loaderbot | f865b73f0c241f1e06baf7adf8b09469298c2db060c0fd89b884d05fd3c3ef1a | Triage

Submit
Reports

Overview

overview

Static

static

3

f865b73f0c...aN.exe

windows7-x64

f865b73f0c...aN.exe

windows10-2004-x64

Sharing

General

Target

f865b73f0c241f1e06baf7adf8b09469298c2db060c0fd89b884d05fd3c3ef1aN
Size

2.6MB
Sample

240929-zb71dayhmn
MD5

2bd5bf1b3068159238df935056b1c280
SHA1

6771dc9f94efba881939e829b1d1b979498fc3b8
SHA256

f865b73f0c241f1e06baf7adf8b09469298c2db060c0fd89b884d05fd3c3ef1a
SHA512

572f76d1933e69d7187508b23f9fcdc07e8514ff94dee15463ead28a0fdcffe1f97e7f84eb0283abd874d8b96f6bcd0bf321406fe5fac237b5b82df0f0fcaecb
SSDEEP

49152:zF6hQEdu02QJxqJ6x7XjpSceD8D13F2Du8+rpRZLY6Qk9mP/U1Hf/sdyGdmIFTNN:zF8tdu09qJEXMceDSVE9+1RZLYG0P/Um

Score

10^/10

loaderbot xmrig discovery loader miner persistence

Static task

static1

1 signatures

Behavioral task

behavioral1

Sample

f865b73f0c241f1e06baf7adf8b09469298c2db060c0fd89b884d05fd3c3ef1aN.exe

Resource

win7-20240708-en

loaderbot discovery loader miner persistence

windows7-x64

14 signatures

120 seconds

Behavioral task

behavioral2

Sample

f865b73f0c241f1e06baf7adf8b09469298c2db060c0fd89b884d05fd3c3ef1aN.exe

Resource

win10v2004-20240802-en

loaderbot xmrig discovery loader miner persistence

windows10-2004-x64

15 signatures

120 seconds

Malware Config

Targets

- Target
  
  f865b73f0c241f1e06baf7adf8b09469298c2db060c0fd89b884d05fd3c3ef1aN
- Size
  
  2.6MB
- MD5
  
  2bd5bf1b3068159238df935056b1c280
- SHA1
  
  6771dc9f94efba881939e829b1d1b979498fc3b8
- SHA256
  
  f865b73f0c241f1e06baf7adf8b09469298c2db060c0fd89b884d05fd3c3ef1a
- SHA512
  
  572f76d1933e69d7187508b23f9fcdc07e8514ff94dee15463ead28a0fdcffe1f97e7f84eb0283abd874d8b96f6bcd0bf321406fe5fac237b5b82df0f0fcaecb
- SSDEEP
  
  49152:zF6hQEdu02QJxqJ6x7XjpSceD8D13F2Du8+rpRZLY6Qk9mP/U1Hf/sdyGdmIFTNN:zF8tdu09qJEXMceDSVE9+1RZLYG0P/Um
Score

10^/10

loaderbot discovery loader miner persistence xmrig
- LoaderBot
  LoaderBot is a loader written in .NET downloading and executing miners.
  loader miner loaderbot
- xmrig
  XMRig is a high performance, open source, cross platform CPU/GPU miner.
  miner xmrig
- LoaderBot executable
- XMRig Miner payload
  miner
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Drops startup file
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

Credential Access

Discovery

Query Registry

Remote System Discovery

System Information Discovery

System Location Discovery

System Language Discovery

System Network Configuration Discovery

Internet Connection Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

loaderbotdiscoveryloaderminerpersistence

behavioral2

loaderbotxmrigdiscoveryloaderminerpersistence

© 2018-2024

Terms | Privacy