops startup file
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4872

C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe
"C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe" -o pool.supportxmr.com:3333 -u 49YFQi8yvD2aPA6d5yT5FVbzQoG8uzYN8CnXnYc5Rnu4MyAVN3MtWMUVa5d5un4nAoE1wsUxEGKKdds1mN6UV1zd1zxNKUi -p x -k -v=0 --donate-level=1 -t 4
2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:456

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe
Filesize
221KB

MD5
e7ddd01601a94118919fbf8653b94b12

SHA1
9b66899155478733bd7289919faf300564d83ee0

SHA256
ec17554c54bcd9b4f647ef9c52fc1d2107505f20203bce32f96c34efe6e38aad

SHA512
bfe0a680bcd48c2b35a00edcac45245d6e9bbc6e870b8ff96e815a7ef367226bfa4a8fd8f62c6d848830c41d8e0af55db4510a3a54804eec88a8d502a539d4a0

Download Submit
C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe
Filesize
1KB

MD5
dd555522ad7254ea9515d877d258fa2d

SHA1
a494ecd224e256c5c33b53e3e9cdaa3c11243ed0

SHA256
f747073c5b58200fe2ec2dcf173abdc2d8a38e5ff2c5b0b0aaab68a480e47bdd

SHA512
05023d2f3da3c12f1e89ee0c9d66a8913190db20344179b403d677e775e4ad80a7c2058dac80db24c163c4121da8a2a5afbfc563cbd8e9dc6730756e50022f61

Download Submit
memory/456-33-0x0000000000400000-0x000000000108D000-memory.dmp

Filesize
12.6MB

Download
memory/456-40-0x0000000000400000-0x000000000108D000-memory.dmp

Filesize
12.6MB

Download
memory/456-41-0x0000000000400000-0x000000000108D000-memory.dmp

Filesize
12.6MB

Download
memory/456-26-0x0000000000400000-0x000000000108D000-memory.dmp

Filesize
12.6MB

Download
memory/456-15-0x0000000000400000-0x000000000108D000-memory.dmp

Filesize
12.6MB

Download
memory/456-16-0x00000000016A0000-0x00000000016B4000-memory.dmp

Filesize
80KB

Download
memory/456-27-0x0000000000400000-0x000000000108D000-memory.dmp

Filesize
12.6MB

Download
memory/456-18-0x0000000000400000-0x000000000108D000-memory.dmp

Filesize
12.6MB

Download
memory/456-19-0x00000000030B0000-0x00000000030D0000-memory.dmp

Filesize
128KB

Download
memory/456-20-0x00000000030D0000-0x00000000030F0000-memory.dmp

Filesize
128KB

Download
memory/456-21-0x00000000030F0000-0x0000000003110000-memory.dmp

Filesize
128KB

Download
memory/456-22-0x0000000015590000-0x00000000155B0000-memory.dmp

Filesize
128KB

Download
memory/456-23-0x0000000000400000-0x000000000108D000-memory.dmp

Filesize
12.6MB

Download
memory/456-39-0x0000000000400000-0x000000000108D000-memory.dmp

Filesize
12.6MB

Download
memory/456-42-0x0000000000400000-0x000000000108D000-memory.dmp

Filesize
12.6MB

Download
memory/456-38-0x0000000000400000-0x000000000108D000-memory.dmp

Filesize
12.6MB

Download
memory/456-17-0x0000000003070000-0x00000000030B0000-memory.dmp

Filesize
256KB

Download
memory/456-28-0x0000000000400000-0x000000000108D000-memory.dmp

Filesize
12.6MB

Download
memory/456-29-0x00000000030B0000-0x00000000030D0000-memory.dmp

Filesize
128KB

Download
memory/456-30-0x00000000030D0000-0x00000000030F0000-memory.dmp

Filesize
128KB

Download
memory/456-31-0x00000000030F0000-0x0000000003110000-memory.dmp

Filesize
128KB

Download
memory/456-32-0x0000000015590000-0x00000000155B0000-memory.dmp

Filesize
128KB

Download
memory/456-37-0x0000000000400000-0x000000000108D000-memory.dmp

Filesize
12.6MB

Download
memory/456-34-0x0000000000400000-0x000000000108D000-memory.dmp

Filesize
12.6MB

Download
memory/456-35-0x0000000000400000-0x000000000108D000-memory.dmp

Filesize
12.6MB

Download
memory/456-36-0x0000000000400000-0x000000000108D000-memory.dmp

Filesize
12.6MB

Download
memory/4872-0-0x0000000075320000-0x0000000075AD0000-memory.dmp

Filesize
7.7MB

Download
memory/4872-4-0x0000000005810000-0x0000000005876000-memory.dmp

Filesize
408KB

Download
memory/4872-24-0x0000000075320000-0x0000000075AD0000-memory.dmp

Filesize
7.7MB

Download
memory/4872-1-0x0000000000700000-0x0000000000B60000-memory.dmp

Filesize
4.4MB

Download
memory/4872-5-0x0000000005570000-0x0000000005580000-memory.dmp

Filesize
64KB

Download
memory/4872-25-0x0000000005570000-0x0000000005580000-memory.dmp

Filesize
64KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads