Analysis
- max time kernel
61s - max time network
199s - platform
windows11-21h2_x64 - resource
win11-20240214-en - resource tags
- submitted
19/02/2024, 09:00
General
- Target W1nnerFree CS2.exe
- Size 21.4MB
- Sample240219-kydbysbf4t
- SHA256 0fa48a6368effe6c9373dd34f9f26bf7f0a2050aab330cefc5acc6de5030ecb6
Malware Config
Signatures
- LoaderBot
LoaderBot is a loader written in .NET downloading and executing miners.
- xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
- LoaderBot executable 4 IoCs
- XMRig Miner payload 1 IoCs
- Drops startup file 1 IoCs
- Executes dropped EXE 4 IoCs
- Loads dropped DLL 6 IoCs
- Adds Run key to start application 2 TTPs 1 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of SetWindowsHookEx 2 IoCs
- Suspicious use of WriteProcessMemory 17 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\W1nnerFree CS2.exe"C:\Users\Admin\AppData\Local\Temp\W1nnerFree CS2.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\1337\ExLoader_Installer.exe"C:\Users\Admin\AppData\Roaming\1337\ExLoader_Installer.exe"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\RarSFX0\ExLoader_Installer.exe"C:\Users\Admin\AppData\Local\Temp\RarSFX0\ExLoader_Installer.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\cmd.exeC:\Windows\System32\cmd.exe /C C:\Windows\System32\reg.exe query HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography /v MachineGuid4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\reg.exeC:\Windows\System32\reg.exe query HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography /v MachineGuid5⤵
-
-
-
C:\Windows\System32\cmd.exeC:\Windows\System32\cmd.exe /C C:\Windows\System32\reg.exe query HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography /v MachineGuid4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\reg.exeC:\Windows\System32\reg.exe query HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography /v MachineGuid5⤵
-
-
-
-
-
C:\Users\Admin\AppData\Roaming\1337\MinerMega.exe"C:\Users\Admin\AppData\Roaming\1337\MinerMega.exe"2⤵
- Drops startup file
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe"C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe" -o pool.hashvault.pro:3333 -u 84EUKYR2H11atFNVAkBBeN2ms43rYAvFBbYJjA37BKULYfBZ7TptXP2aw6mPcBAg9yM6w27ntDcuDMq3iHJbUYPBTbuT74U -p x -k -v=0 --donate-level=1 -t 43⤵
- Executes dropped EXE
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
ExLoader_Installer.exe
d3dcompiler_47.dll
app.so
AssetManifest.bin
FontManifest.json
Warcraft.jpg
RE.png
SJ.png
Raleway-Black.ttf
Raleway-Bold.ttf
Raleway-ExtraBold.ttf
Raleway-Medium.ttf
Raleway-SemiBold.ttf
close.svg
collapse.svg
grain.png
icudtl.dat
flutter_windows.dll
flutter_windows.dll
msvcp140.dll
vcruntime140.dll
vcruntime140_1.dll
System.dll
ExLoader_Installer.exe
MinerMega.exe
MinerMega.exe
MinerMega.exe
Driver.exe
shared_preferences.json
memory/1512-1183-0x0000000140000000-0x0000000140B75000-memory.dmp
memory/1512-1196-0x0000000004B20000-0x0000000004E94000-memory.dmp
memory/1512-1202-0x0000000006020000-0x0000000006394000-memory.dmp
memory/1512-1200-0x0000000005920000-0x0000000005C94000-memory.dmp
memory/1512-1201-0x0000000005CA0000-0x0000000006014000-memory.dmp
memory/1512-1199-0x00000000055A0000-0x0000000005914000-memory.dmp
memory/1512-1198-0x0000000005220000-0x0000000005594000-memory.dmp
memory/1512-1197-0x0000000004EA0000-0x0000000005214000-memory.dmp
memory/1512-1195-0x00000000047A0000-0x0000000004B14000-memory.dmp
memory/1512-1194-0x0000000004420000-0x0000000004794000-memory.dmp
memory/1512-1184-0x0000000001F20000-0x0000000001F34000-memory.dmp
memory/1512-1185-0x0000000140000000-0x0000000140B75000-memory.dmp
memory/1512-1186-0x0000000002820000-0x0000000002B94000-memory.dmp
memory/1512-1187-0x0000000002BA0000-0x0000000002F14000-memory.dmp
memory/1512-1188-0x0000000002F20000-0x0000000003294000-memory.dmp
memory/1512-1189-0x00000000032A0000-0x0000000003614000-memory.dmp
memory/1512-1191-0x00000000039A0000-0x0000000003D14000-memory.dmp
memory/1512-1190-0x0000000003620000-0x0000000003994000-memory.dmp
memory/1512-1192-0x0000000003D20000-0x0000000004094000-memory.dmp
memory/1512-1193-0x00000000040A0000-0x0000000004414000-memory.dmp
memory/1664-26-0x0000000000CF0000-0x00000000010EE000-memory.dmp
memory/1664-1171-0x0000000005E40000-0x0000000005EA6000-memory.dmp
memory/1664-1172-0x0000000003480000-0x0000000003490000-memory.dmp
memory/1664-27-0x0000000074830000-0x0000000074FE1000-memory.dmp
memory/1664-1221-0x0000000074830000-0x0000000074FE1000-memory.dmp
memory/1664-1222-0x0000000003480000-0x0000000003490000-memory.dmp
memory/5068-1128-0x000002366FE00000-0x0000023670BFD000-memory.dmp
memory/5068-1129-0x000002366FE00000-0x0000023670BFD000-memory.dmp
memory/5068-1130-0x000002366D730000-0x000002366D731000-memory.dmp
memory/5068-1127-0x000002366FE00000-0x0000023670BFD000-memory.dmp
memory/5068-1126-0x000002366D720000-0x000002366D721000-memory.dmp