Analysis
- max time kernel
299s - max time network
303s - platform
windows10-1703_x64 - resource
win10-20240404-en - resource tags
- submitted
18/07/2024, 22:40
General
- Target cada3e288c060cfdbf02ba7862856e75ae80da25628847ab61ca88742b4e56b9.exe
- Size 4.2MB
- Sample240718-2ln2cstbnd
- SHA256 cada3e288c060cfdbf02ba7862856e75ae80da25628847ab61ca88742b4e56b9
Malware Config
Extracted
-
loaderbot
-
https://ct45361.tw1.ru/cmd.php
Signatures
- LoaderBot
LoaderBot is a loader written in .NET downloading and executing miners.
- xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
- LoaderBot executable 2 IoCs
- XMRig Miner payload 30 IoCs
- Drops startup file 1 IoCs
- Executes dropped EXE 11 IoCs
- Loads dropped DLL 6 IoCs
- Adds Run key to start application 2 TTPs 1 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious use of AdjustPrivilegeToken 31 IoCs
- Suspicious use of WriteProcessMemory 29 IoCs
- Views/modifies file attributes 1 TTPs 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\cada3e288c060cfdbf02ba7862856e75ae80da25628847ab61ca88742b4e56b9.exe"C:\Users\Admin\AppData\Local\Temp\cada3e288c060cfdbf02ba7862856e75ae80da25628847ab61ca88742b4e56b9.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\main\main.bat" /S"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\mode.commode 65,103⤵
-
-
C:\Users\Admin\AppData\Local\Temp\main\7z.exe7z.exe e file.zip -p177329647297291883199214736 -oextracted3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\main\7z.exe7z.exe e extracted/file_5.zip -oextracted3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\main\7z.exe7z.exe e extracted/file_4.zip -oextracted3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\main\7z.exe7z.exe e extracted/file_3.zip -oextracted3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\main\7z.exe7z.exe e extracted/file_2.zip -oextracted3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\main\7z.exe7z.exe e extracted/file_1.zip -oextracted3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\attrib.exeattrib +H "Installer.exe"3⤵
- Views/modifies file attributes
-
-
C:\Users\Admin\AppData\Local\Temp\main\Installer.exe"Installer.exe"3⤵
- Drops startup file
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe"C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe" -o pool.hashvault.pro:3333 -u 8AjRQPGQfFaMQL4ZNtmz6fSqpNdYZhUVsJxcZC7uiYmi1L5vQpeQr4nGu433wELAERYfH6BsSVBgKSnZcCdKHeYr4Cpj4ja -p x -k -v=0 --donate-level=1 -t 44⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe"C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe" -o pool.hashvault.pro:3333 -u 8AjRQPGQfFaMQL4ZNtmz6fSqpNdYZhUVsJxcZC7uiYmi1L5vQpeQr4nGu433wELAERYfH6BsSVBgKSnZcCdKHeYr4Cpj4ja -p x -k -v=0 --donate-level=1 -t 44⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe"C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe" -o pool.hashvault.pro:3333 -u 8AjRQPGQfFaMQL4ZNtmz6fSqpNdYZhUVsJxcZC7uiYmi1L5vQpeQr4nGu433wELAERYfH6BsSVBgKSnZcCdKHeYr4Cpj4ja -p x -k -v=0 --donate-level=1 -t 44⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe"C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe" -o pool.hashvault.pro:3333 -u 8AjRQPGQfFaMQL4ZNtmz6fSqpNdYZhUVsJxcZC7uiYmi1L5vQpeQr4nGu433wELAERYfH6BsSVBgKSnZcCdKHeYr4Cpj4ja -p x -k -v=0 --donate-level=1 -t 44⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
7z.dll
7z.exe
ANTIAV~1.DAT
Installer.exe
file_1.zip
file_2.zip
file_3.zip
file_4.zip
file_5.zip
file.bin
main.bat
Driver.exe
memory/2440-88-0x0000000140000000-0x0000000140B75000-memory.dmp
memory/2440-84-0x0000000140000000-0x0000000140B75000-memory.dmp
memory/2440-100-0x0000000140000000-0x0000000140B75000-memory.dmp
memory/2440-99-0x0000000140000000-0x0000000140B75000-memory.dmp
memory/2440-98-0x0000000140000000-0x0000000140B75000-memory.dmp
memory/2440-97-0x0000000140000000-0x0000000140B75000-memory.dmp
memory/2440-96-0x0000000140000000-0x0000000140B75000-memory.dmp
memory/2440-95-0x0000000140000000-0x0000000140B75000-memory.dmp
memory/2440-94-0x0000000140000000-0x0000000140B75000-memory.dmp
memory/2440-76-0x0000000140000000-0x0000000140B75000-memory.dmp
memory/2440-77-0x0000000140000000-0x0000000140B75000-memory.dmp
memory/2440-78-0x0000000140000000-0x0000000140B75000-memory.dmp
memory/2440-79-0x0000000140000000-0x0000000140B75000-memory.dmp
memory/2440-80-0x0000000140000000-0x0000000140B75000-memory.dmp
memory/2440-81-0x0000000140000000-0x0000000140B75000-memory.dmp
memory/2440-82-0x0000000140000000-0x0000000140B75000-memory.dmp
memory/2440-83-0x0000000140000000-0x0000000140B75000-memory.dmp
memory/2440-93-0x0000000140000000-0x0000000140B75000-memory.dmp
memory/2440-85-0x0000000140000000-0x0000000140B75000-memory.dmp
memory/2440-86-0x0000000140000000-0x0000000140B75000-memory.dmp
memory/2440-87-0x0000000140000000-0x0000000140B75000-memory.dmp
memory/2440-92-0x0000000140000000-0x0000000140B75000-memory.dmp
memory/2440-89-0x0000000140000000-0x0000000140B75000-memory.dmp
memory/2440-90-0x0000000140000000-0x0000000140B75000-memory.dmp
memory/2440-91-0x0000000140000000-0x0000000140B75000-memory.dmp
memory/2952-66-0x0000000140000000-0x0000000140B75000-memory.dmp
memory/2952-65-0x0000000140000000-0x0000000140B75000-memory.dmp
memory/2952-63-0x00000000001D0000-0x00000000001E4000-memory.dmp
memory/2952-64-0x0000000140000000-0x0000000140B75000-memory.dmp
memory/3040-73-0x0000000140000000-0x0000000140B75000-memory.dmp
memory/3264-55-0x0000000000180000-0x000000000057E000-memory.dmp
memory/3264-58-0x00000000050A0000-0x0000000005106000-memory.dmp
memory/4912-70-0x0000000140000000-0x0000000140B75000-memory.dmp
memory/4912-69-0x0000000140000000-0x0000000140B75000-memory.dmp