Analysis
- max time kernel
138s - max time network
104s - platform
windows7_x64 - resource
win7v200430 - submitted
03/07/2020, 05:48
Static task
static1
Behavioral task
behavioral1
Sample
IMG-#120789.exe
Resource
win7v200430
windows7_x64
0 signatures
0 seconds
General
- Target IMG-#120789.exe
- Size 255KB
- Sample200703-4kh9ecbzas
- SHA256 ccdfc872db6093214d40909b9d4d62e2d6421e57031a04ab95639a1fb003ccbe
- MD5 d7749679582e8468e0170163d4362924
- SHA1 4910e8e80a4d6df7b0bb16ef38422bf92990130e
- SHA512 27f665aea5661bedcb1eb49a36bb49fa1a5786ff92d8c31c6666b45b22feed48d39edfde8fa3554063272347420a7ad4889c96578fc5cfc118238f631bfd7e8b
- MD5 SHA1 SHA512
Malware Config
Extracted
Family
-
lokibot
C2
-
http://egamcorps.ga/~zadmin/lmark/pvent/mode.php
-
http://kbfvzoboss.bid/alien/fre.php
-
http://alphastand.trade/alien/fre.php
-
http://alphastand.win/alien/fre.php
-
http://alphastand.top/alien/fre.php
Signatures
- Suspicious behavior: MapViewOfSection 1 IoCs
pid Process 1456 rundll32.exe - Blacklisted process makes network request 4 IoCs
flow pid Process 5 1548 cmd.exe 6 1548 cmd.exe 7 1548 cmd.exe 9 1548 cmd.exe - Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 1548 cmd.exe - Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Suspicious use of WriteProcessMemory 47 IoCs
description pid Process procid_target PID 1400 wrote to memory of 1456 1400 IMG-#120789.exe 24 PID 1400 wrote to memory of 1456 1400 IMG-#120789.exe 24 PID 1400 wrote to memory of 1456 1400 IMG-#120789.exe 24 PID 1400 wrote to memory of 1456 1400 IMG-#120789.exe 24 PID 1400 wrote to memory of 1456 1400 IMG-#120789.exe 24 PID 1400 wrote to memory of 1456 1400 IMG-#120789.exe 24 PID 1400 wrote to memory of 1456 1400 IMG-#120789.exe 24 PID 1456 wrote to memory of 1548 1456 rundll32.exe 25 PID 1456 wrote to memory of 1548 1456 rundll32.exe 25 PID 1456 wrote to memory of 1548 1456 rundll32.exe 25 PID 1456 wrote to memory of 1548 1456 rundll32.exe 25 PID 1456 wrote to memory of 1548 1456 rundll32.exe 25 PID 1456 wrote to memory of 1548 1456 rundll32.exe 25 PID 1456 wrote to memory of 1548 1456 rundll32.exe 25 PID 1456 wrote to memory of 1548 1456 rundll32.exe 25 PID 1456 wrote to memory of 1548 1456 rundll32.exe 25 PID 1456 wrote to memory of 1548 1456 rundll32.exe 25 PID 1456 wrote to memory of 1548 1456 rundll32.exe 25 PID 1456 wrote to memory of 1548 1456 rundll32.exe 25 PID 1456 wrote to memory of 1548 1456 rundll32.exe 25 PID 1456 wrote to memory of 1548 1456 rundll32.exe 25 PID 1456 wrote to memory of 1548 1456 rundll32.exe 25 PID 1456 wrote to memory of 1548 1456 rundll32.exe 25 PID 1456 wrote to memory of 1548 1456 rundll32.exe 25 PID 1456 wrote to memory of 1548 1456 rundll32.exe 25 PID 1456 wrote to memory of 1548 1456 rundll32.exe 25 PID 1456 wrote to memory of 1548 1456 rundll32.exe 25 PID 1456 wrote to memory of 1548 1456 rundll32.exe 25 PID 1456 wrote to memory of 1548 1456 rundll32.exe 25 PID 1456 wrote to memory of 1548 1456 rundll32.exe 25 PID 1456 wrote to memory of 1548 1456 rundll32.exe 25 PID 1456 wrote to memory of 1548 1456 rundll32.exe 25 PID 1456 wrote to memory of 1548 1456 rundll32.exe 25 PID 1456 wrote to memory of 1548 1456 rundll32.exe 25 PID 1456 wrote to memory of 1548 1456 rundll32.exe 25 PID 1456 wrote to memory of 1548 1456 rundll32.exe 25 PID 1456 wrote to memory of 1548 1456 rundll32.exe 25 PID 1456 wrote to memory of 1548 1456 rundll32.exe 25 PID 1456 wrote to memory of 1548 1456 rundll32.exe 25 PID 1456 wrote to memory of 1548 1456 rundll32.exe 25 PID 1456 wrote to memory of 1548 1456 rundll32.exe 25 PID 1456 wrote to memory of 1548 1456 rundll32.exe 25 PID 1456 wrote to memory of 1548 1456 rundll32.exe 25 PID 1456 wrote to memory of 1548 1456 rundll32.exe 25 PID 1456 wrote to memory of 1548 1456 rundll32.exe 25 PID 1456 wrote to memory of 1548 1456 rundll32.exe 25 PID 1456 wrote to memory of 1548 1456 rundll32.exe 25 - Loads dropped DLL 1 IoCs
pid Process 1456 rundll32.exe - Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 1456 rundll32.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\IMG-#120789.exe"C:\Users\Admin\AppData\Local\Temp\IMG-#120789.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1400 -
C:\Windows\SysWOW64\rundll32.exeC:\Windows\system32\rundll32.exe Reprieve,Hemlock2⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
PID:1456 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe"3⤵
- Blacklisted process makes network request
- Suspicious use of AdjustPrivilegeToken
PID:1548
-
-