Analysis
-
max time kernel
150s -
max time network
140s -
platform
windows10-2004_x64 -
resource
win10v2004-20231222-en -
resource tags
-
submitted
26-12-2023 05:19
General
-
Target
572f91333f0ef870aa2a3ab21fdef3ee.exe
-
Size
2.1MB
-
MD5
572f91333f0ef870aa2a3ab21fdef3ee
-
SHA1
6e3de75d0ef2d51040714517b27fd67abb143e3d
-
SHA256
2b9df917c6efd68e0b700634a4e551950b86a730bd316690668e4e43b31d09ee
-
SHA512
7d90723b77a1e8e65be666940b05f18197f0ed91fc7ab6b4b639ad81b36d65fae2a1b3869a5255258d74499eaeed647852c79298f4f783523bafd3251db91131
-
SSDEEP
49152:AWM2OSAUhB0ETI++BrpMLdDQXWb+FPWRtr8HJ:XM2DD5IhBrpCFQXk+FPWf0J
Malware Config
Signatures
-
LoaderBot
LoaderBot is a loader written in .NET downloading and executing miners.
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
LoaderBot executable 1 IoCs
-
XMRig Miner payload 14 IoCs
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Drops startup file 1 IoCs
-
Executes dropped EXE 2 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Suspicious use of SetThreadContext 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 6 IoCs
-
Suspicious use of WriteProcessMemory 12 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\572f91333f0ef870aa2a3ab21fdef3ee.exe"C:\Users\Admin\AppData\Local\Temp\572f91333f0ef870aa2a3ab21fdef3ee.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\572f91333f0ef870aa2a3ab21fdef3ee.exeC:\Users\Admin\AppData\Local\Temp\572f91333f0ef870aa2a3ab21fdef3ee.exe2⤵
- Checks computer location settings
- Drops startup file
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe"C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe" -o pool.hashvault.pro:3333 -u 49ciCfWrkhQWz6LYXux4LV1P5eAFMfox1H2y3k6VSn7Jb39nDYDUiC6JFCUBDDf63GQqpKc5ZQQ8vCHwgzesAKHtJwB9o2i -p x -k -v=0 --donate-level=1 -t 43⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe"C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe" -o pool.hashvault.pro:3333 -u 49ciCfWrkhQWz6LYXux4LV1P5eAFMfox1H2y3k6VSn7Jb39nDYDUiC6JFCUBDDf63GQqpKc5ZQQ8vCHwgzesAKHtJwB9o2i -p x -k -v=0 --donate-level=1 -t 43⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
605B
MD53654bd2c6957761095206ffdf92b0cb9
SHA16f10f7b5867877de7629afcff644c265e79b4ad3
SHA256c2a4be94cf4ed33d698d9838f4ffb47047da796e733ec11562463a1621212ab4
SHA512e2a81248cca7732ce098088d5237897493fd3629e28d66bc13e5f9191f72cd52893f4a53905906af12d5c6de475738b6c7f6b718a32869e9ee0deb3a54672f79
-
Filesize
138KB
MD5abd7bfc8dac562f472b04ef3e55f1854
SHA1df1f70b178fd626ccaa3232a88552e7f35a47a6e
SHA2568dd37ba4d41fa3e14fff5063cc53a7e44c5f8c156c4b8fb6087c6d3c7f02d39e
SHA5129dc411011b21b143c260e342dc92081e817790b02a82a50d65c3bcca02a3ac6ecad91537d78735394cb0b7f4560e875f04cb174834ca8ab502da2da92ab39520
-
Filesize
126KB
MD55034ff4e4362a941008d1edbeae90516
SHA18878dea50de9986b52554405da8d550396899d57
SHA2565eb4cf494390caeaec51adcc33b839c047e070eb3c1bf1a0e2d2f10f0d203361
SHA512de58f7f7c493e2abf67d250b0e3298ebc006135861d3efbb5b845d26a09e9683d8f2b5221a16543ed8ff035c73c4f6fda31308d4f42729f30ce130d5ce7de5cc
-
Filesize
111KB
MD53f036e75605c8fc4487d567db2622240
SHA1c903f9007f709e2e460cd16a3ff10b07884e2991
SHA256d777a144dca27bc4361603db59f0e17e8606b288f99cd270258988506783d844
SHA512fa31b3dbe9fe3d257433a4588983b53a2e30dfb83ad1de7254d85a55e4ee83221396a8cf2b6ddbc54a18b532c2c6b4ef6c92bb21be838da7d3c9861bfe09a22b
-
Filesize
12KB
MD5d942d1cdb89d09af104473d78e32cebb
SHA17a23446d8319e2e1cb21b35a0a878365e4240702
SHA256bbf83d5088dba3ce2cd35e2b65e29790fc14c60b3e6ff136c225928e23318900
SHA512be2c1c49f7e9e3047ed2cc0b7f3396bdea36af353f3040328009f036b2260af14dc52c0fca1f534aa521b7e9f830993d189b13acc56fdb57134bab7faf839c54
-
Filesize
11.5MB
-
Filesize
80KB
-
Filesize
11.5MB
-
Filesize
7.7MB
-
Filesize
408KB
-
Filesize
64KB
-
Filesize
4.0MB
-
Filesize
7.7MB
-
Filesize
64KB
-
Filesize
120KB
-
Filesize
64KB
-
Filesize
128KB
-
Filesize
472KB
-
Filesize
7.7MB
-
Filesize
4KB
-
Filesize
64KB
-
Filesize
2.1MB
-
Filesize
7.7MB
-
Filesize
7.7MB
-
Filesize
128KB
-
Filesize
128KB
-
Filesize
128KB
-
Filesize
11.5MB
-
Filesize
128KB
-
Filesize
128KB
-
Filesize
11.5MB
-
Filesize
11.5MB
-
Filesize
11.5MB
-
Filesize
128KB
-
Filesize
128KB
-
Filesize
11.5MB
-
Filesize
128KB
-
Filesize
128KB
-
Filesize
11.5MB
-
Filesize
11.5MB
-
Filesize
11.5MB
-
Filesize
11.5MB
-
Filesize
11.5MB
-
Filesize
11.5MB
-
Filesize
11.5MB
-
Filesize
11.5MB