loaderbot | e6454ecc1ee77ea4310736c6f2ec5eb169b94c039a90f2bc24231b8a7b2b5357

Analysis

max time kernel
150s
max time network
96s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
04-05-2024 19:34

Target

142e3778739a869cf9e791442b7bf675_JaffaCakes118.exe
Size

16KB
MD5

142e3778739a869cf9e791442b7bf675
SHA1

c0a97a2b84ebb8b7034e776102e078f118aec4ed
SHA256

e6454ecc1ee77ea4310736c6f2ec5eb169b94c039a90f2bc24231b8a7b2b5357
SHA512

f503da8168e802c7495c8a2e6c4c9085b68dd92176dd977babeff5c51ea1d26846f910a04c425c851fc248c34894a504e5872bc48b5513af1bf69ef4328004ca
SSDEEP

384:FKxvDuPNItH19GTXjdhRLuujYcV6AUwJFZb:F44atV9AhlfYcV6Dw9b

Score

10^/10

LoaderBot
LoaderBot is a loader written in .NET downloading and executing miners.
loader miner loaderbot
LoaderBot executable 1 IoCs

Processes:

resource yara_rule

behavioral2/memory/3056-1-0x0000000000F00000-0x0000000000F0A000-memory.dmp loaderbot
Drops startup file 1 IoCs

Processes:

142e3778739a869cf9e791442b7bf675_JaffaCakes118.exe

description ioc process

File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Webhost.url 142e3778739a869cf9e791442b7bf675_JaffaCakes118.exe

resource	yara_rule
behavioral2/memory/3056-1-0x0000000000F00000-0x0000000000F0A000-memory.dmp	loaderbot

description	ioc	process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Webhost.url	142e3778739a869cf9e791442b7bf675_JaffaCakes118.exe

Adds Run key to start application 2 TTPs 2 IoCs

Registry Run Keys / Startup Folder

Modify Registry

Processes:

142e3778739a869cf9e791442b7bf675_JaffaCakes118.exe142e3778739a869cf9e791442b7bf675_JaffaCakes118.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-2860750803-256193626-1801997576-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Webhost = "C:\\Users\\Admin\\AppData\\Roaming\\Windows\\142e3778739a869cf9e791442b7bf675_JaffaCakes118.exe"	142e3778739a869cf9e791442b7bf675_JaffaCakes118.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2860750803-256193626-1801997576-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Webhost = "C:\\Users\\Admin\\AppData\\Roaming\\Windows\\142e3778739a869cf9e791442b7bf675_JaffaCakes118.exe"	142e3778739a869cf9e791442b7bf675_JaffaCakes118.exe

Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task/Job
T1053

Processes:

schtasks.exeschtasks.exe

pid process

3252 schtasks.exe
948 schtasks.exe
Suspicious behavior: EnumeratesProcesses 3 IoCs

Processes:

142e3778739a869cf9e791442b7bf675_JaffaCakes118.exe142e3778739a869cf9e791442b7bf675_JaffaCakes118.exe

pid process

3056 142e3778739a869cf9e791442b7bf675_JaffaCakes118.exe
2632 142e3778739a869cf9e791442b7bf675_JaffaCakes118.exe
2632 142e3778739a869cf9e791442b7bf675_JaffaCakes118.exe
Suspicious behavior: RenamesItself 1 IoCs

Processes:

142e3778739a869cf9e791442b7bf675_JaffaCakes118.exe

pid process

3056 142e3778739a869cf9e791442b7bf675_JaffaCakes118.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

142e3778739a869cf9e791442b7bf675_JaffaCakes118.exe142e3778739a869cf9e791442b7bf675_JaffaCakes118.exe

description pid process

Token: SeDebugPrivilege 3056 142e3778739a869cf9e791442b7bf675_JaffaCakes118.exe
Token: SeDebugPrivilege 2632 142e3778739a869cf9e791442b7bf675_JaffaCakes118.exe

pid	process
3252	schtasks.exe
948	schtasks.exe

pid	process
3056	142e3778739a869cf9e791442b7bf675_JaffaCakes118.exe

description	pid	process
Token: SeDebugPrivilege	3056	142e3778739a869cf9e791442b7bf675_JaffaCakes118.exe
Token: SeDebugPrivilege	2632	142e3778739a869cf9e791442b7bf675_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 12 IoCs

Processes:

142e3778739a869cf9e791442b7bf675_JaffaCakes118.execmd.exe142e3778739a869cf9e791442b7bf675_JaffaCakes118.execmd.exe

description	pid	process	target process
PID 3056 wrote to memory of 1604	3056	142e3778739a869cf9e791442b7bf675_JaffaCakes118.exe	cmd.exe
PID 3056 wrote to memory of 1604	3056	142e3778739a869cf9e791442b7bf675_JaffaCakes118.exe	cmd.exe
PID 3056 wrote to memory of 1604	3056	142e3778739a869cf9e791442b7bf675_JaffaCakes118.exe	cmd.exe
PID 1604 wrote to memory of 3252	1604	cmd.exe	schtasks.exe
PID 1604 wrote to memory of 3252	1604	cmd.exe	schtasks.exe
PID 1604 wrote to memory of 3252	1604	cmd.exe	schtasks.exe
PID 2632 wrote to memory of 3608	2632	142e3778739a869cf9e791442b7bf675_JaffaCakes118.exe	cmd.exe
PID 2632 wrote to memory of 3608	2632	142e3778739a869cf9e791442b7bf675_JaffaCakes118.exe	cmd.exe
PID 2632 wrote to memory of 3608	2632	142e3778739a869cf9e791442b7bf675_JaffaCakes118.exe	cmd.exe
PID 3608 wrote to memory of 948	3608	cmd.exe	schtasks.exe
PID 3608 wrote to memory of 948	3608	cmd.exe	schtasks.exe
PID 3608 wrote to memory of 948	3608	cmd.exe	schtasks.exe

C:\Windows\SysWOW64\cmd.exe
"cmd" /C schtasks /create /tn \System\SecurityServiceUpdate /tr %userprofile%\AppData\Roaming\Windows\142e3778739a869cf9e791442b7bf675_JaffaCakes118.exe /st 00:00 /du 9999:59 /sc daily /ri 5 /f
2⤵
- Suspicious use of WriteProcessMemory
PID:1604

C:\Windows\SysWOW64\schtasks.exe
schtasks /create /tn \System\SecurityServiceUpdate /tr C:\Users\Admin\AppData\Roaming\Windows\142e3778739a869cf9e791442b7bf675_JaffaCakes118.exe /st 00:00 /du 9999:59 /sc daily /ri 5 /f
3⤵
- Creates scheduled task(s)
PID:3252

C:\Windows\SysWOW64\cmd.exe
"cmd" /C schtasks /create /tn \System\SecurityServiceUpdate /tr %userprofile%\AppData\Roaming\Windows\142e3778739a869cf9e791442b7bf675_JaffaCakes118.exe /st 00:00 /du 9999:59 /sc daily /ri 5 /f
2⤵
- Suspicious use of WriteProcessMemory
PID:3608

C:\Windows\SysWOW64\schtasks.exe
schtasks /create /tn \System\SecurityServiceUpdate /tr C:\Users\Admin\AppData\Roaming\Windows\142e3778739a869cf9e791442b7bf675_JaffaCakes118.exe /st 00:00 /du 9999:59 /sc daily /ri 5 /f
3⤵
- Creates scheduled task(s)
PID:948

memory/2632-5-0x00000000749D0000-0x0000000075180000-memory.dmp

Filesize
7.7MB

Download
memory/2632-6-0x00000000749D0000-0x0000000075180000-memory.dmp

Filesize
7.7MB

Download
memory/2632-8-0x00000000749D0000-0x0000000075180000-memory.dmp

Filesize
7.7MB

Download
memory/3056-0-0x00000000749DE000-0x00000000749DF000-memory.dmp

Filesize
4KB

Download
memory/3056-1-0x0000000000F00000-0x0000000000F0A000-memory.dmp

Filesize
40KB

Download
memory/3056-3-0x0000000005C30000-0x0000000005C96000-memory.dmp

Filesize
408KB

Download
memory/3056-4-0x00000000749D0000-0x0000000075180000-memory.dmp

Filesize
7.7MB

Download
memory/3056-9-0x00000000749DE000-0x00000000749DF000-memory.dmp

Filesize
4KB

Download
memory/3056-10-0x00000000749D0000-0x0000000075180000-memory.dmp

Filesize
7.7MB

Download