Analysis
-
max time kernel
141s -
max time network
130s -
platform
windows10_x64 -
resource
win10v200430 -
submitted
07-07-2020 12:10
Static task
static1
Behavioral task
behavioral1
Sample
52d1f56b7ba9fdf92db971eebca08483ce300c9c76751c3f88ba687fc1355e05.exe
Resource
win7
General
-
Target
52d1f56b7ba9fdf92db971eebca08483ce300c9c76751c3f88ba687fc1355e05.exe
-
Size
675KB
-
MD5
f6e19104e5ed3c54df87b72849134b60
-
SHA1
83089ca9e22e9f451e17104a46bcf3d73c945a31
-
SHA256
52d1f56b7ba9fdf92db971eebca08483ce300c9c76751c3f88ba687fc1355e05
-
SHA512
b43d21f8e3d150e3cb5d8d3cef51ed13d577d197f5da4a7ca658ebc9df84eb71f60e83c697472f8a0dc10c002c705ee7c39cfd524f910e10d5cafe65d0341b33
Malware Config
Extracted
lokibot
http://acpanode-sg.com/stanz/Panel/fre.php
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php
Signatures
-
Suspicious behavior: RenamesItself 1 IoCs
Processes:
52d1f56b7ba9fdf92db971eebca08483ce300c9c76751c3f88ba687fc1355e05.exepid process 2092 52d1f56b7ba9fdf92db971eebca08483ce300c9c76751c3f88ba687fc1355e05.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
52d1f56b7ba9fdf92db971eebca08483ce300c9c76751c3f88ba687fc1355e05.exepid process 4004 52d1f56b7ba9fdf92db971eebca08483ce300c9c76751c3f88ba687fc1355e05.exe 4004 52d1f56b7ba9fdf92db971eebca08483ce300c9c76751c3f88ba687fc1355e05.exe -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
52d1f56b7ba9fdf92db971eebca08483ce300c9c76751c3f88ba687fc1355e05.exedescription pid process target process PID 4004 wrote to memory of 2092 4004 52d1f56b7ba9fdf92db971eebca08483ce300c9c76751c3f88ba687fc1355e05.exe 52d1f56b7ba9fdf92db971eebca08483ce300c9c76751c3f88ba687fc1355e05.exe PID 4004 wrote to memory of 2092 4004 52d1f56b7ba9fdf92db971eebca08483ce300c9c76751c3f88ba687fc1355e05.exe 52d1f56b7ba9fdf92db971eebca08483ce300c9c76751c3f88ba687fc1355e05.exe PID 4004 wrote to memory of 2092 4004 52d1f56b7ba9fdf92db971eebca08483ce300c9c76751c3f88ba687fc1355e05.exe 52d1f56b7ba9fdf92db971eebca08483ce300c9c76751c3f88ba687fc1355e05.exe -
Suspicious behavior: MapViewOfSection 1 IoCs
Processes:
52d1f56b7ba9fdf92db971eebca08483ce300c9c76751c3f88ba687fc1355e05.exepid process 4004 52d1f56b7ba9fdf92db971eebca08483ce300c9c76751c3f88ba687fc1355e05.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
52d1f56b7ba9fdf92db971eebca08483ce300c9c76751c3f88ba687fc1355e05.exedescription pid process target process PID 4004 set thread context of 2092 4004 52d1f56b7ba9fdf92db971eebca08483ce300c9c76751c3f88ba687fc1355e05.exe 52d1f56b7ba9fdf92db971eebca08483ce300c9c76751c3f88ba687fc1355e05.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
52d1f56b7ba9fdf92db971eebca08483ce300c9c76751c3f88ba687fc1355e05.exedescription pid process Token: SeDebugPrivilege 2092 52d1f56b7ba9fdf92db971eebca08483ce300c9c76751c3f88ba687fc1355e05.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\52d1f56b7ba9fdf92db971eebca08483ce300c9c76751c3f88ba687fc1355e05.exe"C:\Users\Admin\AppData\Local\Temp\52d1f56b7ba9fdf92db971eebca08483ce300c9c76751c3f88ba687fc1355e05.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetThreadContext
PID:4004 -
C:\Users\Admin\AppData\Local\Temp\52d1f56b7ba9fdf92db971eebca08483ce300c9c76751c3f88ba687fc1355e05.exe"C:\Users\Admin\AppData\Local\Temp\52d1f56b7ba9fdf92db971eebca08483ce300c9c76751c3f88ba687fc1355e05.exe"2⤵
- Suspicious behavior: RenamesItself
- Suspicious use of AdjustPrivilegeToken
PID:2092