loaderbot | 176aebf3d17f832cf0f446b0da9f991c536b2997477ec654df0d70f4aa76c844

Analysis

max time kernel
118s
max time network
129s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
22-12-2023 16:12

Target

eb78c56dd83f6b0dfb25534f987bbd37.exe
Size

2.0MB
MD5

eb78c56dd83f6b0dfb25534f987bbd37
SHA1

997abab8ec28378275933512ca31c0657489fe1d
SHA256

176aebf3d17f832cf0f446b0da9f991c536b2997477ec654df0d70f4aa76c844
SHA512

c50b33756ad37c3b4c240a56095cb6f12e39bd6ef7008e6ee6ea95922fd9079e7f50a17726e67489c19802a39c621e7e2d42a40093585f19051292afb4450b44
SSDEEP

49152:GMFTi8cSHuoa3W0E/Gc4iWQLgCEmjjZ9B444edBfB:GMFTiXyg3W0E+c4iWnmnZ9R4edBfB

Score

10^/10

LoaderBot
LoaderBot is a loader written in .NET downloading and executing miners.
loader miner loaderbot

LoaderBot executable 1 IoCs

resource	yara_rule
behavioral1/memory/2848-5-0x0000000000400000-0x00000000007FE000-memory.dmp	loaderbot

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2472 set thread context of 2848	2472	eb78c56dd83f6b0dfb25534f987bbd37.exe	28

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2472	eb78c56dd83f6b0dfb25534f987bbd37.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 2472 wrote to memory of 2848	2472	eb78c56dd83f6b0dfb25534f987bbd37.exe	28
PID 2472 wrote to memory of 2848	2472	eb78c56dd83f6b0dfb25534f987bbd37.exe	28
PID 2472 wrote to memory of 2848	2472	eb78c56dd83f6b0dfb25534f987bbd37.exe	28
PID 2472 wrote to memory of 2848	2472	eb78c56dd83f6b0dfb25534f987bbd37.exe	28
PID 2472 wrote to memory of 2848	2472	eb78c56dd83f6b0dfb25534f987bbd37.exe	28
PID 2472 wrote to memory of 2848	2472	eb78c56dd83f6b0dfb25534f987bbd37.exe	28
PID 2472 wrote to memory of 2848	2472	eb78c56dd83f6b0dfb25534f987bbd37.exe	28
PID 2472 wrote to memory of 2848	2472	eb78c56dd83f6b0dfb25534f987bbd37.exe	28
PID 2472 wrote to memory of 2848	2472	eb78c56dd83f6b0dfb25534f987bbd37.exe	28

C:\Users\Admin\AppData\Local\Temp\eb78c56dd83f6b0dfb25534f987bbd37.exe
"C:\Users\Admin\AppData\Local\Temp\eb78c56dd83f6b0dfb25534f987bbd37.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2472
- C:\Users\Admin\AppData\Local\Temp\eb78c56dd83f6b0dfb25534f987bbd37.exe
  C:\Users\Admin\AppData\Local\Temp\eb78c56dd83f6b0dfb25534f987bbd37.exe
  2⤵
  PID:2848

memory/2472-1-0x0000000074180000-0x000000007486E000-memory.dmp

Filesize
6.9MB

Download
memory/2472-0-0x00000000002B0000-0x00000000004A8000-memory.dmp

Filesize
2.0MB

Download
memory/2472-2-0x0000000074180000-0x000000007486E000-memory.dmp

Filesize
6.9MB

Download
memory/2472-3-0x00000000048D0000-0x0000000004910000-memory.dmp

Filesize
256KB

Download
memory/2472-4-0x0000000000280000-0x00000000002A8000-memory.dmp

Filesize
160KB

Download
memory/2472-8-0x0000000074180000-0x000000007486E000-memory.dmp

Filesize
6.9MB

Download
memory/2848-5-0x0000000000400000-0x00000000007FE000-memory.dmp

Filesize
4.0MB

Download