Analysis
-
max time kernel
124s -
max time network
120s -
platform
windows7_x64 -
resource
win7 -
submitted
07-07-2020 12:10
Static task
static1
Behavioral task
behavioral1
Sample
52d1f56b7ba9fdf92db971eebca08483ce300c9c76751c3f88ba687fc1355e05.exe
Resource
win7
General
-
Target
52d1f56b7ba9fdf92db971eebca08483ce300c9c76751c3f88ba687fc1355e05.exe
-
Size
675KB
-
MD5
f6e19104e5ed3c54df87b72849134b60
-
SHA1
83089ca9e22e9f451e17104a46bcf3d73c945a31
-
SHA256
52d1f56b7ba9fdf92db971eebca08483ce300c9c76751c3f88ba687fc1355e05
-
SHA512
b43d21f8e3d150e3cb5d8d3cef51ed13d577d197f5da4a7ca658ebc9df84eb71f60e83c697472f8a0dc10c002c705ee7c39cfd524f910e10d5cafe65d0341b33
Malware Config
Extracted
lokibot
http://acpanode-sg.com/stanz/Panel/fre.php
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php
Signatures
-
Suspicious behavior: MapViewOfSection 1 IoCs
Processes:
52d1f56b7ba9fdf92db971eebca08483ce300c9c76751c3f88ba687fc1355e05.exepid process 240 52d1f56b7ba9fdf92db971eebca08483ce300c9c76751c3f88ba687fc1355e05.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
52d1f56b7ba9fdf92db971eebca08483ce300c9c76751c3f88ba687fc1355e05.exedescription pid process target process PID 240 set thread context of 820 240 52d1f56b7ba9fdf92db971eebca08483ce300c9c76751c3f88ba687fc1355e05.exe 52d1f56b7ba9fdf92db971eebca08483ce300c9c76751c3f88ba687fc1355e05.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
52d1f56b7ba9fdf92db971eebca08483ce300c9c76751c3f88ba687fc1355e05.exedescription pid process Token: SeDebugPrivilege 820 52d1f56b7ba9fdf92db971eebca08483ce300c9c76751c3f88ba687fc1355e05.exe -
Suspicious behavior: RenamesItself 1 IoCs
Processes:
52d1f56b7ba9fdf92db971eebca08483ce300c9c76751c3f88ba687fc1355e05.exepid process 820 52d1f56b7ba9fdf92db971eebca08483ce300c9c76751c3f88ba687fc1355e05.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
52d1f56b7ba9fdf92db971eebca08483ce300c9c76751c3f88ba687fc1355e05.exepid process 240 52d1f56b7ba9fdf92db971eebca08483ce300c9c76751c3f88ba687fc1355e05.exe -
Suspicious use of WriteProcessMemory 4 IoCs
Processes:
52d1f56b7ba9fdf92db971eebca08483ce300c9c76751c3f88ba687fc1355e05.exedescription pid process target process PID 240 wrote to memory of 820 240 52d1f56b7ba9fdf92db971eebca08483ce300c9c76751c3f88ba687fc1355e05.exe 52d1f56b7ba9fdf92db971eebca08483ce300c9c76751c3f88ba687fc1355e05.exe PID 240 wrote to memory of 820 240 52d1f56b7ba9fdf92db971eebca08483ce300c9c76751c3f88ba687fc1355e05.exe 52d1f56b7ba9fdf92db971eebca08483ce300c9c76751c3f88ba687fc1355e05.exe PID 240 wrote to memory of 820 240 52d1f56b7ba9fdf92db971eebca08483ce300c9c76751c3f88ba687fc1355e05.exe 52d1f56b7ba9fdf92db971eebca08483ce300c9c76751c3f88ba687fc1355e05.exe PID 240 wrote to memory of 820 240 52d1f56b7ba9fdf92db971eebca08483ce300c9c76751c3f88ba687fc1355e05.exe 52d1f56b7ba9fdf92db971eebca08483ce300c9c76751c3f88ba687fc1355e05.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\52d1f56b7ba9fdf92db971eebca08483ce300c9c76751c3f88ba687fc1355e05.exe"C:\Users\Admin\AppData\Local\Temp\52d1f56b7ba9fdf92db971eebca08483ce300c9c76751c3f88ba687fc1355e05.exe"1⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\52d1f56b7ba9fdf92db971eebca08483ce300c9c76751c3f88ba687fc1355e05.exe"C:\Users\Admin\AppData\Local\Temp\52d1f56b7ba9fdf92db971eebca08483ce300c9c76751c3f88ba687fc1355e05.exe"2⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious behavior: RenamesItself