Analysis
-
max time kernel
113s -
max time network
119s -
platform
windows7_x64 -
resource
win7 -
submitted
07-07-2020 13:07
Static task
static1
Behavioral task
behavioral1
Sample
New Order.pdf.exe
Resource
win7
Behavioral task
behavioral2
Sample
New Order.pdf.exe
Resource
win10v200430
General
-
Target
New Order.pdf.exe
-
Size
306KB
-
MD5
33734974cdccb671d66899e0cca55d84
-
SHA1
e8cefa5364738a13c537b5b4efb0f6d00e207991
-
SHA256
f69a226eff787090505d361801a4a61d10658bde44759b9e5f80420e3e40e02f
-
SHA512
c392843a80a73693a166bef590a15b1a6c3cfc51f46e767a941ea74bedc177ca223c40196a661e4c7dd3fd85f8047c6ea3d07d2919f9798f0b1c04066410f069
Malware Config
Extracted
lokibot
http://195.69.140.147/.op/cr.php/xbqxHCR0T1UiD
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php
Signatures
-
Suspicious use of WriteProcessMemory 10 IoCs
Processes:
New Order.pdf.exedescription pid process target process PID 1060 wrote to memory of 1436 1060 New Order.pdf.exe New Order.pdf.exe PID 1060 wrote to memory of 1436 1060 New Order.pdf.exe New Order.pdf.exe PID 1060 wrote to memory of 1436 1060 New Order.pdf.exe New Order.pdf.exe PID 1060 wrote to memory of 1436 1060 New Order.pdf.exe New Order.pdf.exe PID 1060 wrote to memory of 1436 1060 New Order.pdf.exe New Order.pdf.exe PID 1060 wrote to memory of 1436 1060 New Order.pdf.exe New Order.pdf.exe PID 1060 wrote to memory of 1436 1060 New Order.pdf.exe New Order.pdf.exe PID 1060 wrote to memory of 1436 1060 New Order.pdf.exe New Order.pdf.exe PID 1060 wrote to memory of 1436 1060 New Order.pdf.exe New Order.pdf.exe PID 1060 wrote to memory of 1436 1060 New Order.pdf.exe New Order.pdf.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
New Order.pdf.exedescription pid process target process PID 1060 set thread context of 1436 1060 New Order.pdf.exe New Order.pdf.exe -
Suspicious behavior: RenamesItself 1 IoCs
Processes:
New Order.pdf.exepid process 1436 New Order.pdf.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
New Order.pdf.exeNew Order.pdf.exedescription pid process Token: SeDebugPrivilege 1060 New Order.pdf.exe Token: SeDebugPrivilege 1436 New Order.pdf.exe -
Suspicious behavior: EnumeratesProcesses 3 IoCs
Processes:
New Order.pdf.exepid process 1060 New Order.pdf.exe 1060 New Order.pdf.exe 1060 New Order.pdf.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\New Order.pdf.exe"C:\Users\Admin\AppData\Local\Temp\New Order.pdf.exe"1⤵
- Suspicious use of WriteProcessMemory
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious behavior: EnumeratesProcesses
-
C:\Users\Admin\AppData\Local\Temp\New Order.pdf.exe"C:\Users\Admin\AppData\Local\Temp\New Order.pdf.exe"2⤵
- Suspicious behavior: RenamesItself
- Suspicious use of AdjustPrivilegeToken