Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
120s -
max time network
121s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
-
submitted
29/09/2024, 20:33
General
-
Target
f865b73f0c241f1e06baf7adf8b09469298c2db060c0fd89b884d05fd3c3ef1aN.exe
-
Size
2.6MB
-
MD5
2bd5bf1b3068159238df935056b1c280
-
SHA1
6771dc9f94efba881939e829b1d1b979498fc3b8
-
SHA256
f865b73f0c241f1e06baf7adf8b09469298c2db060c0fd89b884d05fd3c3ef1a
-
SHA512
572f76d1933e69d7187508b23f9fcdc07e8514ff94dee15463ead28a0fdcffe1f97e7f84eb0283abd874d8b96f6bcd0bf321406fe5fac237b5b82df0f0fcaecb
-
SSDEEP
49152:zF6hQEdu02QJxqJ6x7XjpSceD8D13F2Du8+rpRZLY6Qk9mP/U1Hf/sdyGdmIFTNN:zF8tdu09qJEXMceDSVE9+1RZLYG0P/Um
Malware Config
Signatures
-
LoaderBot
LoaderBot is a loader written in .NET downloading and executing miners.
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
LoaderBot executable 2 IoCs
-
XMRig Miner payload 13 IoCs
-
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
-
Drops startup file 1 IoCs
-
Executes dropped EXE 4 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs
Adversaries may check for Internet connectivity on compromised systems.
-
Runs ping.exe 1 TTPs 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of AdjustPrivilegeToken 5 IoCs
-
Suspicious use of WriteProcessMemory 15 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\f865b73f0c241f1e06baf7adf8b09469298c2db060c0fd89b884d05fd3c3ef1aN.exe"C:\Users\Admin\AppData\Local\Temp\f865b73f0c241f1e06baf7adf8b09469298c2db060c0fd89b884d05fd3c3ef1aN.exe"1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\system.exe"C:\Users\Admin\AppData\Local\Temp\system.exe"2⤵
- Checks computer location settings
- Drops startup file
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe"C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe" -o pool.supportxmr.com:3333 -u 84pG1E7UKYvgbggJxjsMMQMKXFPdLCWknN17Fd2todfvLfRAC7psryqVBihgQfGHEidGgoh4G24xn8WeabSAzPYjS3h8zGH -p x -k -v=0 --donate-level=1 -t 43⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe"C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe" -o pool.supportxmr.com:3333 -u 84pG1E7UKYvgbggJxjsMMQMKXFPdLCWknN17Fd2todfvLfRAC7psryqVBihgQfGHEidGgoh4G24xn8WeabSAzPYjS3h8zGH -p x -k -v=0 --donate-level=1 -t 43⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Users\Admin\AppData\Local\Temp\Enotria.exe"C:\Users\Admin\AppData\Local\Temp\Enotria.exe"2⤵
- Executes dropped EXE
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c ping -n 3 127.0.0.1 & copy /Y "C:\Users\Admin\AppData\Local\Temp\Enotria.exe" "C:\Users\Admin\AppData\Local\Temp\f865b73f0c241f1e06baf7adf8b09469298c2db060c0fd89b884d05fd3c3ef1aN.exe" >> NUL2⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\PING.EXEping -n 3 127.0.0.13⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=1996,i,5469445176230119590,7931734017267321834,262144 --variations-seed-version --mojo-platform-channel-handle=1440 /prefetch:81⤵
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
285KB
MD50ce6fc9ca6df1b0401a23f42899b53d3
SHA1826b92e448901cdaf22726e1c2418e3be2d5362f
SHA25696dc1dc2f4210537bf1d8d7fbaca30342db6b9dc3c2cf23bdd71fe436e8e6f51
SHA51247fadc3d69b789ff25baa47ca34d7f675bacb05182a82600b407cb5ae146fbab7d901e2162915a29aec770f742ce382956e6f4defda9036327bbac97915798b2
-
Filesize
4.0MB
MD5c582001fd00152425fd1a4b9b0d7cf07
SHA1f747b7074505e37b589b72e652778c59077c1151
SHA256e9fca3db7f9c56f58cc1e28118c9897aa3cd0d2e052c62b3aed472bede51e467
SHA51272e6993227acc1b5f4841bfe04030ec70d061ce3ac1512b93e05f9900445253f0ca71917469616210881c61f711aaae1f58eedbef8903e1627fc720f8283bcce
-
Filesize
3.9MB
MD502569a7a91a71133d4a1023bf32aa6f4
SHA10f16bcb3f3f085d3d3be912195558e9f9680d574
SHA2568d6abba9b216172cfc64b8802db0d20a1c634c96e1049f451eddba2363966bf0
SHA512534be1fe93ee556a14cfd8fad5377f57fb056ab4cd2bca14e4f376f4a25d3d4d270917d68a90b3c40d8a8daaeba6f592fa095ecff478332ba23405d1df728322
-
Filesize
11.5MB
-
Filesize
80KB
-
Filesize
11.5MB
-
Filesize
4KB
-
Filesize
4.0MB
-
Filesize
408KB
-
Filesize
7.7MB
-
Filesize
4KB
-
Filesize
7.7MB
-
Filesize
11.5MB
-
Filesize
11.5MB
-
Filesize
11.5MB
-
Filesize
11.5MB
-
Filesize
11.5MB
-
Filesize
11.5MB
-
Filesize
11.5MB
-
Filesize
11.5MB
-
Filesize
11.5MB
-
Filesize
11.5MB
-
Filesize
11.5MB
-
Filesize
11.5MB