Analysis
-
max time kernel
113s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20231222-en -
resource tags
-
submitted
12-01-2024 18:29
General
-
Target
572f91333f0ef870aa2a3ab21fdef3ee.exe
-
Size
2.1MB
-
MD5
572f91333f0ef870aa2a3ab21fdef3ee
-
SHA1
6e3de75d0ef2d51040714517b27fd67abb143e3d
-
SHA256
2b9df917c6efd68e0b700634a4e551950b86a730bd316690668e4e43b31d09ee
-
SHA512
7d90723b77a1e8e65be666940b05f18197f0ed91fc7ab6b4b639ad81b36d65fae2a1b3869a5255258d74499eaeed647852c79298f4f783523bafd3251db91131
-
SSDEEP
49152:AWM2OSAUhB0ETI++BrpMLdDQXWb+FPWRtr8HJ:XM2DD5IhBrpCFQXk+FPWf0J
Malware Config
Signatures
-
LoaderBot
LoaderBot is a loader written in .NET downloading and executing miners.
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
LoaderBot executable 1 IoCs
-
XMRig Miner payload 15 IoCs
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Drops startup file 1 IoCs
-
Executes dropped EXE 3 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Suspicious use of SetThreadContext 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 8 IoCs
-
Suspicious use of WriteProcessMemory 14 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\572f91333f0ef870aa2a3ab21fdef3ee.exe"C:\Users\Admin\AppData\Local\Temp\572f91333f0ef870aa2a3ab21fdef3ee.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\572f91333f0ef870aa2a3ab21fdef3ee.exeC:\Users\Admin\AppData\Local\Temp\572f91333f0ef870aa2a3ab21fdef3ee.exe2⤵
- Checks computer location settings
- Drops startup file
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe"C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe" -o pool.hashvault.pro:3333 -u 49ciCfWrkhQWz6LYXux4LV1P5eAFMfox1H2y3k6VSn7Jb39nDYDUiC6JFCUBDDf63GQqpKc5ZQQ8vCHwgzesAKHtJwB9o2i -p x -k -v=0 --donate-level=1 -t 43⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe"C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe" -o pool.hashvault.pro:3333 -u 49ciCfWrkhQWz6LYXux4LV1P5eAFMfox1H2y3k6VSn7Jb39nDYDUiC6JFCUBDDf63GQqpKc5ZQQ8vCHwgzesAKHtJwB9o2i -p x -k -v=0 --donate-level=1 -t 43⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe"C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe" -o pool.hashvault.pro:3333 -u 49ciCfWrkhQWz6LYXux4LV1P5eAFMfox1H2y3k6VSn7Jb39nDYDUiC6JFCUBDDf63GQqpKc5ZQQ8vCHwgzesAKHtJwB9o2i -p x -k -v=0 --donate-level=1 -t 43⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
605B
MD53654bd2c6957761095206ffdf92b0cb9
SHA16f10f7b5867877de7629afcff644c265e79b4ad3
SHA256c2a4be94cf4ed33d698d9838f4ffb47047da796e733ec11562463a1621212ab4
SHA512e2a81248cca7732ce098088d5237897493fd3629e28d66bc13e5f9191f72cd52893f4a53905906af12d5c6de475738b6c7f6b718a32869e9ee0deb3a54672f79
-
Filesize
1.3MB
MD54abdf1a0212a622b9cbdbd3cb77bbf21
SHA19bc45f66dfabba277f0d7b7e028d8cfb2fce8d37
SHA2564b76dd1361374f91a48bcc0b83f371dca0efc67d184066a6ea99667c5ad2bad0
SHA512fc1bd6c53f051e06e2336e93158e6e2119f5b1190e82f7dc340f839f02b9312a26a27c45bb3239f2ccd222903c51a3a454303726a0c9ef1a81645c0dfc183806
-
Filesize
382KB
MD5665ff3560d288fc8e9bc30985b8ff2d7
SHA165124d9277406151f7dd2d55a93aea144ab0962e
SHA256f0c28c3e9e6e3e6f6d19634c7d562001eabaeb2af6a17cf58aad5be98db739cc
SHA5129d06b0b9bc0c2de2256286e24db83d93a901a42ad29a79d6fb96dc7cab4b8c9452e10787ee48dd93d196e0fe491e4476277d940c331e59c2647a7e9725ceee65
-
Filesize
348KB
MD5a5d1a345894ac5b4af771575a5fbe9bf
SHA1a837a69566edc121577173a0dc54a8b2bc8ca862
SHA2562aa67254e16b4ad7981dfcc8b876809db83f3bb32b3292d93bbff02c344956a7
SHA5123997523ec2860b8831c6ee2c6f06b98f5adb701c0687dfc46992680ad3ff7fb41ed0e2943ad7040d76fa66949344d33fff665784144a1e9f731158432ef4e9cb
-
Filesize
80KB
-
Filesize
11.5MB
-
Filesize
11.5MB
-
Filesize
120KB
-
Filesize
472KB
-
Filesize
7.7MB
-
Filesize
7.7MB
-
Filesize
128KB
-
Filesize
64KB
-
Filesize
4KB
-
Filesize
2.1MB
-
Filesize
11.5MB
-
Filesize
11.5MB
-
Filesize
128KB
-
Filesize
128KB
-
Filesize
11.5MB
-
Filesize
11.5MB
-
Filesize
128KB
-
Filesize
128KB
-
Filesize
128KB
-
Filesize
128KB
-
Filesize
128KB
-
Filesize
128KB
-
Filesize
128KB
-
Filesize
11.5MB
-
Filesize
11.5MB
-
Filesize
128KB
-
Filesize
128KB
-
Filesize
128KB
-
Filesize
128KB
-
Filesize
11.5MB
-
Filesize
11.5MB
-
Filesize
11.5MB
-
Filesize
11.5MB
-
Filesize
408KB
-
Filesize
7.7MB
-
Filesize
64KB
-
Filesize
7.7MB
-
Filesize
64KB
-
Filesize
4.0MB
-
Filesize
11.5MB
-
Filesize
128KB
-
Filesize
128KB
-
Filesize
128KB
-
Filesize
128KB
-
Filesize
11.5MB
-
Filesize
11.5MB
-
Filesize
11.5MB
-
Filesize
128KB