Analysis
- max time kernel
142s - max time network
132s - platform
windows10_x64 - resource
win10 - submitted
03/07/2020, 06:42
Static task
static1
Behavioral task
behavioral1
Sample
902edd6d63f33d46ac7efc5b894a9dd1.exe
Resource
win7v200430
windows7_x64
0 signatures
0 seconds
General
- Target 902edd6d63f33d46ac7efc5b894a9dd1.exe
- Size 305KB
- Sample200703-twamab4ky2
- SHA256 0468ee9baa41d41562625b8872c782302a324bf03b94f9cfa48060e8d4e8203d
- MD5 902edd6d63f33d46ac7efc5b894a9dd1
- SHA1 ce9001a3f062dff2635235045cb6d4d0426ba488
- SHA512 54b9ed2115fecdc8f8515a00197e3db4ec2b87fc85cc859f4689e38762b92e5dea5750ac127a2ce9146f28756efc3ce670d158a05653f6369dea17adbeff5a64
- MD5 SHA1 SHA512
Malware Config
Extracted
Family
-
lokibot
C2
-
http://t-mk.me/ig2/fre.php
-
http://kbfvzoboss.bid/alien/fre.php
-
http://alphastand.trade/alien/fre.php
-
http://alphastand.win/alien/fre.php
-
http://alphastand.top/alien/fre.php
Signatures
- Suspicious behavior: MapViewOfSection 4 IoCs
pid Process 3892 rundll32.exe 3892 rundll32.exe 3892 rundll32.exe 3892 rundll32.exe - Blacklisted process makes network request 6 IoCs
flow pid Process 4 3844 cmd.exe 6 3844 cmd.exe 14 3844 cmd.exe 16 3844 cmd.exe 19 3844 cmd.exe 21 3844 cmd.exe - Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 3844 cmd.exe - Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Suspicious use of WriteProcessMemory 94 IoCs
description pid Process procid_target PID 3788 wrote to memory of 3892 3788 902edd6d63f33d46ac7efc5b894a9dd1.exe 67 PID 3788 wrote to memory of 3892 3788 902edd6d63f33d46ac7efc5b894a9dd1.exe 67 PID 3788 wrote to memory of 3892 3788 902edd6d63f33d46ac7efc5b894a9dd1.exe 67 PID 3892 wrote to memory of 3880 3892 rundll32.exe 68 PID 3892 wrote to memory of 3880 3892 rundll32.exe 68 PID 3892 wrote to memory of 3880 3892 rundll32.exe 68 PID 3892 wrote to memory of 3880 3892 rundll32.exe 68 PID 3892 wrote to memory of 3860 3892 rundll32.exe 69 PID 3892 wrote to memory of 3860 3892 rundll32.exe 69 PID 3892 wrote to memory of 3860 3892 rundll32.exe 69 PID 3892 wrote to memory of 3860 3892 rundll32.exe 69 PID 3892 wrote to memory of 3268 3892 rundll32.exe 70 PID 3892 wrote to memory of 3268 3892 rundll32.exe 70 PID 3892 wrote to memory of 3268 3892 rundll32.exe 70 PID 3892 wrote to memory of 3268 3892 rundll32.exe 70 PID 3892 wrote to memory of 3844 3892 rundll32.exe 71 PID 3892 wrote to memory of 3844 3892 rundll32.exe 71 PID 3892 wrote to memory of 3844 3892 rundll32.exe 71 PID 3892 wrote to memory of 3844 3892 rundll32.exe 71 PID 3892 wrote to memory of 3844 3892 rundll32.exe 71 PID 3892 wrote to memory of 3844 3892 rundll32.exe 71 PID 3892 wrote to memory of 3844 3892 rundll32.exe 71 PID 3892 wrote to memory of 3844 3892 rundll32.exe 71 PID 3892 wrote to memory of 3844 3892 rundll32.exe 71 PID 3892 wrote to memory of 3844 3892 rundll32.exe 71 PID 3892 wrote to memory of 3844 3892 rundll32.exe 71 PID 3892 wrote to memory of 3844 3892 rundll32.exe 71 PID 3892 wrote to memory of 3844 3892 rundll32.exe 71 PID 3892 wrote to memory of 3844 3892 rundll32.exe 71 PID 3892 wrote to memory of 3844 3892 rundll32.exe 71 PID 3892 wrote to memory of 3844 3892 rundll32.exe 71 PID 3892 wrote to memory of 3844 3892 rundll32.exe 71 PID 3892 wrote to memory of 3844 3892 rundll32.exe 71 PID 3892 wrote to memory of 3844 3892 rundll32.exe 71 PID 3892 wrote to memory of 3844 3892 rundll32.exe 71 PID 3892 wrote to memory of 3844 3892 rundll32.exe 71 PID 3892 wrote to memory of 3844 3892 rundll32.exe 71 PID 3892 wrote to memory of 3844 3892 rundll32.exe 71 PID 3892 wrote to memory of 3844 3892 rundll32.exe 71 PID 3892 wrote to memory of 3844 3892 rundll32.exe 71 PID 3892 wrote to memory of 3844 3892 rundll32.exe 71 PID 3892 wrote to memory of 3844 3892 rundll32.exe 71 PID 3892 wrote to memory of 3844 3892 rundll32.exe 71 PID 3892 wrote to memory of 3844 3892 rundll32.exe 71 PID 3892 wrote to memory of 3844 3892 rundll32.exe 71 PID 3892 wrote to memory of 3844 3892 rundll32.exe 71 PID 3892 wrote to memory of 3844 3892 rundll32.exe 71 PID 3892 wrote to memory of 3844 3892 rundll32.exe 71 PID 3892 wrote to memory of 3844 3892 rundll32.exe 71 PID 3892 wrote to memory of 3844 3892 rundll32.exe 71 PID 3892 wrote to memory of 3844 3892 rundll32.exe 71 PID 3892 wrote to memory of 3844 3892 rundll32.exe 71 PID 3892 wrote to memory of 3844 3892 rundll32.exe 71 PID 3892 wrote to memory of 3844 3892 rundll32.exe 71 PID 3892 wrote to memory of 3844 3892 rundll32.exe 71 PID 3892 wrote to memory of 3844 3892 rundll32.exe 71 PID 3892 wrote to memory of 3844 3892 rundll32.exe 71 PID 3892 wrote to memory of 3844 3892 rundll32.exe 71 PID 3892 wrote to memory of 3844 3892 rundll32.exe 71 PID 3892 wrote to memory of 3844 3892 rundll32.exe 71 PID 3892 wrote to memory of 3844 3892 rundll32.exe 71 PID 3892 wrote to memory of 3844 3892 rundll32.exe 71 PID 3892 wrote to memory of 3844 3892 rundll32.exe 71 PID 3892 wrote to memory of 3844 3892 rundll32.exe 71 PID 3892 wrote to memory of 3844 3892 rundll32.exe 71 PID 3892 wrote to memory of 3844 3892 rundll32.exe 71 PID 3892 wrote to memory of 3844 3892 rundll32.exe 71 PID 3892 wrote to memory of 3844 3892 rundll32.exe 71 PID 3892 wrote to memory of 3844 3892 rundll32.exe 71 PID 3892 wrote to memory of 3844 3892 rundll32.exe 71 PID 3892 wrote to memory of 3844 3892 rundll32.exe 71 PID 3892 wrote to memory of 3844 3892 rundll32.exe 71 PID 3892 wrote to memory of 3844 3892 rundll32.exe 71 PID 3892 wrote to memory of 3844 3892 rundll32.exe 71 PID 3892 wrote to memory of 3844 3892 rundll32.exe 71 PID 3892 wrote to memory of 3844 3892 rundll32.exe 71 PID 3892 wrote to memory of 3844 3892 rundll32.exe 71 PID 3892 wrote to memory of 3844 3892 rundll32.exe 71 PID 3892 wrote to memory of 3844 3892 rundll32.exe 71 PID 3892 wrote to memory of 3844 3892 rundll32.exe 71 PID 3892 wrote to memory of 3844 3892 rundll32.exe 71 PID 3892 wrote to memory of 3844 3892 rundll32.exe 71 PID 3892 wrote to memory of 3844 3892 rundll32.exe 71 PID 3892 wrote to memory of 3844 3892 rundll32.exe 71 PID 3892 wrote to memory of 3844 3892 rundll32.exe 71 PID 3892 wrote to memory of 3844 3892 rundll32.exe 71 PID 3892 wrote to memory of 3844 3892 rundll32.exe 71 PID 3892 wrote to memory of 3844 3892 rundll32.exe 71 PID 3892 wrote to memory of 3844 3892 rundll32.exe 71 PID 3892 wrote to memory of 3844 3892 rundll32.exe 71 PID 3892 wrote to memory of 3844 3892 rundll32.exe 71 PID 3892 wrote to memory of 3844 3892 rundll32.exe 71 PID 3892 wrote to memory of 3844 3892 rundll32.exe 71 PID 3892 wrote to memory of 3844 3892 rundll32.exe 71 - Loads dropped DLL 1 IoCs
pid Process 3892 rundll32.exe - Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 3892 rundll32.exe 3892 rundll32.exe 3892 rundll32.exe 3892 rundll32.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\902edd6d63f33d46ac7efc5b894a9dd1.exe"C:\Users\Admin\AppData\Local\Temp\902edd6d63f33d46ac7efc5b894a9dd1.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3788 -
C:\Windows\SysWOW64\rundll32.exeC:\Windows\system32\rundll32.exe Reprieve,Hemlock2⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
PID:3892 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe"3⤵PID:3880
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe"3⤵PID:3860
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe"3⤵PID:3268
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe"3⤵
- Blacklisted process makes network request
- Suspicious use of AdjustPrivilegeToken
PID:3844
-
-