Overview

overview

10

Static

static

10

JaffaCakes...a2.exe

windows7-x64

10

JaffaCakes...a2.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    150s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • submitted
    02/01/2025, 10:24 UTC

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    JaffaCakes118_646543a3d52cc28ce2defb91eb3a0fa2.exe

  • Size

    4.3MB

  • MD5

    646543a3d52cc28ce2defb91eb3a0fa2

  • SHA1

    1932da4ace59883328d589cde74f11c01c713b0a

  • SHA256

    4d13c9ed600e109cf6540800f702eb28921b75c703a68e810bfea63d1989a81d

  • SHA512

    14027b89dfa307533917ac8e4f7deb9f2b6eac021ae9ecef33781739a45779c6573d49b740bc788875b41f8ddd9c6bb883d24f71392eadaa2a91e58bf2f572ac

  • SSDEEP

    98304:NNNaf55cH3Bj1JkxjOejrq8lVwOro1bbyOFb0hjB4+81TC:NNNa4HxDe/GDhFb0lB4+

Score
10/10
loaderbotxmrigdiscoveryloaderminerpersistence

Malware Config

Extracted

Family

loaderbot

Attributes
  • miner_pool

    pool.minexmr.com:4444

  • user

    4AKcSXh6Zck7cS2dWrau2yh8pzWD3EzsCQ1xaRbminrWPYJcZtQswfn1HF3j3b4XFdKcVrDh8R9dUUvVRk6JZwwsJEuxwLs

Signatures

  • LoaderBot

    LoaderBot is a loader written in .NET downloading and executing miners.

    loaderminerloaderbot
  • Loaderbot family
    loaderbot
  • Xmrig family
    xmrig
  • xmrig

    XMRig is a high performance, open source, cross platform CPU/GPU miner.

    minerxmrig
  • LoaderBot executable 1 IoCs
  • XMRig Miner payload 15 IoCs
    miner
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: RenamesItself 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of WriteProcessMemory 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_646543a3d52cc28ce2defb91eb3a0fa2.exe
    "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_646543a3d52cc28ce2defb91eb3a0fa2.exe"
    1⤵
    • Checks computer location settings
    • Drops startup file
    • Adds Run key to start application
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: RenamesItself
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:3292
    • C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe
      "C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe" -o pool.minexmr.com:4444 -u 4AKcSXh6Zck7cS2dWrau2yh8pzWD3EzsCQ1xaRbminrWPYJcZtQswfn1HF3j3b4XFdKcVrDh8R9dUUvVRk6JZwwsJEuxwLs -p x -k -v=0 --donate-level=1 -t 4
      2⤵
      • Executes dropped EXE
      • Suspicious use of AdjustPrivilegeToken
      PID:1600

Network

  • flag-us
    DNS
    pool.minexmr.com
    Driver.exe
    Remote address:
    8.8.8.8:53
    Request
    pool.minexmr.com
    IN A
    Response
  • flag-us
    DNS
    pool.minexmr.com
    Driver.exe
    Remote address:
    8.8.8.8:53
    Request
    pool.minexmr.com
    IN A
    Response
  • flag-us
    DNS
    pool.minexmr.com
    Driver.exe
    Remote address:
    8.8.8.8:53
    Request
    pool.minexmr.com
    IN A
    Response
  • flag-us
    DNS
    pool.minexmr.com
    Driver.exe
    Remote address:
    8.8.8.8:53
    Request
    pool.minexmr.com
    IN A
    Response
  • flag-us
    DNS
    pool.minexmr.com
    Driver.exe
    Remote address:
    8.8.8.8:53
    Request
    pool.minexmr.com
    IN A
    Response
  • flag-us
    DNS
    pool.minexmr.com
    Driver.exe
    Remote address:
    8.8.8.8:53
    Request
    pool.minexmr.com
    IN A
    Response
  • flag-us
    DNS
    pool.minexmr.com
    Driver.exe
    Remote address:
    8.8.8.8:53
    Request
    pool.minexmr.com
    IN A
    Response
  • flag-us
    DNS
    pool.minexmr.com
    Driver.exe
    Remote address:
    8.8.8.8:53
    Request
    pool.minexmr.com
    IN A
    Response
  • flag-us
    DNS
    pool.minexmr.com
    Driver.exe
    Remote address:
    8.8.8.8:53
    Request
    pool.minexmr.com
    IN A
    Response
  • flag-us
    DNS
    pool.minexmr.com
    Driver.exe
    Remote address:
    8.8.8.8:53
    Request
    pool.minexmr.com
    IN A
    Response
  • flag-us
    DNS
    pool.minexmr.com
    Driver.exe
    Remote address:
    8.8.8.8:53
    Request
    pool.minexmr.com
    IN A
    Response
  • flag-us
    DNS
    pool.minexmr.com
    Driver.exe
    Remote address:
    8.8.8.8:53
    Request
    pool.minexmr.com
    IN A
    Response
  • flag-us
    DNS
    pool.minexmr.com
    Driver.exe
    Remote address:
    8.8.8.8:53
    Request
    pool.minexmr.com
    IN A
    Response
  • flag-us
    DNS
    pool.minexmr.com
    Driver.exe
    Remote address:
    8.8.8.8:53
    Request
    pool.minexmr.com
    IN A
    Response
  • flag-us
    DNS
    pool.minexmr.com
    Driver.exe
    Remote address:
    8.8.8.8:53
    Request
    pool.minexmr.com
    IN A
    Response
  • flag-us
    DNS
    pool.minexmr.com
    Driver.exe
    Remote address:
    8.8.8.8:53
    Request
    pool.minexmr.com
    IN A
    Response
  • flag-us
    DNS
    pool.minexmr.com
    Driver.exe
    Remote address:
    8.8.8.8:53
    Request
    pool.minexmr.com
    IN A
    Response
  • flag-us
    DNS
    pool.minexmr.com
    Driver.exe
    Remote address:
    8.8.8.8:53
    Request
    pool.minexmr.com
    IN A
    Response
  • flag-us
    DNS
    pool.minexmr.com
    Driver.exe
    Remote address:
    8.8.8.8:53
    Request
    pool.minexmr.com
    IN A
    Response
  • flag-us
    DNS
    pool.minexmr.com
    Driver.exe
    Remote address:
    8.8.8.8:53
    Request
    pool.minexmr.com
    IN A
    Response
  • flag-us
    DNS
    pool.minexmr.com
    Driver.exe
    Remote address:
    8.8.8.8:53
    Request
    pool.minexmr.com
    IN A
    Response
  • flag-us
    DNS
    pool.minexmr.com
    Driver.exe
    Remote address:
    8.8.8.8:53
    Request
    pool.minexmr.com
    IN A
    Response
  • flag-us
    DNS
    pool.minexmr.com
    Driver.exe
    Remote address:
    8.8.8.8:53
    Request
    pool.minexmr.com
    IN A
    Response
  • flag-us
    DNS
    pool.minexmr.com
    Driver.exe
    Remote address:
    8.8.8.8:53
    Request
    pool.minexmr.com
    IN A
    Response
  • flag-us
    DNS
    pool.minexmr.com
    Driver.exe
    Remote address:
    8.8.8.8:53
    Request
    pool.minexmr.com
    IN A
    Response
  • flag-us
    DNS
    pool.minexmr.com
    Driver.exe
    Remote address:
    8.8.8.8:53
    Request
    pool.minexmr.com
    IN A
    Response
  • flag-us
    DNS
    pool.minexmr.com
    Driver.exe
    Remote address:
    8.8.8.8:53
    Request
    pool.minexmr.com
    IN A
    Response
  • flag-us
    DNS
    pool.minexmr.com
    Driver.exe
    Remote address:
    8.8.8.8:53
    Request
    pool.minexmr.com
    IN A
    Response
  • flag-us
    DNS
    pool.minexmr.com
    Driver.exe
    Remote address:
    8.8.8.8:53
    Request
    pool.minexmr.com
    IN A
    Response
No results found
  • 8.8.8.8:53
    pool.minexmr.com
    dns
    Driver.exe
    62 B
     122 B
     1
    1

    DNS Request

    pool.minexmr.com

  • 8.8.8.8:53
    pool.minexmr.com
    dns
    Driver.exe
    62 B
     122 B
     1
    1

    DNS Request

    pool.minexmr.com

  • 8.8.8.8:53
    pool.minexmr.com
    dns
    Driver.exe
    62 B
     122 B
     1
    1

    DNS Request

    pool.minexmr.com

  • 8.8.8.8:53
    pool.minexmr.com
    dns
    Driver.exe
    62 B
     122 B
     1
    1

    DNS Request

    pool.minexmr.com

  • 8.8.8.8:53
    pool.minexmr.com
    dns
    Driver.exe
    62 B
     122 B
     1
    1

    DNS Request

    pool.minexmr.com

  • 8.8.8.8:53
    pool.minexmr.com
    dns
    Driver.exe
    62 B
     122 B
     1
    1

    DNS Request

    pool.minexmr.com

  • 8.8.8.8:53
    pool.minexmr.com
    dns
    Driver.exe
    62 B
     122 B
     1
    1

    DNS Request

    pool.minexmr.com

  • 8.8.8.8:53
    pool.minexmr.com
    dns
    Driver.exe
    62 B
     122 B
     1
    1

    DNS Request

    pool.minexmr.com

  • 8.8.8.8:53
    pool.minexmr.com
    dns
    Driver.exe
    62 B
     122 B
     1
    1

    DNS Request

    pool.minexmr.com

  • 8.8.8.8:53
    pool.minexmr.com
    dns
    Driver.exe
    62 B
     122 B
     1
    1

    DNS Request

    pool.minexmr.com

  • 8.8.8.8:53
    pool.minexmr.com
    dns
    Driver.exe
    62 B
     122 B
     1
    1

    DNS Request

    pool.minexmr.com

  • 8.8.8.8:53
    pool.minexmr.com
    dns
    Driver.exe
    62 B
     122 B
     1
    1

    DNS Request

    pool.minexmr.com

  • 8.8.8.8:53
    pool.minexmr.com
    dns
    Driver.exe
    62 B
     122 B
     1
    1

    DNS Request

    pool.minexmr.com

  • 8.8.8.8:53
    pool.minexmr.com
    dns
    Driver.exe
    62 B
     122 B
     1
    1

    DNS Request

    pool.minexmr.com

  • 8.8.8.8:53
    pool.minexmr.com
    dns
    Driver.exe
    62 B
     122 B
     1
    1

    DNS Request

    pool.minexmr.com

  • 8.8.8.8:53
    pool.minexmr.com
    dns
    Driver.exe
    62 B
     122 B
     1
    1

    DNS Request

    pool.minexmr.com

  • 8.8.8.8:53
    pool.minexmr.com
    dns
    Driver.exe
    62 B
     122 B
     1
    1

    DNS Request

    pool.minexmr.com

  • 8.8.8.8:53
    pool.minexmr.com
    dns
    Driver.exe
    62 B
     122 B
     1
    1

    DNS Request

    pool.minexmr.com

  • 8.8.8.8:53
    pool.minexmr.com
    dns
    Driver.exe
    62 B
     122 B
     1
    1

    DNS Request

    pool.minexmr.com

  • 8.8.8.8:53
    pool.minexmr.com
    dns
    Driver.exe
    62 B
     122 B
     1
    1

    DNS Request

    pool.minexmr.com

  • 8.8.8.8:53
    pool.minexmr.com
    dns
    Driver.exe
    62 B
     122 B
     1
    1

    DNS Request

    pool.minexmr.com

  • 8.8.8.8:53
    pool.minexmr.com
    dns
    Driver.exe
    62 B
     122 B
     1
    1

    DNS Request

    pool.minexmr.com

  • 8.8.8.8:53
    pool.minexmr.com
    dns
    Driver.exe
    62 B
     122 B
     1
    1

    DNS Request

    pool.minexmr.com

  • 8.8.8.8:53
    pool.minexmr.com
    dns
    Driver.exe
    62 B
     122 B
     1
    1

    DNS Request

    pool.minexmr.com

  • 8.8.8.8:53
    pool.minexmr.com
    dns
    Driver.exe
    62 B
     122 B
     1
    1

    DNS Request

    pool.minexmr.com

  • 8.8.8.8:53
    pool.minexmr.com
    dns
    Driver.exe
    62 B
     122 B
     1
    1

    DNS Request

    pool.minexmr.com

  • 8.8.8.8:53
    pool.minexmr.com
    dns
    Driver.exe
    62 B
     122 B
     1
    1

    DNS Request

    pool.minexmr.com

  • 8.8.8.8:53
    pool.minexmr.com
    dns
    Driver.exe
    62 B
     122 B
     1
    1

    DNS Request

    pool.minexmr.com

  • 8.8.8.8:53
    pool.minexmr.com
    dns
    Driver.exe
    62 B
     122 B
     1
    1

    DNS Request

    pool.minexmr.com

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe
    Filesize

    4.3MB

    MD5

    c58b9de8d4554c6718264f55c9861cfd

    SHA1

    2e120be3d952d9deefc8972519d452bab8814156

    SHA256

    c371d06d30f5afea4fa0bf62f7ea104d3073c688802cdac21d33b4464e9beff4

    SHA512

    2d64f80a507b6bb6001b1c8eea09e5d7c7ede93ae3b670ec2db809b46ebead1758abe9b485ce4bb28440b8ad7164594fca08d28198f2c8cd807dbc9eb36d0335

    Download Submit

  • memory/1600-22-0x0000000000400000-0x000000000108D000-memory.dmp

    Filesize

    12.6MB

    Download

  • memory/1600-27-0x0000000000400000-0x000000000108D000-memory.dmp

    Filesize

    12.6MB

    Download

  • memory/1600-33-0x0000000000400000-0x000000000108D000-memory.dmp

    Filesize

    12.6MB

    Download

  • memory/1600-32-0x0000000000400000-0x000000000108D000-memory.dmp

    Filesize

    12.6MB

    Download

  • memory/1600-15-0x0000000000400000-0x000000000108D000-memory.dmp

    Filesize

    12.6MB

    Download

  • memory/1600-16-0x0000000001290000-0x00000000012A4000-memory.dmp

    Filesize

    80KB

    Download

  • memory/1600-31-0x0000000000400000-0x000000000108D000-memory.dmp

    Filesize

    12.6MB

    Download

  • memory/1600-23-0x0000000000400000-0x000000000108D000-memory.dmp

    Filesize

    12.6MB

    Download

  • memory/1600-30-0x0000000000400000-0x000000000108D000-memory.dmp

    Filesize

    12.6MB

    Download

  • memory/1600-20-0x0000000000400000-0x000000000108D000-memory.dmp

    Filesize

    12.6MB

    Download

  • memory/1600-29-0x0000000000400000-0x000000000108D000-memory.dmp

    Filesize

    12.6MB

    Download

  • memory/1600-19-0x0000000000400000-0x000000000108D000-memory.dmp

    Filesize

    12.6MB

    Download

  • memory/1600-28-0x0000000000400000-0x000000000108D000-memory.dmp

    Filesize

    12.6MB

    Download

  • memory/1600-24-0x0000000000400000-0x000000000108D000-memory.dmp

    Filesize

    12.6MB

    Download

  • memory/1600-25-0x0000000000400000-0x000000000108D000-memory.dmp

    Filesize

    12.6MB

    Download

  • memory/1600-26-0x0000000000400000-0x000000000108D000-memory.dmp

    Filesize

    12.6MB

    Download

  • memory/1600-21-0x0000000000400000-0x000000000108D000-memory.dmp

    Filesize

    12.6MB

    Download

  • memory/3292-18-0x00000000748C0000-0x0000000075070000-memory.dmp

    Filesize

    7.7MB

    Download

  • memory/3292-4-0x0000000005320000-0x0000000005386000-memory.dmp

    Filesize

    408KB

    Download

  • memory/3292-0-0x00000000748CE000-0x00000000748CF000-memory.dmp

    Filesize

    4KB

    Download

  • memory/3292-17-0x00000000748CE000-0x00000000748CF000-memory.dmp

    Filesize

    4KB

    Download

  • memory/3292-1-0x0000000000250000-0x00000000006B0000-memory.dmp

    Filesize

    4.4MB

    Download

  • memory/3292-5-0x00000000748C0000-0x0000000075070000-memory.dmp

    Filesize

    7.7MB

    Download

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.