Analysis
- max time kernel
300s - max time network
289s - platform
windows10-1703_x64 - resource
win10-20240404-en - resource tags
- submitted
15/07/2024, 05:06
General
- Target ae291e6482b4c6353490df035e179163b92b22bb22e0ae5cd6e83d99e47c071f.exe
- Size 4.8MB
- Sample240715-frwshascld
- SHA256 ae291e6482b4c6353490df035e179163b92b22bb22e0ae5cd6e83d99e47c071f
Malware Config
Signatures
- LoaderBot
LoaderBot is a loader written in .NET downloading and executing miners.
- xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
- LoaderBot executable 2 IoCs
- XMRig Miner payload 30 IoCs
- Drops startup file 1 IoCs
- Executes dropped EXE 3 IoCs
- Adds Run key to start application 2 TTPs 1 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious use of AdjustPrivilegeToken 3 IoCs
- Suspicious use of WriteProcessMemory 9 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\ae291e6482b4c6353490df035e179163b92b22bb22e0ae5cd6e83d99e47c071f.exe"C:\Users\Admin\AppData\Local\Temp\ae291e6482b4c6353490df035e179163b92b22bb22e0ae5cd6e83d99e47c071f.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\RarSFX0\1.bat" "2⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\RarSFX0\clamer.execlamer.exe -priverdD3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\RarSFX1\poldawr.exe"C:\Users\Admin\AppData\Local\Temp\RarSFX1\poldawr.exe"4⤵
- Drops startup file
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe"C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe" -o pool.hashvault.pro:3333 -u 8AjRQPGQfFaMQL4ZNtmz6fSqpNdYZhUVsJxcZC7uiYmi1L5vQpeQr4nGu433wELAERYfH6BsSVBgKSnZcCdKHeYr4Cpj4ja -p x -k -v=0 --donate-level=1 -t 45⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
1.bat
clamer.exe
poldawr.exe
Driver.exe
memory/2220-40-0x0000000140000000-0x0000000140B75000-memory.dmp
memory/2220-43-0x0000000140000000-0x0000000140B75000-memory.dmp
memory/2220-27-0x0000000140000000-0x0000000140B75000-memory.dmp
memory/2220-29-0x00000000001D0000-0x00000000001E4000-memory.dmp
memory/2220-30-0x0000000140000000-0x0000000140B75000-memory.dmp
memory/2220-31-0x0000000140000000-0x0000000140B75000-memory.dmp
memory/2220-32-0x0000000140000000-0x0000000140B75000-memory.dmp
memory/2220-33-0x0000000140000000-0x0000000140B75000-memory.dmp
memory/2220-34-0x0000000140000000-0x0000000140B75000-memory.dmp
memory/2220-35-0x0000000140000000-0x0000000140B75000-memory.dmp
memory/2220-36-0x0000000140000000-0x0000000140B75000-memory.dmp
memory/2220-37-0x0000000140000000-0x0000000140B75000-memory.dmp
memory/2220-38-0x0000000140000000-0x0000000140B75000-memory.dmp
memory/2220-39-0x0000000140000000-0x0000000140B75000-memory.dmp
memory/2220-59-0x0000000140000000-0x0000000140B75000-memory.dmp
memory/2220-41-0x0000000140000000-0x0000000140B75000-memory.dmp
memory/2220-42-0x0000000140000000-0x0000000140B75000-memory.dmp
memory/2220-58-0x0000000140000000-0x0000000140B75000-memory.dmp
memory/2220-44-0x0000000140000000-0x0000000140B75000-memory.dmp
memory/2220-45-0x0000000140000000-0x0000000140B75000-memory.dmp
memory/2220-46-0x0000000140000000-0x0000000140B75000-memory.dmp
memory/2220-47-0x0000000140000000-0x0000000140B75000-memory.dmp
memory/2220-48-0x0000000140000000-0x0000000140B75000-memory.dmp
memory/2220-49-0x0000000140000000-0x0000000140B75000-memory.dmp
memory/2220-50-0x0000000140000000-0x0000000140B75000-memory.dmp
memory/2220-51-0x0000000140000000-0x0000000140B75000-memory.dmp
memory/2220-52-0x0000000140000000-0x0000000140B75000-memory.dmp
memory/2220-53-0x0000000140000000-0x0000000140B75000-memory.dmp
memory/2220-54-0x0000000140000000-0x0000000140B75000-memory.dmp
memory/2220-55-0x0000000140000000-0x0000000140B75000-memory.dmp
memory/2220-56-0x0000000140000000-0x0000000140B75000-memory.dmp
memory/2220-57-0x0000000140000000-0x0000000140B75000-memory.dmp
memory/5060-23-0x0000000005000000-0x0000000005066000-memory.dmp
memory/5060-20-0x00000000000C0000-0x00000000004BE000-memory.dmp