Analysis
- max time kernel
146s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-20231215-en - resource tags
- submitted
22/01/2024, 12:57
General
- Target 328-875-0x00000000001C0000-0x0000000000928000-memory.exe
- Size 7.4MB
- Sample240122-p7dfjagcd8
- SHA256 f9a988fa961effa94a6369aec4427e07fd0134d28c5161b0499000b0935a87df
Malware Config
Extracted
-
loaderbot
-
https://ca94025.tw1.ru/cmd.php
Signatures
- LoaderBot
LoaderBot is a loader written in .NET downloading and executing miners.
- xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
- LoaderBot executable 1 IoCs
- XMRig Miner payload 16 IoCs
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
- Drops startup file 1 IoCs
- Executes dropped EXE 3 IoCs
- Adds Run key to start application 2 TTPs 1 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: LoadsDriver 2 IoCs
- Suspicious behavior: RenamesItself 1 IoCs
- Suspicious use of AdjustPrivilegeToken 7 IoCs
- Suspicious use of WriteProcessMemory 6 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\328-875-0x00000000001C0000-0x0000000000928000-memory.exe"C:\Users\Admin\AppData\Local\Temp\328-875-0x00000000001C0000-0x0000000000928000-memory.exe"1⤵
- Checks computer location settings
- Drops startup file
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe"C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe" -o pool.hashvault.pro:3333 -u 49t6urp39F9WQ7iprgWtoA7Xv6iYT8krNCAqo4qJXsrcP2CwHMcQzEsEZJtJLMsdQwSboNLC6a6AsgbKkrHqj6AGJyssTjJ -p x -k -v=0 --donate-level=1 -t 42⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe"C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe" -o pool.hashvault.pro:3333 -u 49t6urp39F9WQ7iprgWtoA7Xv6iYT8krNCAqo4qJXsrcP2CwHMcQzEsEZJtJLMsdQwSboNLC6a6AsgbKkrHqj6AGJyssTjJ -p x -k -v=0 --donate-level=1 -t 42⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe"C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe" -o pool.hashvault.pro:3333 -u 49t6urp39F9WQ7iprgWtoA7Xv6iYT8krNCAqo4qJXsrcP2CwHMcQzEsEZJtJLMsdQwSboNLC6a6AsgbKkrHqj6AGJyssTjJ -p x -k -v=0 --donate-level=1 -t 42⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
Driver.exe
memory/3236-31-0x0000000140000000-0x0000000140B75000-memory.dmp
memory/3236-42-0x0000000140000000-0x0000000140B75000-memory.dmp
memory/3236-50-0x00000000137E0000-0x0000000013800000-memory.dmp
memory/3236-49-0x0000000002120000-0x0000000002140000-memory.dmp
memory/3236-48-0x0000000002100000-0x0000000002120000-memory.dmp
memory/3236-34-0x0000000002120000-0x0000000002140000-memory.dmp
memory/3236-47-0x00000000135B0000-0x00000000135D0000-memory.dmp
memory/3236-21-0x00000000020E0000-0x0000000002100000-memory.dmp
memory/3236-22-0x0000000140000000-0x0000000140B75000-memory.dmp
memory/3236-23-0x0000000140000000-0x0000000140B75000-memory.dmp
memory/3236-46-0x0000000140000000-0x0000000140B75000-memory.dmp
memory/3236-25-0x0000000002100000-0x0000000002120000-memory.dmp
memory/3236-26-0x0000000002120000-0x0000000002140000-memory.dmp
memory/3236-27-0x00000000135B0000-0x00000000135D0000-memory.dmp
memory/3236-45-0x0000000140000000-0x0000000140B75000-memory.dmp
memory/3236-29-0x00000000137E0000-0x0000000013800000-memory.dmp
memory/3236-30-0x0000000140000000-0x0000000140B75000-memory.dmp
memory/3236-44-0x0000000140000000-0x0000000140B75000-memory.dmp
memory/3236-43-0x0000000140000000-0x0000000140B75000-memory.dmp
memory/3236-33-0x0000000002100000-0x0000000002120000-memory.dmp
memory/3236-32-0x0000000140000000-0x0000000140B75000-memory.dmp
memory/3236-35-0x00000000135B0000-0x00000000135D0000-memory.dmp
memory/3236-36-0x00000000137E0000-0x0000000013800000-memory.dmp
memory/3236-37-0x0000000140000000-0x0000000140B75000-memory.dmp
memory/3236-38-0x0000000140000000-0x0000000140B75000-memory.dmp
memory/3236-39-0x0000000140000000-0x0000000140B75000-memory.dmp
memory/3236-40-0x0000000140000000-0x0000000140B75000-memory.dmp
memory/3236-41-0x0000000140000000-0x0000000140B75000-memory.dmp
memory/4220-5-0x0000000005990000-0x00000000059A0000-memory.dmp
memory/4220-0-0x00000000752E0000-0x0000000075A90000-memory.dmp
memory/4220-28-0x0000000005990000-0x00000000059A0000-memory.dmp
memory/4220-24-0x00000000752E0000-0x0000000075A90000-memory.dmp
memory/4220-1-0x0000000000760000-0x0000000000EC8000-memory.dmp
memory/4220-4-0x0000000005B80000-0x0000000005BE6000-memory.dmp
memory/4912-17-0x0000000001FC0000-0x0000000001FD4000-memory.dmp
memory/4912-18-0x0000000140000000-0x0000000140B75000-memory.dmp
memory/4912-15-0x0000000140000000-0x0000000140B75000-memory.dmp