Analysis
-
max time kernel
138s -
max time network
76s -
platform
windows7_x64 -
resource
win7v200430 -
submitted
07-07-2020 06:09
Static task
static1
Behavioral task
behavioral1
Sample
4e4feb5f1bba50c6f1c97791119d8ee28afb3d8d390ee6cf92da7e929d97dd5c.exe
Resource
win7v200430
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
4e4feb5f1bba50c6f1c97791119d8ee28afb3d8d390ee6cf92da7e929d97dd5c.exe
Resource
win10
windows10_x64
0 signatures
0 seconds
General
-
Target
4e4feb5f1bba50c6f1c97791119d8ee28afb3d8d390ee6cf92da7e929d97dd5c.exe
-
Size
287KB
-
MD5
b64bad63393a769438902dcbbf5e5ced
-
SHA1
f9d21a97881ccab02a07fefd34afc2685f21e2b0
-
SHA256
4e4feb5f1bba50c6f1c97791119d8ee28afb3d8d390ee6cf92da7e929d97dd5c
-
SHA512
8014acf1022bdb56d95b1da5c189a53090c72123de48f11d5fce3954867a376837bb66f8d1b87e654793a354911a15b0e98a97a338ff6050884331d00552e7d6
Score
10/10
Malware Config
Extracted
Family
lokibot
C2
http://modevin.ga/~zadmin/lmark/frega3/mode.php
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php
Signatures
-
Loads dropped DLL 1 IoCs
pid Process 1440 rundll32.exe -
Suspicious behavior: MapViewOfSection 1 IoCs
pid Process 1440 rundll32.exe -
Modifies service 2 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\EventLog\Application\Tipping 4e4feb5f1bba50c6f1c97791119d8ee28afb3d8d390ee6cf92da7e929d97dd5c.exe Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\eventlog\Application\Tipping\lang 4e4feb5f1bba50c6f1c97791119d8ee28afb3d8d390ee6cf92da7e929d97dd5c.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Suspicious use of WriteProcessMemory 47 IoCs
description pid Process procid_target PID 1304 wrote to memory of 1440 1304 4e4feb5f1bba50c6f1c97791119d8ee28afb3d8d390ee6cf92da7e929d97dd5c.exe 24 PID 1304 wrote to memory of 1440 1304 4e4feb5f1bba50c6f1c97791119d8ee28afb3d8d390ee6cf92da7e929d97dd5c.exe 24 PID 1304 wrote to memory of 1440 1304 4e4feb5f1bba50c6f1c97791119d8ee28afb3d8d390ee6cf92da7e929d97dd5c.exe 24 PID 1304 wrote to memory of 1440 1304 4e4feb5f1bba50c6f1c97791119d8ee28afb3d8d390ee6cf92da7e929d97dd5c.exe 24 PID 1304 wrote to memory of 1440 1304 4e4feb5f1bba50c6f1c97791119d8ee28afb3d8d390ee6cf92da7e929d97dd5c.exe 24 PID 1304 wrote to memory of 1440 1304 4e4feb5f1bba50c6f1c97791119d8ee28afb3d8d390ee6cf92da7e929d97dd5c.exe 24 PID 1304 wrote to memory of 1440 1304 4e4feb5f1bba50c6f1c97791119d8ee28afb3d8d390ee6cf92da7e929d97dd5c.exe 24 PID 1440 wrote to memory of 604 1440 rundll32.exe 25 PID 1440 wrote to memory of 604 1440 rundll32.exe 25 PID 1440 wrote to memory of 604 1440 rundll32.exe 25 PID 1440 wrote to memory of 604 1440 rundll32.exe 25 PID 1440 wrote to memory of 604 1440 rundll32.exe 25 PID 1440 wrote to memory of 604 1440 rundll32.exe 25 PID 1440 wrote to memory of 604 1440 rundll32.exe 25 PID 1440 wrote to memory of 604 1440 rundll32.exe 25 PID 1440 wrote to memory of 604 1440 rundll32.exe 25 PID 1440 wrote to memory of 604 1440 rundll32.exe 25 PID 1440 wrote to memory of 604 1440 rundll32.exe 25 PID 1440 wrote to memory of 604 1440 rundll32.exe 25 PID 1440 wrote to memory of 604 1440 rundll32.exe 25 PID 1440 wrote to memory of 604 1440 rundll32.exe 25 PID 1440 wrote to memory of 604 1440 rundll32.exe 25 PID 1440 wrote to memory of 604 1440 rundll32.exe 25 PID 1440 wrote to memory of 604 1440 rundll32.exe 25 PID 1440 wrote to memory of 604 1440 rundll32.exe 25 PID 1440 wrote to memory of 604 1440 rundll32.exe 25 PID 1440 wrote to memory of 604 1440 rundll32.exe 25 PID 1440 wrote to memory of 604 1440 rundll32.exe 25 PID 1440 wrote to memory of 604 1440 rundll32.exe 25 PID 1440 wrote to memory of 604 1440 rundll32.exe 25 PID 1440 wrote to memory of 604 1440 rundll32.exe 25 PID 1440 wrote to memory of 604 1440 rundll32.exe 25 PID 1440 wrote to memory of 604 1440 rundll32.exe 25 PID 1440 wrote to memory of 604 1440 rundll32.exe 25 PID 1440 wrote to memory of 604 1440 rundll32.exe 25 PID 1440 wrote to memory of 604 1440 rundll32.exe 25 PID 1440 wrote to memory of 604 1440 rundll32.exe 25 PID 1440 wrote to memory of 604 1440 rundll32.exe 25 PID 1440 wrote to memory of 604 1440 rundll32.exe 25 PID 1440 wrote to memory of 604 1440 rundll32.exe 25 PID 1440 wrote to memory of 604 1440 rundll32.exe 25 PID 1440 wrote to memory of 604 1440 rundll32.exe 25 PID 1440 wrote to memory of 604 1440 rundll32.exe 25 PID 1440 wrote to memory of 604 1440 rundll32.exe 25 PID 1440 wrote to memory of 604 1440 rundll32.exe 25 PID 1440 wrote to memory of 604 1440 rundll32.exe 25 PID 1440 wrote to memory of 604 1440 rundll32.exe 25 -
Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 1440 rundll32.exe -
Blacklisted process makes network request 4 IoCs
flow pid Process 4 604 cmd.exe 5 604 cmd.exe 6 604 cmd.exe 7 604 cmd.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 604 cmd.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\4e4feb5f1bba50c6f1c97791119d8ee28afb3d8d390ee6cf92da7e929d97dd5c.exe"C:\Users\Admin\AppData\Local\Temp\4e4feb5f1bba50c6f1c97791119d8ee28afb3d8d390ee6cf92da7e929d97dd5c.exe"1⤵
- Modifies service
- Suspicious use of WriteProcessMemory
PID:1304 -
C:\Windows\SysWOW64\rundll32.exeC:\Windows\system32\rundll32.exe Barracoon,Hemlock2⤵
- Loads dropped DLL
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
- Suspicious behavior: EnumeratesProcesses
PID:1440 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe"3⤵
- Blacklisted process makes network request
- Suspicious use of AdjustPrivilegeToken
PID:604
-
-