loaderbot | 7693091a21dc487f97f0ca1f51153e305587bf505460bbdee2fdee19e2584119

Analysis

max time kernel
12s
max time network
142s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
16-04-2024 04:06

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

f2a6e8143d7778697c0396b2ebbbc97f_JaffaCakes118.exe
Size

12.6MB
MD5

f2a6e8143d7778697c0396b2ebbbc97f
SHA1

8e3f4db2c4e54ec274d0943af9c2d28e11256375
SHA256

7693091a21dc487f97f0ca1f51153e305587bf505460bbdee2fdee19e2584119
SHA512

04c411ebb219720462bbfe005f68fde1aa90e1c633bc4133298479053c28a5846068a38c611c9f94ecfeb4f0e8e81c65032afd373227e1aa69780258ff933849
SSDEEP

393216:fRtouHPatS+kxpNEMijBwGlUBfI+CYQxl9K3:fMuv9+k3JBI6Qxl9

Score

10^/10

loaderbot evasion loader miner persistence trojan vmprotect

Malware Config

Signatures

LoaderBot
LoaderBot is a loader written in .NET downloading and executing miners.
loader miner loaderbot

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Driver.exe

LoaderBot executable 1 IoCs

resource	yara_rule
behavioral1/memory/1972-1-0x0000000001360000-0x000000000265A000-memory.dmp	loaderbot

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	Driver.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	Driver.exe

Drops startup file 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Driver.url	f2a6e8143d7778697c0396b2ebbbc97f_JaffaCakes118.exe

Executes dropped EXE 1 IoCs

pid	Process
2576	Driver.exe

Loads dropped DLL 1 IoCs

pid	Process
1972	f2a6e8143d7778697c0396b2ebbbc97f_JaffaCakes118.exe

VMProtect packed file 1 IoCs

Detects executables packed with VMProtect commercial packer.

vmprotect

resource	yara_rule
behavioral1/memory/1972-1-0x0000000001360000-0x000000000265A000-memory.dmp	vmprotect

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Run\Driver = "C:\\Users\\Admin\\AppData\\Roaming\\Sysfiles\\f2a6e8143d7778697c0396b2ebbbc97f_JaffaCakes118.exe"	f2a6e8143d7778697c0396b2ebbbc97f_JaffaCakes118.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	Driver.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1972	f2a6e8143d7778697c0396b2ebbbc97f_JaffaCakes118.exe
1972	f2a6e8143d7778697c0396b2ebbbc97f_JaffaCakes118.exe
1972	f2a6e8143d7778697c0396b2ebbbc97f_JaffaCakes118.exe
1972	f2a6e8143d7778697c0396b2ebbbc97f_JaffaCakes118.exe
1972	f2a6e8143d7778697c0396b2ebbbc97f_JaffaCakes118.exe
1972	f2a6e8143d7778697c0396b2ebbbc97f_JaffaCakes118.exe
1972	f2a6e8143d7778697c0396b2ebbbc97f_JaffaCakes118.exe
1972	f2a6e8143d7778697c0396b2ebbbc97f_JaffaCakes118.exe
1972	f2a6e8143d7778697c0396b2ebbbc97f_JaffaCakes118.exe
1972	f2a6e8143d7778697c0396b2ebbbc97f_JaffaCakes118.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
1972	f2a6e8143d7778697c0396b2ebbbc97f_JaffaCakes118.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	1972	f2a6e8143d7778697c0396b2ebbbc97f_JaffaCakes118.exe
Token: SeLockMemoryPrivilege	2576	Driver.exe
Token: SeLockMemoryPrivilege	2576	Driver.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1972 wrote to memory of 2576	1972	f2a6e8143d7778697c0396b2ebbbc97f_JaffaCakes118.exe	29
PID 1972 wrote to memory of 2576	1972	f2a6e8143d7778697c0396b2ebbbc97f_JaffaCakes118.exe	29
PID 1972 wrote to memory of 2576	1972	f2a6e8143d7778697c0396b2ebbbc97f_JaffaCakes118.exe	29
PID 1972 wrote to memory of 2576	1972	f2a6e8143d7778697c0396b2ebbbc97f_JaffaCakes118.exe	29

C:\Users\Admin\AppData\Local\Temp\f2a6e8143d7778697c0396b2ebbbc97f_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\f2a6e8143d7778697c0396b2ebbbc97f_JaffaCakes118.exe"
1⤵
- Drops startup file
- Loads dropped DLL
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1972
- C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe
  "C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe" -o pool.supportxmr.com:3333 -u 48VqBvWwx4DFvegwZp7dE7WpBeYWhdaZUF8BiWc6HdwsP89dK2tiqnHSuyyBjeSn9cZ2ZCMrVrVDkAhGNvCC44DKL2zvQn1 -p x -k -v=0 --donate-level=1 -t 4
  2⤵
  - Identifies VirtualBox via ACPI registry values (likely anti-VM)
  - Checks BIOS information in registry
  - Executes dropped EXE
  - Checks whether UAC is enabled
  - Suspicious use of AdjustPrivilegeToken
  PID:2576

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe

Filesize
6.2MB

MD5
69db4898504d484299184227fc5864e5

SHA1
2099fef060129cffc199a3fcf2668dd9e2da545a

SHA256
83d13dc72e47b60a336d2f976234b5d0331bbd82d80c1b691ac7ea065b50cdb5

SHA512
2abb486cb7abf897474be642cc460f9c4a84eb692b697ca473f326211f295471cd0bb9363094d3f6a179c2b28a068f01b85065530d96c11cc9c8a59c4cbb46d1

Download Submit
memory/1972-0-0x0000000074A50000-0x000000007513E000-memory.dmp

Filesize
6.9MB

Download
memory/1972-1-0x0000000001360000-0x000000000265A000-memory.dmp

Filesize
19.0MB

Download
memory/1972-3-0x00000000003C0000-0x0000000000400000-memory.dmp

Filesize
256KB

Download
memory/1972-2-0x00000000003C0000-0x0000000000400000-memory.dmp

Filesize
256KB

Download
memory/1972-4-0x00000000003C0000-0x0000000000400000-memory.dmp

Filesize
256KB

Download
memory/1972-60-0x00000000003C0000-0x0000000000400000-memory.dmp

Filesize
256KB

Download
memory/1972-58-0x00000000003C0000-0x0000000000400000-memory.dmp

Filesize
256KB

Download
memory/1972-55-0x00000000003C0000-0x0000000000400000-memory.dmp

Filesize
256KB

Download
memory/1972-51-0x0000000074A50000-0x000000007513E000-memory.dmp

Filesize
6.9MB

Download
memory/2576-44-0x0000000000360000-0x0000000000380000-memory.dmp

Filesize
128KB

Download
memory/2576-16-0x000000013FEF0000-0x00000001412A0000-memory.dmp

Filesize
19.7MB

Download
memory/2576-28-0x00000000001B0000-0x00000000001BC000-memory.dmp

Filesize
48KB

Download
memory/2576-34-0x0000000180000000-0x000000018008D000-memory.dmp

Filesize
564KB

Download
memory/2576-40-0x000000013FEF0000-0x00000001412A0000-memory.dmp

Filesize
19.7MB

Download
memory/2576-41-0x000000013FEF0000-0x00000001412A0000-memory.dmp

Filesize
19.7MB

Download
memory/2576-42-0x000000013FEF0000-0x00000001412A0000-memory.dmp

Filesize
19.7MB

Download
memory/2576-43-0x000000013FEF0000-0x00000001412A0000-memory.dmp

Filesize
19.7MB

Download
memory/2576-17-0x000000013FEF0000-0x00000001412A0000-memory.dmp

Filesize
19.7MB

Download
memory/2576-45-0x000007FE80010000-0x000007FE80011000-memory.dmp

Filesize
4KB

Download
memory/2576-46-0x00000000024E0000-0x0000000002500000-memory.dmp

Filesize
128KB

Download
memory/2576-47-0x0000000002500000-0x0000000002520000-memory.dmp

Filesize
128KB

Download
memory/2576-48-0x0000000002520000-0x0000000002540000-memory.dmp

Filesize
128KB

Download
memory/2576-49-0x0000000002540000-0x0000000002560000-memory.dmp

Filesize
128KB

Download
memory/2576-50-0x000000013FEF0000-0x00000001412A0000-memory.dmp

Filesize
19.7MB

Download
memory/2576-20-0x0000000000340000-0x000000000035B000-memory.dmp

Filesize
108KB

Download
memory/2576-52-0x000000013FEF0000-0x00000001412A0000-memory.dmp

Filesize
19.7MB

Download
memory/2576-54-0x000000013FEF0000-0x00000001412A0000-memory.dmp

Filesize
19.7MB

Download
memory/2576-15-0x000000013FEF0000-0x00000001412A0000-memory.dmp

Filesize
19.7MB

Download
memory/2576-56-0x000000013FEF0000-0x00000001412A0000-memory.dmp

Filesize
19.7MB

Download
memory/2576-12-0x0000000000180000-0x0000000000181000-memory.dmp

Filesize
4KB

Download
memory/2576-59-0x000000013FEF0000-0x00000001412A0000-memory.dmp

Filesize
19.7MB

Download
memory/2576-11-0x000007FEFD9C0000-0x000007FEFDA2C000-memory.dmp

Filesize
432KB

Download
memory/2576-61-0x000000013FEF0000-0x00000001412A0000-memory.dmp

Filesize
19.7MB

Download
memory/2576-62-0x000000013FEF0000-0x00000001412A0000-memory.dmp

Filesize
19.7MB

Download
memory/2576-63-0x000007FEFD9C0000-0x000007FEFDA2C000-memory.dmp

Filesize
432KB

Download
memory/2576-65-0x000000013FEF0000-0x00000001412A0000-memory.dmp

Filesize
19.7MB

Download
memory/2576-66-0x0000000000180000-0x0000000000181000-memory.dmp

Filesize
4KB

Download
memory/2576-67-0x000000013FEF0000-0x00000001412A0000-memory.dmp

Filesize
19.7MB

Download