mylobot | 0104ce2fc223011c9ecd635665939018c1e74edcc8a503d7983ec1cafafbbc65

General

Target

0104ce2fc223011c9ecd635665939018c1e74edcc8a503d7983ec1cafafbbc65.exe
Size

369KB
MD5

de50b55b849ac32363ef3f39d450dd6e
SHA1

8f1e8ab32ad0ff404519ffd9431af8f22a027050
SHA256

0104ce2fc223011c9ecd635665939018c1e74edcc8a503d7983ec1cafafbbc65
SHA512

df317637424bd6a07f080d8a496ea567bebf6348d805f2846bc25326a1ae83a80c57f39dcf82d289498fdcc858b6bcfb2c838417fb7252032099dd98f3097be0
SSDEEP

6144:kn9+9wPbNTK0Q/fvzKZ62jY/776KOWu/GduR9swnApRTvgJAbUYL7j:k9RTG/fvyLj472KOv/GduzsJpRvbT

Score

10^/10

mylobot botnet persistence

Malware Config

Extracted

Family

mylobot

C2

eakalra.ru:1281

op17.ru:6006

ad21822.ru:8742

urtuifc.ru:1692

nmernrh.ru:4163

bjbhtsc.ru:6239

jmbfgpn.ru:1344

hoebfle.ru:9593

okllxlr.ru:8335

klqzrze.ru:6999

xwstyrt.ru:8627

qgfhmmm.ru:1886

ygdgryq.ru:5843

unsyisl.ru:7365

snzglco.ru:3268

fchbwme.ru:7533

iqaagar.ru:2919

flkpuod.ru:5796

zuenhrs.ru:9439

lqejyjg.ru:4627

Signatures

Mylobot
Botnet which first appeared in 2017 written in C++.
botnet mylobot

Deletes itself 1 IoCs

pid	Process
4196	svchost.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\{3FE53168-BCF9-1E69-FE2E-ADA80D6363D3} = "c:\\programdata\\{A3F51958-94C9-8279-FE2E-ADA80D6363D3}\\0e4ac9c7.exe"	svchost.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2324 set thread context of 4544	2324	0104ce2fc223011c9ecd635665939018c1e74edcc8a503d7983ec1cafafbbc65.exe	81

Checks SCSI registry key(s) 3 TTPs 2 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName	0104ce2fc223011c9ecd635665939018c1e74edcc8a503d7983ec1cafafbbc65.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000	0104ce2fc223011c9ecd635665939018c1e74edcc8a503d7983ec1cafafbbc65.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000_Classes\CLSID\{F9D03EA5-B334-D85C-FE2E-ADA80D6363D3}	svchost.exe
Key created	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000_Classes\CLSID\{A3F5195B-94CA-8279-FE2E-ADA80D6363D3}	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000_Classes\CLSID\{A3F5195B-94CA-8279-FE2E-ADA80D6363D3}\ = "1719358413"	svchost.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
4544	0104ce2fc223011c9ecd635665939018c1e74edcc8a503d7983ec1cafafbbc65.exe
4544	0104ce2fc223011c9ecd635665939018c1e74edcc8a503d7983ec1cafafbbc65.exe
4544	0104ce2fc223011c9ecd635665939018c1e74edcc8a503d7983ec1cafafbbc65.exe
4544	0104ce2fc223011c9ecd635665939018c1e74edcc8a503d7983ec1cafafbbc65.exe
4196	svchost.exe
4196	svchost.exe
4196	svchost.exe
4196	svchost.exe

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
4544	0104ce2fc223011c9ecd635665939018c1e74edcc8a503d7983ec1cafafbbc65.exe

Suspicious use of WriteProcessMemory 20 IoCs

description	pid	Process	procid_target
PID 2324 wrote to memory of 4544	2324	0104ce2fc223011c9ecd635665939018c1e74edcc8a503d7983ec1cafafbbc65.exe	81
PID 2324 wrote to memory of 4544	2324	0104ce2fc223011c9ecd635665939018c1e74edcc8a503d7983ec1cafafbbc65.exe	81
PID 2324 wrote to memory of 4544	2324	0104ce2fc223011c9ecd635665939018c1e74edcc8a503d7983ec1cafafbbc65.exe	81
PID 2324 wrote to memory of 4544	2324	0104ce2fc223011c9ecd635665939018c1e74edcc8a503d7983ec1cafafbbc65.exe	81
PID 2324 wrote to memory of 4544	2324	0104ce2fc223011c9ecd635665939018c1e74edcc8a503d7983ec1cafafbbc65.exe	81
PID 2324 wrote to memory of 4544	2324	0104ce2fc223011c9ecd635665939018c1e74edcc8a503d7983ec1cafafbbc65.exe	81
PID 2324 wrote to memory of 4544	2324	0104ce2fc223011c9ecd635665939018c1e74edcc8a503d7983ec1cafafbbc65.exe	81
PID 2324 wrote to memory of 4544	2324	0104ce2fc223011c9ecd635665939018c1e74edcc8a503d7983ec1cafafbbc65.exe	81
PID 2324 wrote to memory of 4544	2324	0104ce2fc223011c9ecd635665939018c1e74edcc8a503d7983ec1cafafbbc65.exe	81
PID 4544 wrote to memory of 4196	4544	0104ce2fc223011c9ecd635665939018c1e74edcc8a503d7983ec1cafafbbc65.exe	82
PID 4544 wrote to memory of 4196	4544	0104ce2fc223011c9ecd635665939018c1e74edcc8a503d7983ec1cafafbbc65.exe	82
PID 4544 wrote to memory of 4196	4544	0104ce2fc223011c9ecd635665939018c1e74edcc8a503d7983ec1cafafbbc65.exe	82
PID 4544 wrote to memory of 4196	4544	0104ce2fc223011c9ecd635665939018c1e74edcc8a503d7983ec1cafafbbc65.exe	82
PID 4196 wrote to memory of 2324	4196	svchost.exe	80
PID 4196 wrote to memory of 2324	4196	svchost.exe	80
PID 4196 wrote to memory of 4308	4196	svchost.exe	83
PID 4196 wrote to memory of 4308	4196	svchost.exe	83
PID 4196 wrote to memory of 4308	4196	svchost.exe	83
PID 4196 wrote to memory of 4308	4196	svchost.exe	83
PID 4196 wrote to memory of 4308	4196	svchost.exe	83

C:\Users\Admin\AppData\Local\Temp\0104ce2fc223011c9ecd635665939018c1e74edcc8a503d7983ec1cafafbbc65.exe
"C:\Users\Admin\AppData\Local\Temp\0104ce2fc223011c9ecd635665939018c1e74edcc8a503d7983ec1cafafbbc65.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2324
- C:\Users\Admin\AppData\Local\Temp\0104ce2fc223011c9ecd635665939018c1e74edcc8a503d7983ec1cafafbbc65.exe
  "C:\Users\Admin\AppData\Local\Temp\0104ce2fc223011c9ecd635665939018c1e74edcc8a503d7983ec1cafafbbc65.exe"
  2⤵
  - Checks SCSI registry key(s)
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of WriteProcessMemory
  PID:4544
- - C:\Windows\SysWOW64\svchost.exe
    "C:\Windows\system32\svchost.exe"
    3⤵
    - Deletes itself
    - Adds Run key to start application
    - Modifies registry class
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:4196
  - - C:\Windows\SysWOW64\notepad.exe
      "C:\Windows\system32\notepad.exe"
      4⤵
      PID:4308

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\{A3F51958-94C9-8279-FE2E-ADA80D6363D3}\0e4ac9c7.exe

Filesize
369KB

MD5
de50b55b849ac32363ef3f39d450dd6e

SHA1
8f1e8ab32ad0ff404519ffd9431af8f22a027050

SHA256
0104ce2fc223011c9ecd635665939018c1e74edcc8a503d7983ec1cafafbbc65

SHA512
df317637424bd6a07f080d8a496ea567bebf6348d805f2846bc25326a1ae83a80c57f39dcf82d289498fdcc858b6bcfb2c838417fb7252032099dd98f3097be0

Download Submit
memory/2324-0-0x00000000001E0000-0x00000000001E1000-memory.dmp

Filesize
4KB

Download
memory/2324-12-0x00000000001F0000-0x00000000001F1000-memory.dmp

Filesize
4KB

Download
memory/4196-9-0x0000000000ED0000-0x0000000000F05000-memory.dmp

Filesize
212KB

Download
memory/4196-7-0x0000000000ED0000-0x0000000000F05000-memory.dmp

Filesize
212KB

Download
memory/4196-13-0x0000000000ED0000-0x0000000000F05000-memory.dmp

Filesize
212KB

Download
memory/4196-5-0x0000000000ED0000-0x0000000000F05000-memory.dmp

Filesize
212KB

Download
memory/4196-8-0x0000000000ED0000-0x0000000000F05000-memory.dmp

Filesize
212KB

Download
memory/4196-10-0x0000000000ED0000-0x0000000000F05000-memory.dmp

Filesize
212KB

Download
memory/4196-17-0x0000000000ED0000-0x0000000000F05000-memory.dmp

Filesize
212KB

Download
memory/4308-16-0x0000000000AD0000-0x0000000000AD1000-memory.dmp

Filesize
4KB

Download
memory/4544-3-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/4544-11-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/4544-4-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/4544-2-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/4544-1-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads