loaderbot | 7693091a21dc487f97f0ca1f51153e305587bf505460bbdee2fdee19e2584119

Analysis

max time kernel
104s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
16-04-2024 04:06

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

f2a6e8143d7778697c0396b2ebbbc97f_JaffaCakes118.exe
Size

12.6MB
MD5

f2a6e8143d7778697c0396b2ebbbc97f
SHA1

8e3f4db2c4e54ec274d0943af9c2d28e11256375
SHA256

7693091a21dc487f97f0ca1f51153e305587bf505460bbdee2fdee19e2584119
SHA512

04c411ebb219720462bbfe005f68fde1aa90e1c633bc4133298479053c28a5846068a38c611c9f94ecfeb4f0e8e81c65032afd373227e1aa69780258ff933849
SSDEEP

393216:fRtouHPatS+kxpNEMijBwGlUBfI+CYQxl9K3:fMuv9+k3JBI6Qxl9

Score

10^/10

loaderbot evasion loader miner persistence trojan vmprotect

Malware Config

Signatures

LoaderBot
LoaderBot is a loader written in .NET downloading and executing miners.
loader miner loaderbot
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
evasion

Query Registry
T1012

Virtualization/Sandbox Evasion
T1497

Processes:

Driver.exe

description ioc process

Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ Driver.exe
LoaderBot executable 2 IoCs

Processes:

resource yara_rule

behavioral2/memory/1564-1-0x0000000000F20000-0x000000000221A000-memory.dmp loaderbot
behavioral2/memory/1564-64-0x000000000B050000-0x000000000B060000-memory.dmp loaderbot

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Driver.exe

resource	yara_rule
behavioral2/memory/1564-1-0x0000000000F20000-0x000000000221A000-memory.dmp	loaderbot
behavioral2/memory/1564-64-0x000000000B050000-0x000000000B060000-memory.dmp	loaderbot

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

Driver.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	Driver.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	Driver.exe

Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.

Query Registry
T1012

System Information Discovery
T1082

Processes:

f2a6e8143d7778697c0396b2ebbbc97f_JaffaCakes118.exe

description ioc process

Key value queried \REGISTRY\USER\S-1-5-21-259785868-298165991-4178590326-1000\Control Panel\International\Geo\Nation f2a6e8143d7778697c0396b2ebbbc97f_JaffaCakes118.exe
Drops startup file 1 IoCs

Processes:

f2a6e8143d7778697c0396b2ebbbc97f_JaffaCakes118.exe

description ioc process

File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Driver.url f2a6e8143d7778697c0396b2ebbbc97f_JaffaCakes118.exe
Executes dropped EXE 1 IoCs

Processes:

Driver.exe

pid process

3200 Driver.exe
VMProtect packed file 1 IoCs
Detects executables packed with VMProtect commercial packer.
vmprotect

Processes:

resource yara_rule

behavioral2/memory/1564-1-0x0000000000F20000-0x000000000221A000-memory.dmp vmprotect

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-259785868-298165991-4178590326-1000\Control Panel\International\Geo\Nation	f2a6e8143d7778697c0396b2ebbbc97f_JaffaCakes118.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Driver.url	f2a6e8143d7778697c0396b2ebbbc97f_JaffaCakes118.exe

pid	process
3200	Driver.exe

resource	yara_rule
behavioral2/memory/1564-1-0x0000000000F20000-0x000000000221A000-memory.dmp	vmprotect

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

f2a6e8143d7778697c0396b2ebbbc97f_JaffaCakes118.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-259785868-298165991-4178590326-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Driver = "C:\\Users\\Admin\\AppData\\Roaming\\Sysfiles\\f2a6e8143d7778697c0396b2ebbbc97f_JaffaCakes118.exe"	f2a6e8143d7778697c0396b2ebbbc97f_JaffaCakes118.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs
evasion trojan

System Information Discovery
T1082

Processes:

Driver.exe

description ioc process

Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA Driver.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

description	ioc	process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	Driver.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

f2a6e8143d7778697c0396b2ebbbc97f_JaffaCakes118.exe

pid	process
1564	f2a6e8143d7778697c0396b2ebbbc97f_JaffaCakes118.exe
1564	f2a6e8143d7778697c0396b2ebbbc97f_JaffaCakes118.exe
1564	f2a6e8143d7778697c0396b2ebbbc97f_JaffaCakes118.exe
1564	f2a6e8143d7778697c0396b2ebbbc97f_JaffaCakes118.exe
1564	f2a6e8143d7778697c0396b2ebbbc97f_JaffaCakes118.exe
1564	f2a6e8143d7778697c0396b2ebbbc97f_JaffaCakes118.exe
1564	f2a6e8143d7778697c0396b2ebbbc97f_JaffaCakes118.exe
1564	f2a6e8143d7778697c0396b2ebbbc97f_JaffaCakes118.exe
1564	f2a6e8143d7778697c0396b2ebbbc97f_JaffaCakes118.exe
1564	f2a6e8143d7778697c0396b2ebbbc97f_JaffaCakes118.exe
1564	f2a6e8143d7778697c0396b2ebbbc97f_JaffaCakes118.exe
1564	f2a6e8143d7778697c0396b2ebbbc97f_JaffaCakes118.exe
1564	f2a6e8143d7778697c0396b2ebbbc97f_JaffaCakes118.exe
1564	f2a6e8143d7778697c0396b2ebbbc97f_JaffaCakes118.exe
1564	f2a6e8143d7778697c0396b2ebbbc97f_JaffaCakes118.exe
1564	f2a6e8143d7778697c0396b2ebbbc97f_JaffaCakes118.exe
1564	f2a6e8143d7778697c0396b2ebbbc97f_JaffaCakes118.exe
1564	f2a6e8143d7778697c0396b2ebbbc97f_JaffaCakes118.exe
1564	f2a6e8143d7778697c0396b2ebbbc97f_JaffaCakes118.exe
1564	f2a6e8143d7778697c0396b2ebbbc97f_JaffaCakes118.exe
1564	f2a6e8143d7778697c0396b2ebbbc97f_JaffaCakes118.exe
1564	f2a6e8143d7778697c0396b2ebbbc97f_JaffaCakes118.exe
1564	f2a6e8143d7778697c0396b2ebbbc97f_JaffaCakes118.exe
1564	f2a6e8143d7778697c0396b2ebbbc97f_JaffaCakes118.exe
1564	f2a6e8143d7778697c0396b2ebbbc97f_JaffaCakes118.exe
1564	f2a6e8143d7778697c0396b2ebbbc97f_JaffaCakes118.exe
1564	f2a6e8143d7778697c0396b2ebbbc97f_JaffaCakes118.exe
1564	f2a6e8143d7778697c0396b2ebbbc97f_JaffaCakes118.exe
1564	f2a6e8143d7778697c0396b2ebbbc97f_JaffaCakes118.exe
1564	f2a6e8143d7778697c0396b2ebbbc97f_JaffaCakes118.exe
1564	f2a6e8143d7778697c0396b2ebbbc97f_JaffaCakes118.exe
1564	f2a6e8143d7778697c0396b2ebbbc97f_JaffaCakes118.exe
1564	f2a6e8143d7778697c0396b2ebbbc97f_JaffaCakes118.exe
1564	f2a6e8143d7778697c0396b2ebbbc97f_JaffaCakes118.exe
1564	f2a6e8143d7778697c0396b2ebbbc97f_JaffaCakes118.exe
1564	f2a6e8143d7778697c0396b2ebbbc97f_JaffaCakes118.exe
1564	f2a6e8143d7778697c0396b2ebbbc97f_JaffaCakes118.exe
1564	f2a6e8143d7778697c0396b2ebbbc97f_JaffaCakes118.exe
1564	f2a6e8143d7778697c0396b2ebbbc97f_JaffaCakes118.exe
1564	f2a6e8143d7778697c0396b2ebbbc97f_JaffaCakes118.exe
1564	f2a6e8143d7778697c0396b2ebbbc97f_JaffaCakes118.exe
1564	f2a6e8143d7778697c0396b2ebbbc97f_JaffaCakes118.exe
1564	f2a6e8143d7778697c0396b2ebbbc97f_JaffaCakes118.exe
1564	f2a6e8143d7778697c0396b2ebbbc97f_JaffaCakes118.exe
1564	f2a6e8143d7778697c0396b2ebbbc97f_JaffaCakes118.exe
1564	f2a6e8143d7778697c0396b2ebbbc97f_JaffaCakes118.exe
1564	f2a6e8143d7778697c0396b2ebbbc97f_JaffaCakes118.exe
1564	f2a6e8143d7778697c0396b2ebbbc97f_JaffaCakes118.exe
1564	f2a6e8143d7778697c0396b2ebbbc97f_JaffaCakes118.exe
1564	f2a6e8143d7778697c0396b2ebbbc97f_JaffaCakes118.exe
1564	f2a6e8143d7778697c0396b2ebbbc97f_JaffaCakes118.exe
1564	f2a6e8143d7778697c0396b2ebbbc97f_JaffaCakes118.exe
1564	f2a6e8143d7778697c0396b2ebbbc97f_JaffaCakes118.exe
1564	f2a6e8143d7778697c0396b2ebbbc97f_JaffaCakes118.exe
1564	f2a6e8143d7778697c0396b2ebbbc97f_JaffaCakes118.exe
1564	f2a6e8143d7778697c0396b2ebbbc97f_JaffaCakes118.exe
1564	f2a6e8143d7778697c0396b2ebbbc97f_JaffaCakes118.exe
1564	f2a6e8143d7778697c0396b2ebbbc97f_JaffaCakes118.exe
1564	f2a6e8143d7778697c0396b2ebbbc97f_JaffaCakes118.exe
1564	f2a6e8143d7778697c0396b2ebbbc97f_JaffaCakes118.exe
1564	f2a6e8143d7778697c0396b2ebbbc97f_JaffaCakes118.exe
1564	f2a6e8143d7778697c0396b2ebbbc97f_JaffaCakes118.exe
1564	f2a6e8143d7778697c0396b2ebbbc97f_JaffaCakes118.exe
1564	f2a6e8143d7778697c0396b2ebbbc97f_JaffaCakes118.exe

Suspicious behavior: RenamesItself 1 IoCs

Processes:

f2a6e8143d7778697c0396b2ebbbc97f_JaffaCakes118.exe

pid process

1564 f2a6e8143d7778697c0396b2ebbbc97f_JaffaCakes118.exe
Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

f2a6e8143d7778697c0396b2ebbbc97f_JaffaCakes118.exeDriver.exe

description pid process

Token: SeDebugPrivilege 1564 f2a6e8143d7778697c0396b2ebbbc97f_JaffaCakes118.exe
Token: SeLockMemoryPrivilege 3200 Driver.exe
Token: SeLockMemoryPrivilege 3200 Driver.exe
Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

Driver.exe

pid process

3200 Driver.exe

description	pid	process
Token: SeDebugPrivilege	1564	f2a6e8143d7778697c0396b2ebbbc97f_JaffaCakes118.exe
Token: SeLockMemoryPrivilege	3200	Driver.exe
Token: SeLockMemoryPrivilege	3200	Driver.exe

pid	process
3200	Driver.exe

Suspicious use of WriteProcessMemory 2 IoCs

Processes:

f2a6e8143d7778697c0396b2ebbbc97f_JaffaCakes118.exe

description	pid	process	target process
PID 1564 wrote to memory of 3200	1564	f2a6e8143d7778697c0396b2ebbbc97f_JaffaCakes118.exe	Driver.exe
PID 1564 wrote to memory of 3200	1564	f2a6e8143d7778697c0396b2ebbbc97f_JaffaCakes118.exe	Driver.exe

C:\Users\Admin\AppData\Local\Temp\f2a6e8143d7778697c0396b2ebbbc97f_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\f2a6e8143d7778697c0396b2ebbbc97f_JaffaCakes118.exe"
1⤵
- Checks computer location settings
- Drops startup file
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1564

C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe
"C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe" -o pool.supportxmr.com:3333 -u 48VqBvWwx4DFvegwZp7dE7WpBeYWhdaZUF8BiWc6HdwsP89dK2tiqnHSuyyBjeSn9cZ2ZCMrVrVDkAhGNvCC44DKL2zvQn1 -p x -k -v=0 --donate-level=1 -t 4
2⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Checks whether UAC is enabled
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:3200

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe
Filesize
6.2MB

MD5
69db4898504d484299184227fc5864e5

SHA1
2099fef060129cffc199a3fcf2668dd9e2da545a

SHA256
83d13dc72e47b60a336d2f976234b5d0331bbd82d80c1b691ac7ea065b50cdb5

SHA512
2abb486cb7abf897474be642cc460f9c4a84eb692b697ca473f326211f295471cd0bb9363094d3f6a179c2b28a068f01b85065530d96c11cc9c8a59c4cbb46d1

Download Submit
memory/1564-0-0x0000000074490000-0x0000000074C40000-memory.dmp

Filesize
7.7MB

Download
memory/1564-1-0x0000000000F20000-0x000000000221A000-memory.dmp

Filesize
19.0MB

Download
memory/1564-2-0x000000000B050000-0x000000000B060000-memory.dmp

Filesize
64KB

Download
memory/1564-3-0x0000000004510000-0x0000000004520000-memory.dmp

Filesize
64KB

Download
memory/1564-4-0x0000000004570000-0x0000000004571000-memory.dmp

Filesize
4KB

Download
memory/1564-7-0x0000000007110000-0x0000000007176000-memory.dmp

Filesize
408KB

Download
memory/1564-64-0x000000000B050000-0x000000000B060000-memory.dmp

Filesize
64KB

Download
memory/1564-66-0x0000000004570000-0x0000000004571000-memory.dmp

Filesize
4KB

Download
memory/1564-65-0x0000000004510000-0x0000000004520000-memory.dmp

Filesize
64KB

Download
memory/1564-59-0x0000000074490000-0x0000000074C40000-memory.dmp

Filesize
7.7MB

Download
memory/3200-58-0x00007FF6E2610000-0x00007FF6E39C0000-memory.dmp

Filesize
19.7MB

Download
memory/3200-25-0x00007FFE00030000-0x00007FFE00031000-memory.dmp

Filesize
4KB

Download
memory/3200-28-0x00007FF6E2610000-0x00007FF6E39C0000-memory.dmp

Filesize
19.7MB

Download
memory/3200-29-0x00007FF6E2610000-0x00007FF6E39C0000-memory.dmp

Filesize
19.7MB

Download
memory/3200-32-0x000002BB259B0000-0x000002BB259CB000-memory.dmp

Filesize
108KB

Download
memory/3200-40-0x000002BB259A0000-0x000002BB259AC000-memory.dmp

Filesize
48KB

Download
memory/3200-46-0x0000000180000000-0x000000018008D000-memory.dmp

Filesize
564KB

Download
memory/3200-52-0x00007FF6E2610000-0x00007FF6E39C0000-memory.dmp

Filesize
19.7MB

Download
memory/3200-53-0x00007FF6E2610000-0x00007FF6E39C0000-memory.dmp

Filesize
19.7MB

Download
memory/3200-54-0x00007FF6E2610000-0x00007FF6E39C0000-memory.dmp

Filesize
19.7MB

Download
memory/3200-55-0x00007FF6E2610000-0x00007FF6E39C0000-memory.dmp

Filesize
19.7MB

Download
memory/3200-56-0x000002BB25950000-0x000002BB25970000-memory.dmp

Filesize
128KB

Download
memory/3200-57-0x000002BB259D0000-0x000002BB259F0000-memory.dmp

Filesize
128KB

Download
memory/3200-27-0x00007FFE00000000-0x00007FFE00002000-memory.dmp

Filesize
8KB

Download
memory/3200-21-0x00007FFE36C50000-0x00007FFE36F19000-memory.dmp

Filesize
2.8MB

Download
memory/3200-60-0x00007FF6E2610000-0x00007FF6E39C0000-memory.dmp

Filesize
19.7MB

Download
memory/3200-61-0x000002BB259F0000-0x000002BB25A10000-memory.dmp

Filesize
128KB

Download
memory/3200-62-0x000002BB25A10000-0x000002BB25A30000-memory.dmp

Filesize
128KB

Download
memory/3200-63-0x000002BB25A30000-0x000002BB25A50000-memory.dmp

Filesize
128KB

Download
memory/3200-26-0x00007FF6E2610000-0x00007FF6E39C0000-memory.dmp

Filesize
19.7MB

Download
memory/3200-22-0x00007FFE36C50000-0x00007FFE36F19000-memory.dmp

Filesize
2.8MB

Download
memory/3200-20-0x00007FFE38860000-0x00007FFE3891E000-memory.dmp

Filesize
760KB

Download
memory/3200-67-0x000002BB25A60000-0x000002BB25A80000-memory.dmp

Filesize
128KB

Download
memory/3200-68-0x00007FF6E2610000-0x00007FF6E39C0000-memory.dmp

Filesize
19.7MB

Download
memory/3200-69-0x00007FF6E2610000-0x00007FF6E39C0000-memory.dmp

Filesize
19.7MB

Download
memory/3200-71-0x00007FFE36C50000-0x00007FFE36F19000-memory.dmp

Filesize
2.8MB

Download
memory/3200-72-0x00007FF6E2610000-0x00007FF6E39C0000-memory.dmp

Filesize
19.7MB

Download
memory/3200-73-0x00007FFE38860000-0x00007FFE3891E000-memory.dmp

Filesize
760KB

Download
memory/3200-74-0x00007FF6E2610000-0x00007FF6E39C0000-memory.dmp

Filesize
19.7MB

Download
memory/3200-75-0x00007FF6E2610000-0x00007FF6E39C0000-memory.dmp

Filesize
19.7MB

Download
memory/3200-76-0x00007FF6E2610000-0x00007FF6E39C0000-memory.dmp

Filesize
19.7MB

Download
memory/3200-77-0x00007FF6E2610000-0x00007FF6E39C0000-memory.dmp

Filesize
19.7MB

Download
memory/3200-79-0x00007FF6E2610000-0x00007FF6E39C0000-memory.dmp

Filesize
19.7MB

Download
memory/3200-80-0x00007FF6E2610000-0x00007FF6E39C0000-memory.dmp

Filesize
19.7MB

Download
memory/3200-81-0x000002BB259F0000-0x000002BB25A10000-memory.dmp

Filesize
128KB

Download
memory/3200-82-0x000002BB25A10000-0x000002BB25A30000-memory.dmp

Filesize
128KB

Download
memory/3200-83-0x000002BB25A30000-0x000002BB25A50000-memory.dmp

Filesize
128KB

Download