Analysis
- max time kernel
38s - max time network
153s - platform
windows10-2004_x64 - resource
win10v2004-20240412-en - resource tags
- submitted
14/04/2024, 01:46
General
- Target 7fd525394f449871ea7be96a66ddc1ff6cb498aaaee85549cae392a782670780.exe
- Size 4.2MB
- Sample240414-b7cmcagb2s
- SHA256 7fd525394f449871ea7be96a66ddc1ff6cb498aaaee85549cae392a782670780
Malware Config
Signatures
- LoaderBot
LoaderBot is a loader written in .NET downloading and executing miners.
- xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
- LoaderBot executable 2 IoCs
- XMRig Miner payload 16 IoCs
- Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
- Drops startup file 1 IoCs
- Executes dropped EXE 6 IoCs
- Loads dropped DLL 3 IoCs
- Adds Run key to start application 2 TTPs 1 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: LoadsDriver 1 IoCs
- Suspicious use of AdjustPrivilegeToken 17 IoCs
- Suspicious use of WriteProcessMemory 19 IoCs
- Views/modifies file attributes 1 TTPs 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\7fd525394f449871ea7be96a66ddc1ff6cb498aaaee85549cae392a782670780.exe"C:\Users\Admin\AppData\Local\Temp\7fd525394f449871ea7be96a66ddc1ff6cb498aaaee85549cae392a782670780.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\main\main.bat" /S"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\mode.commode 65,103⤵
-
-
C:\Users\Admin\AppData\Local\Temp\main\7z.exe7z.exe e file.zip -p12151210907486279731870130990 -oextracted3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\main\7z.exe7z.exe e extracted/file_2.zip -oextracted3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\main\7z.exe7z.exe e extracted/file_1.zip -oextracted3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\attrib.exeattrib +H "Installer.exe"3⤵
- Views/modifies file attributes
-
-
C:\Users\Admin\AppData\Local\Temp\main\Installer.exe"Installer.exe"3⤵
- Checks computer location settings
- Drops startup file
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe"C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe" -o pool.supportxmr.com:3333 -u 4AAVoaf13Do2Jqvf6MT9z7bF1AbfFL5i1b6pLTTWa8t4aj46CBnKFFtSR6xYN9xshV7aQJC51fLe3ErWugFWGZWMMe4j2Ea -p x -k -v=0 --donate-level=0 -t 44⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe"C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe" -o pool.supportxmr.com:3333 -u 4AAVoaf13Do2Jqvf6MT9z7bF1AbfFL5i1b6pLTTWa8t4aj46CBnKFFtSR6xYN9xshV7aQJC51fLe3ErWugFWGZWMMe4j2Ea -p x -k -v=0 --donate-level=0 -t 44⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe"C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe" -o pool.supportxmr.com:3333 -u 4AAVoaf13Do2Jqvf6MT9z7bF1AbfFL5i1b6pLTTWa8t4aj46CBnKFFtSR6xYN9xshV7aQJC51fLe3ErWugFWGZWMMe4j2Ea -p x -k -v=0 --donate-level=0 -t 44⤵
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
7z.dll
7z.exe
ANTIAV~1.DAT
Installer.exe
file_1.zip
file_2.zip
file.bin
main.bat
Driver.exe
memory/3052-61-0x0000000073B10000-0x00000000742C0000-memory.dmp
memory/3052-37-0x0000000073B10000-0x00000000742C0000-memory.dmp
memory/3052-38-0x00000000001E0000-0x00000000005DE000-memory.dmp
memory/3052-42-0x00000000052E0000-0x0000000005346000-memory.dmp
memory/3052-41-0x00000000050D0000-0x00000000050E0000-memory.dmp
memory/3052-66-0x00000000050D0000-0x00000000050E0000-memory.dmp
memory/3420-81-0x00000000137E0000-0x0000000013800000-memory.dmp
memory/3420-76-0x0000000140000000-0x0000000140B75000-memory.dmp
memory/3420-59-0x0000000140000000-0x0000000140B75000-memory.dmp
memory/3420-60-0x0000000140000000-0x0000000140B75000-memory.dmp
memory/3420-79-0x00000000135A0000-0x00000000135C0000-memory.dmp
memory/3420-63-0x0000000002010000-0x0000000002030000-memory.dmp
memory/3420-62-0x0000000001FF0000-0x0000000002010000-memory.dmp
memory/3420-64-0x00000000135A0000-0x00000000135C0000-memory.dmp
memory/3420-65-0x00000000137E0000-0x0000000013800000-memory.dmp
memory/3420-80-0x0000000001FF0000-0x0000000002010000-memory.dmp
memory/3420-67-0x0000000140000000-0x0000000140B75000-memory.dmp
memory/3420-68-0x0000000140000000-0x0000000140B75000-memory.dmp
memory/3420-69-0x0000000140000000-0x0000000140B75000-memory.dmp
memory/3420-70-0x0000000001FF0000-0x0000000002010000-memory.dmp
memory/3420-71-0x0000000002010000-0x0000000002030000-memory.dmp
memory/3420-72-0x00000000135A0000-0x00000000135C0000-memory.dmp
memory/3420-73-0x00000000137E0000-0x0000000013800000-memory.dmp
memory/3420-74-0x0000000140000000-0x0000000140B75000-memory.dmp
memory/3420-75-0x0000000140000000-0x0000000140B75000-memory.dmp
memory/3420-58-0x0000000001FD0000-0x0000000001FF0000-memory.dmp
memory/3420-77-0x0000000140000000-0x0000000140B75000-memory.dmp
memory/3420-78-0x0000000002010000-0x0000000002030000-memory.dmp
memory/3980-54-0x00000000005D0000-0x00000000005E4000-memory.dmp
memory/3980-55-0x0000000140000000-0x0000000140B75000-memory.dmp
memory/3980-52-0x0000000140000000-0x0000000140B75000-memory.dmp
memory/4100-89-0x0000000140000000-0x0000000140B75000-memory.dmp
memory/4100-91-0x0000000140000000-0x0000000140B75000-memory.dmp
memory/4100-86-0x0000000002010000-0x0000000002030000-memory.dmp
memory/4100-87-0x0000000002030000-0x0000000002050000-memory.dmp
memory/4100-88-0x0000000002050000-0x0000000002070000-memory.dmp
memory/4100-84-0x0000000140000000-0x0000000140B75000-memory.dmp
memory/4100-90-0x0000000140000000-0x0000000140B75000-memory.dmp
memory/4100-85-0x0000000001FF0000-0x0000000002010000-memory.dmp
memory/4100-92-0x0000000001FF0000-0x0000000002010000-memory.dmp
memory/4100-93-0x0000000140000000-0x0000000140B75000-memory.dmp
memory/4100-94-0x0000000002010000-0x0000000002030000-memory.dmp
memory/4100-95-0x0000000002030000-0x0000000002050000-memory.dmp
memory/4100-96-0x0000000002050000-0x0000000002070000-memory.dmp
memory/4100-97-0x0000000140000000-0x0000000140B75000-memory.dmp