Analysis

  • max time kernel
    150s
  • max time network
    120s
  • platform
    windows7_x64
  • resource
    win7-20231215-en
  • resource tags

    arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
  • submitted
    31-01-2024 01:03

General

  • Target

    830979606090d60f5dc4dcbf37357434.exe

  • Size

    341KB

  • MD5

    830979606090d60f5dc4dcbf37357434

  • SHA1

    f8c775a2a3f9f390013860b4b5a158759889c220

  • SHA256

    71951f44b136095b6d931247b2b9118447ec1eae54a07d28ad1ec53da218f476

  • SHA512

    b8ea5187c20557a74e47effec1df18c35f3aefff7743e732acf855df69c2aca06896e05586a413f8101168b77b644b07fe778d861038299c082531eef127584e

  • SSDEEP

    3072:NmwQcBN2litkEwfBNjXnAg0FujksEvYjckD95ra5u2DMLdp1eNZGjREiGuAF:NfQcD2stkj5nAOoFqZ5rsMLF2F

Malware Config

Extracted

Family

mylobot

C2

op17.ru:6006

eakalra.ru:1281

zgclgdb.ru:8518

hpifnad.ru:3721

lbjcwix.ru:8326

rykacfb.ru:8483

benkofx.ru:3333

fpzskbc.ru:9364

ouxtjzd.ru:8658

schwpxp.ru:2956

pspkgya.ru:2675

lmlwtdm.ru:2768

rzwnsph.ru:5898

awtiwzk.ru:9816

pzljenb.ru:3486

yhjtpyf.ru:3565

ogkbsoq.ru:2553

rjngcbj.ru:5655

jlfeopz.ru:4698

wqcruiz.ru:2165

Signatures

  • Mylobot

    Botnet which first appeared in 2017 written in C++.

  • Adds Run key to start application 2 TTPs 1 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Program crash 1 IoCs
  • Modifies registry class 3 IoCs
  • Suspicious behavior: EnumeratesProcesses 3 IoCs
  • Suspicious behavior: MapViewOfSection 1 IoCs
  • Suspicious use of WriteProcessMemory 25 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\830979606090d60f5dc4dcbf37357434.exe
    "C:\Users\Admin\AppData\Local\Temp\830979606090d60f5dc4dcbf37357434.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:2476
    • C:\Users\Admin\AppData\Local\Temp\830979606090d60f5dc4dcbf37357434.exe
      "C:\Users\Admin\AppData\Local\Temp\830979606090d60f5dc4dcbf37357434.exe"
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: MapViewOfSection
      • Suspicious use of WriteProcessMemory
      PID:292
      • C:\Windows\SysWOW64\svchost.exe
        "C:\Windows\system32\svchost.exe"
        3⤵
        • Adds Run key to start application
        • Modifies registry class
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of WriteProcessMemory
        PID:2688
    • C:\Users\Admin\AppData\Local\Temp\830979606090d60f5dc4dcbf37357434.exe
      "C:\Users\Admin\AppData\Local\Temp\830979606090d60f5dc4dcbf37357434.exe"
      2⤵
        PID:2776
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 2476 -s 152
        2⤵
        • Program crash
        PID:2764

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\ProgramData\{26F7AC83-8BE6-FA80-7A65-F6F0044C4A01}\8b487c1c.exe

      Filesize

      341KB

      MD5

      830979606090d60f5dc4dcbf37357434

      SHA1

      f8c775a2a3f9f390013860b4b5a158759889c220

      SHA256

      71951f44b136095b6d931247b2b9118447ec1eae54a07d28ad1ec53da218f476

      SHA512

      b8ea5187c20557a74e47effec1df18c35f3aefff7743e732acf855df69c2aca06896e05586a413f8101168b77b644b07fe778d861038299c082531eef127584e

    • memory/292-4-0x0000000000400000-0x000000000042B000-memory.dmp

      Filesize

      172KB

    • memory/292-3-0x0000000000400000-0x000000000042B000-memory.dmp

      Filesize

      172KB

    • memory/292-24-0x0000000000400000-0x000000000042B000-memory.dmp

      Filesize

      172KB

    • memory/292-6-0x0000000000400000-0x000000000042B000-memory.dmp

      Filesize

      172KB

    • memory/292-8-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

      Filesize

      4KB

    • memory/292-7-0x0000000000400000-0x000000000042B000-memory.dmp

      Filesize

      172KB

    • memory/292-13-0x0000000000400000-0x000000000042B000-memory.dmp

      Filesize

      172KB

    • memory/292-16-0x0000000000400000-0x000000000042B000-memory.dmp

      Filesize

      172KB

    • memory/292-15-0x0000000000400000-0x000000000042B000-memory.dmp

      Filesize

      172KB

    • memory/292-5-0x0000000000400000-0x000000000042B000-memory.dmp

      Filesize

      172KB

    • memory/2476-2-0x0000000002E70000-0x0000000002E71000-memory.dmp

      Filesize

      4KB

    • memory/2476-0-0x0000000000570000-0x0000000000571000-memory.dmp

      Filesize

      4KB

    • memory/2476-1-0x0000000000580000-0x0000000000581000-memory.dmp

      Filesize

      4KB

    • memory/2688-17-0x0000000000090000-0x00000000000E6000-memory.dmp

      Filesize

      344KB

    • memory/2688-23-0x0000000000130000-0x000000000015B000-memory.dmp

      Filesize

      172KB

    • memory/2688-36-0x0000000000130000-0x000000000015B000-memory.dmp

      Filesize

      172KB

    • memory/2688-22-0x0000000000130000-0x000000000015B000-memory.dmp

      Filesize

      172KB

    • memory/2688-21-0x0000000000130000-0x000000000015B000-memory.dmp

      Filesize

      172KB

    • memory/2688-20-0x0000000000130000-0x000000000015B000-memory.dmp

      Filesize

      172KB

    • memory/2688-18-0x0000000000130000-0x000000000015B000-memory.dmp

      Filesize

      172KB

    • memory/2764-25-0x0000000000060000-0x0000000000061000-memory.dmp

      Filesize

      4KB

    • memory/2764-29-0x0000000000050000-0x0000000000051000-memory.dmp

      Filesize

      4KB