Analysis

  • max time kernel
    145s
  • max time network
    120s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    12-05-2024 11:24

General

  • Target

    9c47cd82.exe

  • Size

    284KB

  • MD5

    add07689c5b49b370081d3872d610696

  • SHA1

    ce0001c8b21cd23f66eb401c2f09f5347c743ac6

  • SHA256

    4e812c0035be66b12f3bfed4aea833e51badac0f938051c5e3bd88aa31c5816d

  • SHA512

    46c7c0b9a8f1ba7608c9b3eb73d67a333dd7bbd8f75f155bdf27c8c8d08e2cf8ae42b29e5542ef2915669a37637fca6bf9178eae541123a42d63f774a0b66372

  • SSDEEP

    6144:L5wTHwhi1uOD7sFhh/t+M32CuFrPUDwIFucurrKO:L5wTQouk7sFHt+M2CuFrPUsfcDO

Malware Config

Extracted

Family

mylobot

C2

op17.ru:6006

eakalra.ru:1281

zgclgdb.ru:8518

hpifnad.ru:3721

lbjcwix.ru:8326

rykacfb.ru:8483

benkofx.ru:3333

fpzskbc.ru:9364

ouxtjzd.ru:8658

schwpxp.ru:2956

pspkgya.ru:2675

lmlwtdm.ru:2768

rzwnsph.ru:5898

awtiwzk.ru:9816

pzljenb.ru:3486

yhjtpyf.ru:3565

ogkbsoq.ru:2553

rjngcbj.ru:5655

jlfeopz.ru:4698

wqcruiz.ru:2165

Signatures

  • Mylobot

    Botnet which first appeared in 2017 written in C++.

  • Deletes itself 1 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Modifies registry class 3 IoCs
  • Suspicious behavior: EnumeratesProcesses 3 IoCs
  • Suspicious behavior: MapViewOfSection 1 IoCs
  • Suspicious use of WriteProcessMemory 23 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\9c47cd82.exe
    "C:\Users\Admin\AppData\Local\Temp\9c47cd82.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:2724
    • C:\Users\Admin\AppData\Local\Temp\9c47cd82.exe
      "C:\Users\Admin\AppData\Local\Temp\9c47cd82.exe"
      2⤵
      • Adds Run key to start application
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: MapViewOfSection
      • Suspicious use of WriteProcessMemory
      PID:5488
      • C:\Windows\SysWOW64\svchost.exe
        "C:\Windows\system32\svchost.exe"
        3⤵
        • Deletes itself
        • Modifies registry class
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of WriteProcessMemory
        PID:5568
        • C:\Windows\SysWOW64\notepad.exe
          "C:\Windows\system32\notepad.exe"
          4⤵
            PID:5652

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • \??\c:\users\admin\appdata\roaming\{58B7BA2A-63DB-2E16-E59F-41C5B2A04704}\f5086ab5.exe

      Filesize

      284KB

      MD5

      add07689c5b49b370081d3872d610696

      SHA1

      ce0001c8b21cd23f66eb401c2f09f5347c743ac6

      SHA256

      4e812c0035be66b12f3bfed4aea833e51badac0f938051c5e3bd88aa31c5816d

      SHA512

      46c7c0b9a8f1ba7608c9b3eb73d67a333dd7bbd8f75f155bdf27c8c8d08e2cf8ae42b29e5542ef2915669a37637fca6bf9178eae541123a42d63f774a0b66372

    • memory/2724-0-0x0000000001DA0000-0x0000000001DA1000-memory.dmp

      Filesize

      4KB

    • memory/5488-30-0x0000000000400000-0x000000000042B000-memory.dmp

      Filesize

      172KB

    • memory/5488-11-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

      Filesize

      4KB

    • memory/5488-5-0x0000000000400000-0x000000000042B000-memory.dmp

      Filesize

      172KB

    • memory/5488-3-0x0000000000400000-0x000000000042B000-memory.dmp

      Filesize

      172KB

    • memory/5488-1-0x0000000000400000-0x000000000042B000-memory.dmp

      Filesize

      172KB

    • memory/5488-13-0x0000000000400000-0x000000000042B000-memory.dmp

      Filesize

      172KB

    • memory/5488-16-0x0000000000400000-0x000000000042B000-memory.dmp

      Filesize

      172KB

    • memory/5488-15-0x0000000000400000-0x000000000042B000-memory.dmp

      Filesize

      172KB

    • memory/5488-27-0x00000000002B0000-0x00000000002B1000-memory.dmp

      Filesize

      4KB

    • memory/5488-7-0x0000000000400000-0x000000000042B000-memory.dmp

      Filesize

      172KB

    • memory/5488-9-0x0000000000400000-0x000000000042B000-memory.dmp

      Filesize

      172KB

    • memory/5568-22-0x0000000000120000-0x000000000014B000-memory.dmp

      Filesize

      172KB

    • memory/5568-21-0x0000000000120000-0x000000000014B000-memory.dmp

      Filesize

      172KB

    • memory/5568-20-0x0000000000120000-0x000000000014B000-memory.dmp

      Filesize

      172KB

    • memory/5568-25-0x0000000000120000-0x000000000014B000-memory.dmp

      Filesize

      172KB

    • memory/5568-19-0x00000000000D0000-0x0000000000118000-memory.dmp

      Filesize

      288KB

    • memory/5568-24-0x0000000000120000-0x000000000014B000-memory.dmp

      Filesize

      172KB

    • memory/5568-23-0x0000000000120000-0x000000000014B000-memory.dmp

      Filesize

      172KB

    • memory/5568-37-0x0000000000120000-0x000000000014B000-memory.dmp

      Filesize

      172KB

    • memory/5652-36-0x0000000000020000-0x0000000000021000-memory.dmp

      Filesize

      4KB