Analysis
-
max time kernel
61s -
max time network
46s -
platform
windows7_x64 -
resource
win7 -
submitted
07-07-2020 18:10
Static task
static1
Behavioral task
behavioral1
Sample
404f2420708cee39bb4f5c17d735a5c24a9d71efa5dc74aaedb434ff5254e72c.exe
Resource
win7
Behavioral task
behavioral2
Sample
404f2420708cee39bb4f5c17d735a5c24a9d71efa5dc74aaedb434ff5254e72c.exe
Resource
win10
General
-
Target
404f2420708cee39bb4f5c17d735a5c24a9d71efa5dc74aaedb434ff5254e72c.exe
-
Size
332KB
-
MD5
dd03071b4a17130fcff4f9fb5b4fd533
-
SHA1
8a038e1ed5dcede0207e2267890a7dc9393d28ef
-
SHA256
404f2420708cee39bb4f5c17d735a5c24a9d71efa5dc74aaedb434ff5254e72c
-
SHA512
6f94f89dda5c2e6bca2a61219cfa30631751c3dce73c375b9515fb2493ae5709be18ba23f0eb9b06cd6e2a30af50e2dbd6326c06305569bb64a75aca3f736c8e
Malware Config
Extracted
lokibot
http://195.69.140.147/.op/cr.php/xbqxHCR0T1UiD
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php
Signatures
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
404f2420708cee39bb4f5c17d735a5c24a9d71efa5dc74aaedb434ff5254e72c.exe404f2420708cee39bb4f5c17d735a5c24a9d71efa5dc74aaedb434ff5254e72c.exedescription pid process Token: SeDebugPrivilege 1588 404f2420708cee39bb4f5c17d735a5c24a9d71efa5dc74aaedb434ff5254e72c.exe Token: SeDebugPrivilege 1104 404f2420708cee39bb4f5c17d735a5c24a9d71efa5dc74aaedb434ff5254e72c.exe -
Suspicious behavior: EnumeratesProcesses 3 IoCs
Processes:
404f2420708cee39bb4f5c17d735a5c24a9d71efa5dc74aaedb434ff5254e72c.exepid process 1588 404f2420708cee39bb4f5c17d735a5c24a9d71efa5dc74aaedb434ff5254e72c.exe 1588 404f2420708cee39bb4f5c17d735a5c24a9d71efa5dc74aaedb434ff5254e72c.exe 1588 404f2420708cee39bb4f5c17d735a5c24a9d71efa5dc74aaedb434ff5254e72c.exe -
Suspicious use of WriteProcessMemory 10 IoCs
Processes:
404f2420708cee39bb4f5c17d735a5c24a9d71efa5dc74aaedb434ff5254e72c.exedescription pid process target process PID 1588 wrote to memory of 1104 1588 404f2420708cee39bb4f5c17d735a5c24a9d71efa5dc74aaedb434ff5254e72c.exe 404f2420708cee39bb4f5c17d735a5c24a9d71efa5dc74aaedb434ff5254e72c.exe PID 1588 wrote to memory of 1104 1588 404f2420708cee39bb4f5c17d735a5c24a9d71efa5dc74aaedb434ff5254e72c.exe 404f2420708cee39bb4f5c17d735a5c24a9d71efa5dc74aaedb434ff5254e72c.exe PID 1588 wrote to memory of 1104 1588 404f2420708cee39bb4f5c17d735a5c24a9d71efa5dc74aaedb434ff5254e72c.exe 404f2420708cee39bb4f5c17d735a5c24a9d71efa5dc74aaedb434ff5254e72c.exe PID 1588 wrote to memory of 1104 1588 404f2420708cee39bb4f5c17d735a5c24a9d71efa5dc74aaedb434ff5254e72c.exe 404f2420708cee39bb4f5c17d735a5c24a9d71efa5dc74aaedb434ff5254e72c.exe PID 1588 wrote to memory of 1104 1588 404f2420708cee39bb4f5c17d735a5c24a9d71efa5dc74aaedb434ff5254e72c.exe 404f2420708cee39bb4f5c17d735a5c24a9d71efa5dc74aaedb434ff5254e72c.exe PID 1588 wrote to memory of 1104 1588 404f2420708cee39bb4f5c17d735a5c24a9d71efa5dc74aaedb434ff5254e72c.exe 404f2420708cee39bb4f5c17d735a5c24a9d71efa5dc74aaedb434ff5254e72c.exe PID 1588 wrote to memory of 1104 1588 404f2420708cee39bb4f5c17d735a5c24a9d71efa5dc74aaedb434ff5254e72c.exe 404f2420708cee39bb4f5c17d735a5c24a9d71efa5dc74aaedb434ff5254e72c.exe PID 1588 wrote to memory of 1104 1588 404f2420708cee39bb4f5c17d735a5c24a9d71efa5dc74aaedb434ff5254e72c.exe 404f2420708cee39bb4f5c17d735a5c24a9d71efa5dc74aaedb434ff5254e72c.exe PID 1588 wrote to memory of 1104 1588 404f2420708cee39bb4f5c17d735a5c24a9d71efa5dc74aaedb434ff5254e72c.exe 404f2420708cee39bb4f5c17d735a5c24a9d71efa5dc74aaedb434ff5254e72c.exe PID 1588 wrote to memory of 1104 1588 404f2420708cee39bb4f5c17d735a5c24a9d71efa5dc74aaedb434ff5254e72c.exe 404f2420708cee39bb4f5c17d735a5c24a9d71efa5dc74aaedb434ff5254e72c.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
404f2420708cee39bb4f5c17d735a5c24a9d71efa5dc74aaedb434ff5254e72c.exedescription pid process target process PID 1588 set thread context of 1104 1588 404f2420708cee39bb4f5c17d735a5c24a9d71efa5dc74aaedb434ff5254e72c.exe 404f2420708cee39bb4f5c17d735a5c24a9d71efa5dc74aaedb434ff5254e72c.exe -
Suspicious behavior: RenamesItself 1 IoCs
Processes:
404f2420708cee39bb4f5c17d735a5c24a9d71efa5dc74aaedb434ff5254e72c.exepid process 1104 404f2420708cee39bb4f5c17d735a5c24a9d71efa5dc74aaedb434ff5254e72c.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\404f2420708cee39bb4f5c17d735a5c24a9d71efa5dc74aaedb434ff5254e72c.exe"C:\Users\Admin\AppData\Local\Temp\404f2420708cee39bb4f5c17d735a5c24a9d71efa5dc74aaedb434ff5254e72c.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
- Suspicious use of SetThreadContext
-
C:\Users\Admin\AppData\Local\Temp\404f2420708cee39bb4f5c17d735a5c24a9d71efa5dc74aaedb434ff5254e72c.exe"C:\Users\Admin\AppData\Local\Temp\404f2420708cee39bb4f5c17d735a5c24a9d71efa5dc74aaedb434ff5254e72c.exe"2⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious behavior: RenamesItself