Analysis
-
max time kernel
138s -
max time network
32s -
platform
windows7_x64 -
resource
win7v200430 -
submitted
08-07-2020 06:57
Static task
static1
Behavioral task
behavioral1
Sample
NEW INQUIRY PURCHASE ORDER.exe
Resource
win7v200430
General
-
Target
NEW INQUIRY PURCHASE ORDER.exe
-
Size
607KB
-
MD5
05e06166f7767f1c3d34ad3e4ab3009f
-
SHA1
a7eaac1d28e5453cfb594977df91ee24ce357195
-
SHA256
3c4ed32a41025d81f99706a778597aa3dcef8034e81746e04ef197f37e7a25e8
-
SHA512
f902f9819ba394c2e39b281e159441f6cda6275984bd311971674af991b09ca8797ae9ee32c2e9649641558b2521b18ddb012429f15d91395e498df214517a00
Malware Config
Extracted
lokibot
http://195.69.140.147/.op/cr.php/u1DEZ4oVQPK3w
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php
Signatures
-
Suspicious behavior: MapViewOfSection 1 IoCs
Processes:
NEW INQUIRY PURCHASE ORDER.exepid process 1032 NEW INQUIRY PURCHASE ORDER.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
NEW INQUIRY PURCHASE ORDER.exedescription pid process target process PID 1032 set thread context of 1004 1032 NEW INQUIRY PURCHASE ORDER.exe NEW INQUIRY PURCHASE ORDER.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
NEW INQUIRY PURCHASE ORDER.exedescription pid process Token: SeDebugPrivilege 1004 NEW INQUIRY PURCHASE ORDER.exe -
Suspicious behavior: RenamesItself 1 IoCs
Processes:
NEW INQUIRY PURCHASE ORDER.exepid process 1004 NEW INQUIRY PURCHASE ORDER.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
NEW INQUIRY PURCHASE ORDER.exepid process 1032 NEW INQUIRY PURCHASE ORDER.exe -
Suspicious use of WriteProcessMemory 4 IoCs
Processes:
NEW INQUIRY PURCHASE ORDER.exedescription pid process target process PID 1032 wrote to memory of 1004 1032 NEW INQUIRY PURCHASE ORDER.exe NEW INQUIRY PURCHASE ORDER.exe PID 1032 wrote to memory of 1004 1032 NEW INQUIRY PURCHASE ORDER.exe NEW INQUIRY PURCHASE ORDER.exe PID 1032 wrote to memory of 1004 1032 NEW INQUIRY PURCHASE ORDER.exe NEW INQUIRY PURCHASE ORDER.exe PID 1032 wrote to memory of 1004 1032 NEW INQUIRY PURCHASE ORDER.exe NEW INQUIRY PURCHASE ORDER.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\NEW INQUIRY PURCHASE ORDER.exe"C:\Users\Admin\AppData\Local\Temp\NEW INQUIRY PURCHASE ORDER.exe"1⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\NEW INQUIRY PURCHASE ORDER.exe"C:\Users\Admin\AppData\Local\Temp\NEW INQUIRY PURCHASE ORDER.exe"2⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious behavior: RenamesItself