Analysis
-
max time kernel
146s -
max time network
107s -
platform
windows10_x64 -
resource
win10v200430 -
submitted
09-07-2020 10:15
Static task
static1
Behavioral task
behavioral1
Sample
ca56935bb84dfd978fe1702cd53aa045b25b9597324817d4e036fd6ad581dc3b.exe
Resource
win7
General
-
Target
ca56935bb84dfd978fe1702cd53aa045b25b9597324817d4e036fd6ad581dc3b.exe
-
Size
605KB
-
MD5
1f3eed5fce32227de318e3affc9f80d2
-
SHA1
e687b5b570cf6acb62eb52783ca9eeaebc2f33ae
-
SHA256
ca56935bb84dfd978fe1702cd53aa045b25b9597324817d4e036fd6ad581dc3b
-
SHA512
41fc57a5a7d420ab86514a16a85846377646ea5f13296cd90a65cd739b0fb67db1bdf8c272a1f193955f091d05cafa2bc15aa8932129627f72f530d728d9572d
Malware Config
Extracted
lokibot
http://abidjiaintl.ml/sethr/logs/fre.php
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php
Signatures
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
ca56935bb84dfd978fe1702cd53aa045b25b9597324817d4e036fd6ad581dc3b.exepid process 2612 ca56935bb84dfd978fe1702cd53aa045b25b9597324817d4e036fd6ad581dc3b.exe 2612 ca56935bb84dfd978fe1702cd53aa045b25b9597324817d4e036fd6ad581dc3b.exe -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
ca56935bb84dfd978fe1702cd53aa045b25b9597324817d4e036fd6ad581dc3b.exedescription pid process target process PID 2612 wrote to memory of 4088 2612 ca56935bb84dfd978fe1702cd53aa045b25b9597324817d4e036fd6ad581dc3b.exe ca56935bb84dfd978fe1702cd53aa045b25b9597324817d4e036fd6ad581dc3b.exe PID 2612 wrote to memory of 4088 2612 ca56935bb84dfd978fe1702cd53aa045b25b9597324817d4e036fd6ad581dc3b.exe ca56935bb84dfd978fe1702cd53aa045b25b9597324817d4e036fd6ad581dc3b.exe PID 2612 wrote to memory of 4088 2612 ca56935bb84dfd978fe1702cd53aa045b25b9597324817d4e036fd6ad581dc3b.exe ca56935bb84dfd978fe1702cd53aa045b25b9597324817d4e036fd6ad581dc3b.exe -
Suspicious behavior: MapViewOfSection 1 IoCs
Processes:
ca56935bb84dfd978fe1702cd53aa045b25b9597324817d4e036fd6ad581dc3b.exepid process 2612 ca56935bb84dfd978fe1702cd53aa045b25b9597324817d4e036fd6ad581dc3b.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
ca56935bb84dfd978fe1702cd53aa045b25b9597324817d4e036fd6ad581dc3b.exedescription pid process target process PID 2612 set thread context of 4088 2612 ca56935bb84dfd978fe1702cd53aa045b25b9597324817d4e036fd6ad581dc3b.exe ca56935bb84dfd978fe1702cd53aa045b25b9597324817d4e036fd6ad581dc3b.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
ca56935bb84dfd978fe1702cd53aa045b25b9597324817d4e036fd6ad581dc3b.exedescription pid process Token: SeDebugPrivilege 4088 ca56935bb84dfd978fe1702cd53aa045b25b9597324817d4e036fd6ad581dc3b.exe -
Suspicious behavior: RenamesItself 1 IoCs
Processes:
ca56935bb84dfd978fe1702cd53aa045b25b9597324817d4e036fd6ad581dc3b.exepid process 4088 ca56935bb84dfd978fe1702cd53aa045b25b9597324817d4e036fd6ad581dc3b.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
Processes
-
C:\Users\Admin\AppData\Local\Temp\ca56935bb84dfd978fe1702cd53aa045b25b9597324817d4e036fd6ad581dc3b.exe"C:\Users\Admin\AppData\Local\Temp\ca56935bb84dfd978fe1702cd53aa045b25b9597324817d4e036fd6ad581dc3b.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetThreadContext
PID:2612 -
C:\Users\Admin\AppData\Local\Temp\ca56935bb84dfd978fe1702cd53aa045b25b9597324817d4e036fd6ad581dc3b.exe"C:\Users\Admin\AppData\Local\Temp\ca56935bb84dfd978fe1702cd53aa045b25b9597324817d4e036fd6ad581dc3b.exe"2⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious behavior: RenamesItself
PID:4088