Analysis
- max time kernel
149s - max time network
156s - platform
windows10-2004_x64 - resource
win10v2004-20241007-en - resource tags
- submitted
24/10/2024, 23:28
General
- Target e3801874cc5d57f0f249ba6499d6c870e2a1ed6f695ada3389cbf19ed2c85d6e.exe
- Size 2.9MB
- Sample241024-3gc9qsxerc
- SHA256 e3801874cc5d57f0f249ba6499d6c870e2a1ed6f695ada3389cbf19ed2c85d6e
Malware Config
Extracted
-
loaderbot
-
http://reebokfm.beget.tech/cmd.php
Signatures
- LoaderBot
LoaderBot is a loader written in .NET downloading and executing miners.
- xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
- LoaderBot executable 1 IoCs
- XMRig Miner payload 18 IoCs
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
- Drops startup file 1 IoCs
- Executes dropped EXE 4 IoCs
- Adds Run key to start application 2 TTPs 1 IoCs
- Suspicious use of NtSetInformationThreadHideFromDebugger 16 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: RenamesItself 1 IoCs
- Suspicious use of AdjustPrivilegeToken 7 IoCs
- Suspicious use of SetWindowsHookEx 1 IoCs
- Suspicious use of WriteProcessMemory 8 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\e3801874cc5d57f0f249ba6499d6c870e2a1ed6f695ada3389cbf19ed2c85d6e.exe"C:\Users\Admin\AppData\Local\Temp\e3801874cc5d57f0f249ba6499d6c870e2a1ed6f695ada3389cbf19ed2c85d6e.exe"1⤵
- Checks computer location settings
- Drops startup file
- Adds Run key to start application
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe"C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe" -o pool.supportxmr.com:3333 -u 47vHWCbAN63PGUDefhL7tV5TeAqZxYjs7E2UexaZWyRCG63u9D5oHThTjEexj5HjNXP2TWAMCkAMiST5kAkYKTP7EJmsebD -p x -k -v=0 --donate-level=0 -t 42⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe"C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe" -o pool.supportxmr.com:3333 -u 47vHWCbAN63PGUDefhL7tV5TeAqZxYjs7E2UexaZWyRCG63u9D5oHThTjEexj5HjNXP2TWAMCkAMiST5kAkYKTP7EJmsebD -p x -k -v=0 --donate-level=0 -t 42⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe"C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe" -o pool.supportxmr.com:3333 -u 47vHWCbAN63PGUDefhL7tV5TeAqZxYjs7E2UexaZWyRCG63u9D5oHThTjEexj5HjNXP2TWAMCkAMiST5kAkYKTP7EJmsebD -p x -k -v=0 --donate-level=0 -t 42⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe"C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe" -o pool.supportxmr.com:3333 -u 47vHWCbAN63PGUDefhL7tV5TeAqZxYjs7E2UexaZWyRCG63u9D5oHThTjEexj5HjNXP2TWAMCkAMiST5kAkYKTP7EJmsebD -p x -k -v=0 --donate-level=0 -t 42⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
Driver.exe
memory/864-16-0x0000000140000000-0x0000000140B75000-memory.dmp
memory/864-18-0x0000000000400000-0x0000000000414000-memory.dmp
memory/864-19-0x0000000140000000-0x0000000140B75000-memory.dmp
memory/1972-28-0x0000000073EE0000-0x0000000074690000-memory.dmp
memory/1972-1-0x0000000073EEE000-0x0000000073EEF000-memory.dmp
memory/1972-2-0x0000000000660000-0x0000000000DC4000-memory.dmp
memory/1972-5-0x0000000006050000-0x00000000060B6000-memory.dmp
memory/1972-6-0x0000000073EE0000-0x0000000074690000-memory.dmp
memory/1972-0-0x0000000000660000-0x0000000000DC4000-memory.dmp
memory/1972-25-0x0000000000660000-0x0000000000DC4000-memory.dmp
memory/1972-26-0x0000000073EEE000-0x0000000073EEF000-memory.dmp
memory/2872-29-0x0000000140000000-0x0000000140B75000-memory.dmp
memory/2872-30-0x0000000140000000-0x0000000140B75000-memory.dmp
memory/2872-32-0x0000000140000000-0x0000000140B75000-memory.dmp
memory/2872-34-0x0000000140000000-0x0000000140B75000-memory.dmp
memory/3472-22-0x0000000140000000-0x0000000140B75000-memory.dmp
memory/3628-45-0x0000000140000000-0x0000000140B75000-memory.dmp
memory/3628-38-0x0000000140000000-0x0000000140B75000-memory.dmp
memory/3628-41-0x0000000140000000-0x0000000140B75000-memory.dmp
memory/3628-43-0x0000000140000000-0x0000000140B75000-memory.dmp
memory/3628-39-0x0000000140000000-0x0000000140B75000-memory.dmp
memory/3628-47-0x0000000140000000-0x0000000140B75000-memory.dmp
memory/3628-49-0x0000000140000000-0x0000000140B75000-memory.dmp
memory/3628-51-0x0000000140000000-0x0000000140B75000-memory.dmp
memory/3628-53-0x0000000140000000-0x0000000140B75000-memory.dmp
memory/3628-55-0x0000000140000000-0x0000000140B75000-memory.dmp
memory/3628-57-0x0000000140000000-0x0000000140B75000-memory.dmp
memory/3628-59-0x0000000140000000-0x0000000140B75000-memory.dmp