Analysis
-
max time kernel
92s -
max time network
110s -
platform
windows10_x64 -
resource
win10 -
submitted
07-07-2020 06:09
Static task
static1
Behavioral task
behavioral1
Sample
4e4feb5f1bba50c6f1c97791119d8ee28afb3d8d390ee6cf92da7e929d97dd5c.exe
Resource
win7v200430
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
4e4feb5f1bba50c6f1c97791119d8ee28afb3d8d390ee6cf92da7e929d97dd5c.exe
Resource
win10
windows10_x64
0 signatures
0 seconds
General
-
Target
4e4feb5f1bba50c6f1c97791119d8ee28afb3d8d390ee6cf92da7e929d97dd5c.exe
-
Size
287KB
-
MD5
b64bad63393a769438902dcbbf5e5ced
-
SHA1
f9d21a97881ccab02a07fefd34afc2685f21e2b0
-
SHA256
4e4feb5f1bba50c6f1c97791119d8ee28afb3d8d390ee6cf92da7e929d97dd5c
-
SHA512
8014acf1022bdb56d95b1da5c189a53090c72123de48f11d5fce3954867a376837bb66f8d1b87e654793a354911a15b0e98a97a338ff6050884331d00552e7d6
Score
10/10
Malware Config
Extracted
Family
lokibot
C2
http://modevin.ga/~zadmin/lmark/frega3/mode.php
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php
Signatures
-
Suspicious use of WriteProcessMemory 86 IoCs
description pid Process procid_target PID 3020 wrote to memory of 3812 3020 4e4feb5f1bba50c6f1c97791119d8ee28afb3d8d390ee6cf92da7e929d97dd5c.exe 67 PID 3020 wrote to memory of 3812 3020 4e4feb5f1bba50c6f1c97791119d8ee28afb3d8d390ee6cf92da7e929d97dd5c.exe 67 PID 3020 wrote to memory of 3812 3020 4e4feb5f1bba50c6f1c97791119d8ee28afb3d8d390ee6cf92da7e929d97dd5c.exe 67 PID 3812 wrote to memory of 3612 3812 rundll32.exe 68 PID 3812 wrote to memory of 3612 3812 rundll32.exe 68 PID 3812 wrote to memory of 3612 3812 rundll32.exe 68 PID 3812 wrote to memory of 3612 3812 rundll32.exe 68 PID 3812 wrote to memory of 3928 3812 rundll32.exe 69 PID 3812 wrote to memory of 3928 3812 rundll32.exe 69 PID 3812 wrote to memory of 3928 3812 rundll32.exe 69 PID 3812 wrote to memory of 3928 3812 rundll32.exe 69 PID 3812 wrote to memory of 3928 3812 rundll32.exe 69 PID 3812 wrote to memory of 3928 3812 rundll32.exe 69 PID 3812 wrote to memory of 3928 3812 rundll32.exe 69 PID 3812 wrote to memory of 3928 3812 rundll32.exe 69 PID 3812 wrote to memory of 3928 3812 rundll32.exe 69 PID 3812 wrote to memory of 3928 3812 rundll32.exe 69 PID 3812 wrote to memory of 3928 3812 rundll32.exe 69 PID 3812 wrote to memory of 3928 3812 rundll32.exe 69 PID 3812 wrote to memory of 3928 3812 rundll32.exe 69 PID 3812 wrote to memory of 3928 3812 rundll32.exe 69 PID 3812 wrote to memory of 3928 3812 rundll32.exe 69 PID 3812 wrote to memory of 3928 3812 rundll32.exe 69 PID 3812 wrote to memory of 3928 3812 rundll32.exe 69 PID 3812 wrote to memory of 3928 3812 rundll32.exe 69 PID 3812 wrote to memory of 3928 3812 rundll32.exe 69 PID 3812 wrote to memory of 3928 3812 rundll32.exe 69 PID 3812 wrote to memory of 3928 3812 rundll32.exe 69 PID 3812 wrote to memory of 3928 3812 rundll32.exe 69 PID 3812 wrote to memory of 3928 3812 rundll32.exe 69 PID 3812 wrote to memory of 3928 3812 rundll32.exe 69 PID 3812 wrote to memory of 3928 3812 rundll32.exe 69 PID 3812 wrote to memory of 3928 3812 rundll32.exe 69 PID 3812 wrote to memory of 3928 3812 rundll32.exe 69 PID 3812 wrote to memory of 3928 3812 rundll32.exe 69 PID 3812 wrote to memory of 3928 3812 rundll32.exe 69 PID 3812 wrote to memory of 3928 3812 rundll32.exe 69 PID 3812 wrote to memory of 3928 3812 rundll32.exe 69 PID 3812 wrote to memory of 3928 3812 rundll32.exe 69 PID 3812 wrote to memory of 3928 3812 rundll32.exe 69 PID 3812 wrote to memory of 3928 3812 rundll32.exe 69 PID 3812 wrote to memory of 3928 3812 rundll32.exe 69 PID 3812 wrote to memory of 3928 3812 rundll32.exe 69 PID 3812 wrote to memory of 3928 3812 rundll32.exe 69 PID 3812 wrote to memory of 3928 3812 rundll32.exe 69 PID 3812 wrote to memory of 3928 3812 rundll32.exe 69 PID 3812 wrote to memory of 3928 3812 rundll32.exe 69 PID 3812 wrote to memory of 3928 3812 rundll32.exe 69 PID 3812 wrote to memory of 3928 3812 rundll32.exe 69 PID 3812 wrote to memory of 3928 3812 rundll32.exe 69 PID 3812 wrote to memory of 3928 3812 rundll32.exe 69 PID 3812 wrote to memory of 3928 3812 rundll32.exe 69 PID 3812 wrote to memory of 3928 3812 rundll32.exe 69 PID 3812 wrote to memory of 3928 3812 rundll32.exe 69 PID 3812 wrote to memory of 3928 3812 rundll32.exe 69 PID 3812 wrote to memory of 3928 3812 rundll32.exe 69 PID 3812 wrote to memory of 3928 3812 rundll32.exe 69 PID 3812 wrote to memory of 3928 3812 rundll32.exe 69 PID 3812 wrote to memory of 3928 3812 rundll32.exe 69 PID 3812 wrote to memory of 3928 3812 rundll32.exe 69 PID 3812 wrote to memory of 3928 3812 rundll32.exe 69 PID 3812 wrote to memory of 3928 3812 rundll32.exe 69 PID 3812 wrote to memory of 3928 3812 rundll32.exe 69 PID 3812 wrote to memory of 3928 3812 rundll32.exe 69 PID 3812 wrote to memory of 3928 3812 rundll32.exe 69 PID 3812 wrote to memory of 3928 3812 rundll32.exe 69 PID 3812 wrote to memory of 3928 3812 rundll32.exe 69 PID 3812 wrote to memory of 3928 3812 rundll32.exe 69 PID 3812 wrote to memory of 3928 3812 rundll32.exe 69 PID 3812 wrote to memory of 3928 3812 rundll32.exe 69 PID 3812 wrote to memory of 3928 3812 rundll32.exe 69 PID 3812 wrote to memory of 3928 3812 rundll32.exe 69 PID 3812 wrote to memory of 3928 3812 rundll32.exe 69 PID 3812 wrote to memory of 3928 3812 rundll32.exe 69 PID 3812 wrote to memory of 3928 3812 rundll32.exe 69 PID 3812 wrote to memory of 3928 3812 rundll32.exe 69 PID 3812 wrote to memory of 3928 3812 rundll32.exe 69 PID 3812 wrote to memory of 3928 3812 rundll32.exe 69 PID 3812 wrote to memory of 3928 3812 rundll32.exe 69 PID 3812 wrote to memory of 3928 3812 rundll32.exe 69 PID 3812 wrote to memory of 3928 3812 rundll32.exe 69 PID 3812 wrote to memory of 3928 3812 rundll32.exe 69 PID 3812 wrote to memory of 3928 3812 rundll32.exe 69 PID 3812 wrote to memory of 3928 3812 rundll32.exe 69 PID 3812 wrote to memory of 3928 3812 rundll32.exe 69 PID 3812 wrote to memory of 3928 3812 rundll32.exe 69 -
Loads dropped DLL 1 IoCs
pid Process 3812 rundll32.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 3928 cmd.exe -
Modifies service 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\EventLog\Application\Tipping\lang 4e4feb5f1bba50c6f1c97791119d8ee28afb3d8d390ee6cf92da7e929d97dd5c.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\EventLog\Application\Tipping 4e4feb5f1bba50c6f1c97791119d8ee28afb3d8d390ee6cf92da7e929d97dd5c.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 3812 rundll32.exe 3812 rundll32.exe -
Suspicious behavior: MapViewOfSection 2 IoCs
pid Process 3812 rundll32.exe 3812 rundll32.exe -
Blacklisted process makes network request 4 IoCs
flow pid Process 4 3928 cmd.exe 5 3928 cmd.exe 6 3928 cmd.exe 12 3928 cmd.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
Processes
-
C:\Users\Admin\AppData\Local\Temp\4e4feb5f1bba50c6f1c97791119d8ee28afb3d8d390ee6cf92da7e929d97dd5c.exe"C:\Users\Admin\AppData\Local\Temp\4e4feb5f1bba50c6f1c97791119d8ee28afb3d8d390ee6cf92da7e929d97dd5c.exe"1⤵
- Suspicious use of WriteProcessMemory
- Modifies service
PID:3020 -
C:\Windows\SysWOW64\rundll32.exeC:\Windows\system32\rundll32.exe Barracoon,Hemlock2⤵
- Suspicious use of WriteProcessMemory
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:3812 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe"3⤵PID:3612
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe"3⤵
- Suspicious use of AdjustPrivilegeToken
- Blacklisted process makes network request
PID:3928
-
-