Analysis
-
max time kernel
101s -
max time network
111s -
platform
windows7_x64 -
resource
win7v200430 -
submitted
07-07-2020 09:15
Static task
static1
Behavioral task
behavioral1
Sample
BAYERCOMPANY MCHN-Order 20200707.exe
Resource
win7v200430
General
-
Target
BAYERCOMPANY MCHN-Order 20200707.exe
-
Size
348KB
-
MD5
4ab98a275e83315ab25f376c2500fc00
-
SHA1
bb3e84826ed9dade2311bdb0be60b0f639041ebb
-
SHA256
83212dc99a020b7d37a385d273f4a075db369d2032840c0ed77a682278487f4e
-
SHA512
970be824cdb2c76c80f63a23efc056cb13d252d98088a986fbd870909c2cae25d5488c82e3ca5c162a30f3f33256d7f0264414a37bf54052bf4c3a74be712010
Malware Config
Extracted
lokibot
http://bayercornpany.com/php/fre.php
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php
Signatures
-
Suspicious use of WriteProcessMemory 22 IoCs
Processes:
BAYERCOMPANY MCHN-Order 20200707.exedescription pid process target process PID 1360 wrote to memory of 1368 1360 BAYERCOMPANY MCHN-Order 20200707.exe BAYERCOMPANY MCHN-Order 20200707.exe PID 1360 wrote to memory of 1368 1360 BAYERCOMPANY MCHN-Order 20200707.exe BAYERCOMPANY MCHN-Order 20200707.exe PID 1360 wrote to memory of 1368 1360 BAYERCOMPANY MCHN-Order 20200707.exe BAYERCOMPANY MCHN-Order 20200707.exe PID 1360 wrote to memory of 1368 1360 BAYERCOMPANY MCHN-Order 20200707.exe BAYERCOMPANY MCHN-Order 20200707.exe PID 1360 wrote to memory of 1224 1360 BAYERCOMPANY MCHN-Order 20200707.exe BAYERCOMPANY MCHN-Order 20200707.exe PID 1360 wrote to memory of 1224 1360 BAYERCOMPANY MCHN-Order 20200707.exe BAYERCOMPANY MCHN-Order 20200707.exe PID 1360 wrote to memory of 1224 1360 BAYERCOMPANY MCHN-Order 20200707.exe BAYERCOMPANY MCHN-Order 20200707.exe PID 1360 wrote to memory of 1224 1360 BAYERCOMPANY MCHN-Order 20200707.exe BAYERCOMPANY MCHN-Order 20200707.exe PID 1360 wrote to memory of 1800 1360 BAYERCOMPANY MCHN-Order 20200707.exe BAYERCOMPANY MCHN-Order 20200707.exe PID 1360 wrote to memory of 1800 1360 BAYERCOMPANY MCHN-Order 20200707.exe BAYERCOMPANY MCHN-Order 20200707.exe PID 1360 wrote to memory of 1800 1360 BAYERCOMPANY MCHN-Order 20200707.exe BAYERCOMPANY MCHN-Order 20200707.exe PID 1360 wrote to memory of 1800 1360 BAYERCOMPANY MCHN-Order 20200707.exe BAYERCOMPANY MCHN-Order 20200707.exe PID 1360 wrote to memory of 1792 1360 BAYERCOMPANY MCHN-Order 20200707.exe BAYERCOMPANY MCHN-Order 20200707.exe PID 1360 wrote to memory of 1792 1360 BAYERCOMPANY MCHN-Order 20200707.exe BAYERCOMPANY MCHN-Order 20200707.exe PID 1360 wrote to memory of 1792 1360 BAYERCOMPANY MCHN-Order 20200707.exe BAYERCOMPANY MCHN-Order 20200707.exe PID 1360 wrote to memory of 1792 1360 BAYERCOMPANY MCHN-Order 20200707.exe BAYERCOMPANY MCHN-Order 20200707.exe PID 1360 wrote to memory of 1792 1360 BAYERCOMPANY MCHN-Order 20200707.exe BAYERCOMPANY MCHN-Order 20200707.exe PID 1360 wrote to memory of 1792 1360 BAYERCOMPANY MCHN-Order 20200707.exe BAYERCOMPANY MCHN-Order 20200707.exe PID 1360 wrote to memory of 1792 1360 BAYERCOMPANY MCHN-Order 20200707.exe BAYERCOMPANY MCHN-Order 20200707.exe PID 1360 wrote to memory of 1792 1360 BAYERCOMPANY MCHN-Order 20200707.exe BAYERCOMPANY MCHN-Order 20200707.exe PID 1360 wrote to memory of 1792 1360 BAYERCOMPANY MCHN-Order 20200707.exe BAYERCOMPANY MCHN-Order 20200707.exe PID 1360 wrote to memory of 1792 1360 BAYERCOMPANY MCHN-Order 20200707.exe BAYERCOMPANY MCHN-Order 20200707.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
BAYERCOMPANY MCHN-Order 20200707.exeBAYERCOMPANY MCHN-Order 20200707.exedescription pid process Token: SeDebugPrivilege 1360 BAYERCOMPANY MCHN-Order 20200707.exe Token: SeDebugPrivilege 1792 BAYERCOMPANY MCHN-Order 20200707.exe -
Suspicious behavior: EnumeratesProcesses 3 IoCs
Processes:
BAYERCOMPANY MCHN-Order 20200707.exepid process 1360 BAYERCOMPANY MCHN-Order 20200707.exe 1360 BAYERCOMPANY MCHN-Order 20200707.exe 1360 BAYERCOMPANY MCHN-Order 20200707.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
BAYERCOMPANY MCHN-Order 20200707.exedescription pid process target process PID 1360 set thread context of 1792 1360 BAYERCOMPANY MCHN-Order 20200707.exe BAYERCOMPANY MCHN-Order 20200707.exe -
Suspicious behavior: RenamesItself 1 IoCs
Processes:
BAYERCOMPANY MCHN-Order 20200707.exepid process 1792 BAYERCOMPANY MCHN-Order 20200707.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
Processes
-
C:\Users\Admin\AppData\Local\Temp\BAYERCOMPANY MCHN-Order 20200707.exe"C:\Users\Admin\AppData\Local\Temp\BAYERCOMPANY MCHN-Order 20200707.exe"1⤵
- Suspicious use of WriteProcessMemory
- Suspicious use of AdjustPrivilegeToken
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetThreadContext
PID:1360 -
C:\Users\Admin\AppData\Local\Temp\BAYERCOMPANY MCHN-Order 20200707.exe"{path}"2⤵PID:1368
-
C:\Users\Admin\AppData\Local\Temp\BAYERCOMPANY MCHN-Order 20200707.exe"{path}"2⤵PID:1224
-
C:\Users\Admin\AppData\Local\Temp\BAYERCOMPANY MCHN-Order 20200707.exe"{path}"2⤵PID:1800
-
C:\Users\Admin\AppData\Local\Temp\BAYERCOMPANY MCHN-Order 20200707.exe"{path}"2⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious behavior: RenamesItself
PID:1792