Analysis
-
max time kernel
79s -
max time network
156s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
-
submitted
24-12-2023 21:53
General
-
Target
13f091c04b02de894b2b68404b101f5e.exe
-
Size
2.1MB
-
MD5
13f091c04b02de894b2b68404b101f5e
-
SHA1
77be502649288dc78adfd4d887afd8c2f2e06fae
-
SHA256
e88dc2a26b632c34188248f90b1a9f222d3da628839271d989be8fec039fb714
-
SHA512
a115fed08b8f87c0d2dbf93a12c187c2d58ae5c54753ab7e9e82473cb5e2486bd6a435940ec38148a776436e26e52a9c71ee4f3e4aba6ae1c508488483f192cf
-
SSDEEP
49152:3LeFWZXUM2OSAUhB0ETI++BrpMLdDQXWb+FPWRlW:/UM2DD5IhBrpCFQXk+FPWjW
Malware Config
Signatures
-
LoaderBot
LoaderBot is a loader written in .NET downloading and executing miners.
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
LoaderBot executable 1 IoCs
-
XMRig Miner payload 5 IoCs
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Drops startup file 1 IoCs
-
Executes dropped EXE 1 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Suspicious use of SetThreadContext 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 35 IoCs
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 3 IoCs
-
Suspicious use of WriteProcessMemory 10 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\13f091c04b02de894b2b68404b101f5e.exe"C:\Users\Admin\AppData\Local\Temp\13f091c04b02de894b2b68404b101f5e.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\13f091c04b02de894b2b68404b101f5e.exeC:\Users\Admin\AppData\Local\Temp\13f091c04b02de894b2b68404b101f5e.exe2⤵
- Checks computer location settings
- Drops startup file
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe"C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe" -o pool.hashvault.pro:3333 -u 49ciCfWrkhQWz6LYXux4LV1P5eAFMfox1H2y3k6VSn7Jb39nDYDUiC6JFCUBDDf63GQqpKc5ZQQ8vCHwgzesAKHtJwB9o2i -p x -k -v=0 --donate-level=1 -t 43⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
605B
MD53654bd2c6957761095206ffdf92b0cb9
SHA16f10f7b5867877de7629afcff644c265e79b4ad3
SHA256c2a4be94cf4ed33d698d9838f4ffb47047da796e733ec11562463a1621212ab4
SHA512e2a81248cca7732ce098088d5237897493fd3629e28d66bc13e5f9191f72cd52893f4a53905906af12d5c6de475738b6c7f6b718a32869e9ee0deb3a54672f79
-
Filesize
3.9MB
MD502569a7a91a71133d4a1023bf32aa6f4
SHA10f16bcb3f3f085d3d3be912195558e9f9680d574
SHA2568d6abba9b216172cfc64b8802db0d20a1c634c96e1049f451eddba2363966bf0
SHA512534be1fe93ee556a14cfd8fad5377f57fb056ab4cd2bca14e4f376f4a25d3d4d270917d68a90b3c40d8a8daaeba6f592fa095ecff478332ba23405d1df728322
-
Filesize
2.1MB
MD50396e36c697a74bc1d6754f0524f4372
SHA167c75c8d47565e42fdfd4131b53c4eca75fa336a
SHA2562fb6292fd092134c8a62e75f73db4dd1c937f33091cd95ff754bec1fcc1fb110
SHA51275eddf4a1d1dc216fe05c3f1c45315ffe26c606be6ec3a40598aa46d06d97d95a59bfb2523e230d4b55547e014348ca13921ad34a1b9a28b3c00caf5ba44ba78
-
Filesize
673KB
MD5937d61a7c9ef3750cce05cc28f7260ed
SHA1d0fb9ac1c6ea4af8b9a86b9d0c705029165f0329
SHA25687a2f1ea4e29ecee0ee9376c85d11232fa69a3a9c4cac5c59f6bbf9fda2dcc9d
SHA512c656eb4381e1b483b4f1dc118775f2559a0d5ef2ade8c1c3de08c35034053948dd922090586b1810316020c3ceff5c21acd4d7d258a13dcfee65761ebfe5a3a3
-
Filesize
128KB
-
Filesize
64KB
-
Filesize
7.7MB
-
Filesize
472KB
-
Filesize
120KB
-
Filesize
7.7MB
-
Filesize
4KB
-
Filesize
64KB
-
Filesize
7.7MB
-
Filesize
2.1MB
-
Filesize
4.0MB
-
Filesize
7.7MB
-
Filesize
64KB
-
Filesize
408KB
-
Filesize
7.7MB
-
Filesize
64KB
-
Filesize
11.5MB
-
Filesize
128KB
-
Filesize
128KB
-
Filesize
80KB
-
Filesize
11.5MB
-
Filesize
11.5MB
-
Filesize
128KB
-
Filesize
128KB
-
Filesize
128KB
-
Filesize
11.5MB
-
Filesize
11.5MB
-
Filesize
11.5MB
-
Filesize
128KB
-
Filesize
11.5MB
-
Filesize
128KB
-
Filesize
128KB
-
Filesize
128KB
-
Filesize
11.5MB