Analysis
-
max time kernel
126s -
max time network
146s -
platform
windows10_x64 -
resource
win10v200430 -
submitted
09-07-2020 07:29
Static task
static1
Behavioral task
behavioral1
Sample
e8d966948ddbb6417ad48cdebd00283c.exe
Resource
win7
General
-
Target
e8d966948ddbb6417ad48cdebd00283c.exe
-
Size
829KB
-
MD5
e8d966948ddbb6417ad48cdebd00283c
-
SHA1
2ab63cf6275cf2a3252aebd82d77109444522f20
-
SHA256
32bd55dea43d23447a44243dd33e4b29d88580a8dbaac2e6c15feec05b27ce1d
-
SHA512
2ce6d60c57ce3d0be3f6bee224b855b7204fd22fb11af727eddad1ada97cbd135bbcbd27db358217688f1ce173465906212764d395a4bf38c35e6c0260d37068
Malware Config
Extracted
lokibot
http://emdadbimarz.ir/huhn/fre.php
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php
Signatures
-
Suspicious use of SetThreadContext 1 IoCs
Processes:
e8d966948ddbb6417ad48cdebd00283c.exedescription pid process target process PID 1164 set thread context of 1256 1164 e8d966948ddbb6417ad48cdebd00283c.exe e8d966948ddbb6417ad48cdebd00283c.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
e8d966948ddbb6417ad48cdebd00283c.exedescription pid process Token: SeDebugPrivilege 1256 e8d966948ddbb6417ad48cdebd00283c.exe -
Suspicious behavior: RenamesItself 1 IoCs
Processes:
e8d966948ddbb6417ad48cdebd00283c.exepid process 1256 e8d966948ddbb6417ad48cdebd00283c.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
e8d966948ddbb6417ad48cdebd00283c.exepid process 1164 e8d966948ddbb6417ad48cdebd00283c.exe 1164 e8d966948ddbb6417ad48cdebd00283c.exe -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
e8d966948ddbb6417ad48cdebd00283c.exedescription pid process target process PID 1164 wrote to memory of 1256 1164 e8d966948ddbb6417ad48cdebd00283c.exe e8d966948ddbb6417ad48cdebd00283c.exe PID 1164 wrote to memory of 1256 1164 e8d966948ddbb6417ad48cdebd00283c.exe e8d966948ddbb6417ad48cdebd00283c.exe PID 1164 wrote to memory of 1256 1164 e8d966948ddbb6417ad48cdebd00283c.exe e8d966948ddbb6417ad48cdebd00283c.exe -
Suspicious behavior: MapViewOfSection 1 IoCs
Processes:
e8d966948ddbb6417ad48cdebd00283c.exepid process 1164 e8d966948ddbb6417ad48cdebd00283c.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\e8d966948ddbb6417ad48cdebd00283c.exe"C:\Users\Admin\AppData\Local\Temp\e8d966948ddbb6417ad48cdebd00283c.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
- Suspicious behavior: MapViewOfSection
-
C:\Users\Admin\AppData\Local\Temp\e8d966948ddbb6417ad48cdebd00283c.exe"C:\Users\Admin\AppData\Local\Temp\e8d966948ddbb6417ad48cdebd00283c.exe"2⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious behavior: RenamesItself