Extracted

Extracted

• • Target
    https://cdn.discordapp.com/attachments/1531069890197327922/1543143717676908615/Guns.lol_viewbot.zip?ex=6ab0cd14&is=6aaf7b94&hm=02de834d1139b4d2f2f8bdd8661168e5c23bce035d84305532e8cd0ceadfadf3&

  Score

  10^/10

  defense_evasiondiscoveryexecutiondonutloaderoverlordxmrigloaderminerpersistenceransomwareratupx

  • Detects DonutLoader

    loader

  • Detects Overlord RAT

  • Family: DonutLoader

    DonutLoader is a position-independent code that enables in-memory execution of VBScript, JScript, EXE, DLL files and dotNET assemblies.

    loaderdonutloader

  • Family: Overlord

    Overlord is an open-source Windows RAT written in Golang.

    ratoverlord

  • Family: xmrig

    XMRig is a high performance, open source, cross platform CPU/GPU miner.

    minerxmrig

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • XMRig Miner payload

    miner

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Downloads MZ/PE file

  • Creates new service(s)

    persistenceexecution

  • Executes dropped EXE

  • Loads dropped DLL

  • Registers new Windows logon scripts automatically executed at logon.

    persistence

  • Stops running service(s)

    defense_evasionexecution

  • Adds Run key to start application

    persistence

  • Drops desktop.ini file(s)

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery

  • Network Share Discovery

    Attempt to gather information on host network.

    discovery

  • Drops file in System32 directory

  • Executes a VBScript file via the Windows Script Host.

    execution

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1