Analysis
- max time kernel
149s - max time network
143s - platform
windows10-2004_x64 - resource
win10v2004-20240611-en - resource tags
- submitted
13/06/2024, 01:05
General
- Target a34ab98a46710de5f631103149c046ab_JaffaCakes118.exe
- Size 176KB
- Sample240613-bfst9asbql
- SHA256 cc2116a99fd714ca55a707bdb636f16e946d75699356bcd5ffad859ad852bac9
Malware Config
Extracted
-
mylobot
-
fywkuzp.ru:7432
-
zdrussle.ru:2173
-
pseyumd.ru:5492
-
stydodo.ru:2619
-
tqzknrx.com:1123
-
mdcqrxw.com:4984
-
tpwtgyw.com:9631
-
cnoyucn.com:9426
-
qhloury.com:4759
-
fnjxpwy.com:3863
-
csxpzlz.com:5778
-
wlkjopy.com:8778
-
mynfwwk.com:8427
-
uuitwxg.com:6656
-
agnxomu.com:8881
-
wcagsib.com:3547
-
fmniltb.com:9582
-
oapwxiu.com:3922
-
petrrry.com:7531
-
poubauo.com:4623
Signatures
- Mylobot
Botnet which first appeared in 2017 written in C++.
- Executes dropped EXE 2 IoCs
- Adds Run key to start application 2 TTPs 1 IoCs
- Suspicious use of SetThreadContext 2 IoCs
- Suspicious use of WriteProcessMemory 37 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\a34ab98a46710de5f631103149c046ab_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\a34ab98a46710de5f631103149c046ab_JaffaCakes118.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\a34ab98a46710de5f631103149c046ab_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\a34ab98a46710de5f631103149c046ab_JaffaCakes118.exe"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\grvervhc\vdrvwtvd.exe"C:\Users\Admin\AppData\Roaming\grvervhc\vdrvwtvd.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\grvervhc\vdrvwtvd.exe"C:\Users\Admin\AppData\Roaming\grvervhc\vdrvwtvd.exe"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe"5⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\notepad.exe"C:\Windows\system32\notepad.exe"6⤵
-
-
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
vdrvwtvd.exe
memory/636-1-0x0000000000400000-0x000000000041C000-memory.dmp
memory/636-3-0x0000000000400000-0x000000000041C000-memory.dmp
memory/636-4-0x0000000000400000-0x000000000041C000-memory.dmp
memory/636-7-0x0000000000400000-0x000000000041C000-memory.dmp
memory/1916-38-0x0000000000400000-0x000000000042F000-memory.dmp
memory/1916-13-0x0000000000400000-0x000000000042F000-memory.dmp
memory/3736-27-0x0000000000100000-0x0000000000101000-memory.dmp
memory/3736-53-0x0000000000870000-0x0000000000886000-memory.dmp
memory/3736-23-0x0000000000660000-0x0000000000661000-memory.dmp
memory/3736-20-0x00000000007B0000-0x00000000007C5000-memory.dmp
memory/3736-21-0x00000000007B0000-0x00000000007C5000-memory.dmp
memory/3736-18-0x0000000000100000-0x0000000000101000-memory.dmp
memory/3736-28-0x0000000000870000-0x0000000000886000-memory.dmp
memory/3736-31-0x0000000000870000-0x0000000000886000-memory.dmp
memory/3736-19-0x0000000000100000-0x0000000000101000-memory.dmp
memory/3736-36-0x0000000000870000-0x0000000000886000-memory.dmp
memory/3736-34-0x0000000000870000-0x0000000000886000-memory.dmp
memory/3736-39-0x0000000000870000-0x0000000000886000-memory.dmp
memory/3736-33-0x0000000000870000-0x0000000000886000-memory.dmp
memory/4192-0-0x0000000000590000-0x0000000000591000-memory.dmp
memory/4996-50-0x0000000000CC0000-0x0000000000CC1000-memory.dmp
memory/4996-51-0x0000000000400000-0x0000000000416000-memory.dmp
memory/4996-52-0x0000000000400000-0x0000000000416000-memory.dmp
memory/4996-46-0x00000000044A0000-0x00000000044A1000-memory.dmp