Analysis
- max time kernel
94s - max time network
136s - platform
windows10_x64 - resource
win10 - submitted
03/07/2020, 05:48
Static task
static1
Behavioral task
behavioral1
Sample
IMG-#120789.exe
Resource
win7v200430
windows7_x64
0 signatures
0 seconds
General
- Target IMG-#120789.exe
- Size 255KB
- Sample200703-4kh9ecbzas
- SHA256 ccdfc872db6093214d40909b9d4d62e2d6421e57031a04ab95639a1fb003ccbe
- MD5 d7749679582e8468e0170163d4362924
- SHA1 4910e8e80a4d6df7b0bb16ef38422bf92990130e
- SHA512 27f665aea5661bedcb1eb49a36bb49fa1a5786ff92d8c31c6666b45b22feed48d39edfde8fa3554063272347420a7ad4889c96578fc5cfc118238f631bfd7e8b
- MD5 SHA1 SHA512
Malware Config
Extracted
Family
-
lokibot
C2
-
http://egamcorps.ga/~zadmin/lmark/pvent/mode.php
-
http://kbfvzoboss.bid/alien/fre.php
-
http://alphastand.trade/alien/fre.php
-
http://alphastand.win/alien/fre.php
-
http://alphastand.top/alien/fre.php
Signatures
- Blacklisted process makes network request 4 IoCs
flow pid Process 6 2972 cmd.exe 7 2972 cmd.exe 8 2972 cmd.exe 13 2972 cmd.exe - Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 2972 cmd.exe - Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Suspicious use of WriteProcessMemory 86 IoCs
description pid Process procid_target PID 716 wrote to memory of 3840 716 IMG-#120789.exe 67 PID 716 wrote to memory of 3840 716 IMG-#120789.exe 67 PID 716 wrote to memory of 3840 716 IMG-#120789.exe 67 PID 3840 wrote to memory of 3112 3840 rundll32.exe 68 PID 3840 wrote to memory of 3112 3840 rundll32.exe 68 PID 3840 wrote to memory of 3112 3840 rundll32.exe 68 PID 3840 wrote to memory of 3112 3840 rundll32.exe 68 PID 3840 wrote to memory of 2972 3840 rundll32.exe 69 PID 3840 wrote to memory of 2972 3840 rundll32.exe 69 PID 3840 wrote to memory of 2972 3840 rundll32.exe 69 PID 3840 wrote to memory of 2972 3840 rundll32.exe 69 PID 3840 wrote to memory of 2972 3840 rundll32.exe 69 PID 3840 wrote to memory of 2972 3840 rundll32.exe 69 PID 3840 wrote to memory of 2972 3840 rundll32.exe 69 PID 3840 wrote to memory of 2972 3840 rundll32.exe 69 PID 3840 wrote to memory of 2972 3840 rundll32.exe 69 PID 3840 wrote to memory of 2972 3840 rundll32.exe 69 PID 3840 wrote to memory of 2972 3840 rundll32.exe 69 PID 3840 wrote to memory of 2972 3840 rundll32.exe 69 PID 3840 wrote to memory of 2972 3840 rundll32.exe 69 PID 3840 wrote to memory of 2972 3840 rundll32.exe 69 PID 3840 wrote to memory of 2972 3840 rundll32.exe 69 PID 3840 wrote to memory of 2972 3840 rundll32.exe 69 PID 3840 wrote to memory of 2972 3840 rundll32.exe 69 PID 3840 wrote to memory of 2972 3840 rundll32.exe 69 PID 3840 wrote to memory of 2972 3840 rundll32.exe 69 PID 3840 wrote to memory of 2972 3840 rundll32.exe 69 PID 3840 wrote to memory of 2972 3840 rundll32.exe 69 PID 3840 wrote to memory of 2972 3840 rundll32.exe 69 PID 3840 wrote to memory of 2972 3840 rundll32.exe 69 PID 3840 wrote to memory of 2972 3840 rundll32.exe 69 PID 3840 wrote to memory of 2972 3840 rundll32.exe 69 PID 3840 wrote to memory of 2972 3840 rundll32.exe 69 PID 3840 wrote to memory of 2972 3840 rundll32.exe 69 PID 3840 wrote to memory of 2972 3840 rundll32.exe 69 PID 3840 wrote to memory of 2972 3840 rundll32.exe 69 PID 3840 wrote to memory of 2972 3840 rundll32.exe 69 PID 3840 wrote to memory of 2972 3840 rundll32.exe 69 PID 3840 wrote to memory of 2972 3840 rundll32.exe 69 PID 3840 wrote to memory of 2972 3840 rundll32.exe 69 PID 3840 wrote to memory of 2972 3840 rundll32.exe 69 PID 3840 wrote to memory of 2972 3840 rundll32.exe 69 PID 3840 wrote to memory of 2972 3840 rundll32.exe 69 PID 3840 wrote to memory of 2972 3840 rundll32.exe 69 PID 3840 wrote to memory of 2972 3840 rundll32.exe 69 PID 3840 wrote to memory of 2972 3840 rundll32.exe 69 PID 3840 wrote to memory of 2972 3840 rundll32.exe 69 PID 3840 wrote to memory of 2972 3840 rundll32.exe 69 PID 3840 wrote to memory of 2972 3840 rundll32.exe 69 PID 3840 wrote to memory of 2972 3840 rundll32.exe 69 PID 3840 wrote to memory of 2972 3840 rundll32.exe 69 PID 3840 wrote to memory of 2972 3840 rundll32.exe 69 PID 3840 wrote to memory of 2972 3840 rundll32.exe 69 PID 3840 wrote to memory of 2972 3840 rundll32.exe 69 PID 3840 wrote to memory of 2972 3840 rundll32.exe 69 PID 3840 wrote to memory of 2972 3840 rundll32.exe 69 PID 3840 wrote to memory of 2972 3840 rundll32.exe 69 PID 3840 wrote to memory of 2972 3840 rundll32.exe 69 PID 3840 wrote to memory of 2972 3840 rundll32.exe 69 PID 3840 wrote to memory of 2972 3840 rundll32.exe 69 PID 3840 wrote to memory of 2972 3840 rundll32.exe 69 PID 3840 wrote to memory of 2972 3840 rundll32.exe 69 PID 3840 wrote to memory of 2972 3840 rundll32.exe 69 PID 3840 wrote to memory of 2972 3840 rundll32.exe 69 PID 3840 wrote to memory of 2972 3840 rundll32.exe 69 PID 3840 wrote to memory of 2972 3840 rundll32.exe 69 PID 3840 wrote to memory of 2972 3840 rundll32.exe 69 PID 3840 wrote to memory of 2972 3840 rundll32.exe 69 PID 3840 wrote to memory of 2972 3840 rundll32.exe 69 PID 3840 wrote to memory of 2972 3840 rundll32.exe 69 PID 3840 wrote to memory of 2972 3840 rundll32.exe 69 PID 3840 wrote to memory of 2972 3840 rundll32.exe 69 PID 3840 wrote to memory of 2972 3840 rundll32.exe 69 PID 3840 wrote to memory of 2972 3840 rundll32.exe 69 PID 3840 wrote to memory of 2972 3840 rundll32.exe 69 PID 3840 wrote to memory of 2972 3840 rundll32.exe 69 PID 3840 wrote to memory of 2972 3840 rundll32.exe 69 PID 3840 wrote to memory of 2972 3840 rundll32.exe 69 PID 3840 wrote to memory of 2972 3840 rundll32.exe 69 PID 3840 wrote to memory of 2972 3840 rundll32.exe 69 PID 3840 wrote to memory of 2972 3840 rundll32.exe 69 PID 3840 wrote to memory of 2972 3840 rundll32.exe 69 PID 3840 wrote to memory of 2972 3840 rundll32.exe 69 PID 3840 wrote to memory of 2972 3840 rundll32.exe 69 PID 3840 wrote to memory of 2972 3840 rundll32.exe 69 PID 3840 wrote to memory of 2972 3840 rundll32.exe 69 - Loads dropped DLL 1 IoCs
pid Process 3840 rundll32.exe - Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 3840 rundll32.exe 3840 rundll32.exe - Suspicious behavior: MapViewOfSection 2 IoCs
pid Process 3840 rundll32.exe 3840 rundll32.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\IMG-#120789.exe"C:\Users\Admin\AppData\Local\Temp\IMG-#120789.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:716 -
C:\Windows\SysWOW64\rundll32.exeC:\Windows\system32\rundll32.exe Reprieve,Hemlock2⤵
- Suspicious use of WriteProcessMemory
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:3840 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe"3⤵PID:3112
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe"3⤵
- Blacklisted process makes network request
- Suspicious use of AdjustPrivilegeToken
PID:2972
-
-