Analysis
-
max time kernel
124s -
max time network
147s -
platform
windows10_x64 -
resource
win10v200430 -
submitted
09/07/2020, 15:02
Static task
static1
Behavioral task
behavioral1
Sample
Invoice_628377382.exe
Resource
win7
windows7_x64
0 signatures
0 seconds
General
-
Target
Invoice_628377382.exe
-
Size
298KB
-
MD5
cf84bcaee07c71ce84e017806ceb559a
-
SHA1
6c67c7f67d30edb25720f3742f6e9ae29a9b8589
-
SHA256
32585e3a92b96a490c87874d90a262dc0cc814617d9f5c8721c6c54d98385b6d
-
SHA512
a83e620875d5532f4c899bd4ef6f6dcb1d135c4e7d47aec641f7f26325a662164417188c1803cd01f7eac6be81fcd74cebf90813aa9028e1026b606677c5fb6e
Malware Config
Extracted
Family
lokibot
C2
http://modevin.ga/~zadmin/lmark/frega2/mode.php
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php
Signatures
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 1460 cmd.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Loads dropped DLL 2 IoCs
pid Process 3812 Invoice_628377382.exe 1212 rundll32.exe -
Suspicious use of WriteProcessMemory 82 IoCs
description pid Process procid_target PID 3812 wrote to memory of 1212 3812 Invoice_628377382.exe 68 PID 3812 wrote to memory of 1212 3812 Invoice_628377382.exe 68 PID 3812 wrote to memory of 1212 3812 Invoice_628377382.exe 68 PID 1212 wrote to memory of 1460 1212 rundll32.exe 69 PID 1212 wrote to memory of 1460 1212 rundll32.exe 69 PID 1212 wrote to memory of 1460 1212 rundll32.exe 69 PID 1212 wrote to memory of 1460 1212 rundll32.exe 69 PID 1212 wrote to memory of 1460 1212 rundll32.exe 69 PID 1212 wrote to memory of 1460 1212 rundll32.exe 69 PID 1212 wrote to memory of 1460 1212 rundll32.exe 69 PID 1212 wrote to memory of 1460 1212 rundll32.exe 69 PID 1212 wrote to memory of 1460 1212 rundll32.exe 69 PID 1212 wrote to memory of 1460 1212 rundll32.exe 69 PID 1212 wrote to memory of 1460 1212 rundll32.exe 69 PID 1212 wrote to memory of 1460 1212 rundll32.exe 69 PID 1212 wrote to memory of 1460 1212 rundll32.exe 69 PID 1212 wrote to memory of 1460 1212 rundll32.exe 69 PID 1212 wrote to memory of 1460 1212 rundll32.exe 69 PID 1212 wrote to memory of 1460 1212 rundll32.exe 69 PID 1212 wrote to memory of 1460 1212 rundll32.exe 69 PID 1212 wrote to memory of 1460 1212 rundll32.exe 69 PID 1212 wrote to memory of 1460 1212 rundll32.exe 69 PID 1212 wrote to memory of 1460 1212 rundll32.exe 69 PID 1212 wrote to memory of 1460 1212 rundll32.exe 69 PID 1212 wrote to memory of 1460 1212 rundll32.exe 69 PID 1212 wrote to memory of 1460 1212 rundll32.exe 69 PID 1212 wrote to memory of 1460 1212 rundll32.exe 69 PID 1212 wrote to memory of 1460 1212 rundll32.exe 69 PID 1212 wrote to memory of 1460 1212 rundll32.exe 69 PID 1212 wrote to memory of 1460 1212 rundll32.exe 69 PID 1212 wrote to memory of 1460 1212 rundll32.exe 69 PID 1212 wrote to memory of 1460 1212 rundll32.exe 69 PID 1212 wrote to memory of 1460 1212 rundll32.exe 69 PID 1212 wrote to memory of 1460 1212 rundll32.exe 69 PID 1212 wrote to memory of 1460 1212 rundll32.exe 69 PID 1212 wrote to memory of 1460 1212 rundll32.exe 69 PID 1212 wrote to memory of 1460 1212 rundll32.exe 69 PID 1212 wrote to memory of 1460 1212 rundll32.exe 69 PID 1212 wrote to memory of 1460 1212 rundll32.exe 69 PID 1212 wrote to memory of 1460 1212 rundll32.exe 69 PID 1212 wrote to memory of 1460 1212 rundll32.exe 69 PID 1212 wrote to memory of 1460 1212 rundll32.exe 69 PID 1212 wrote to memory of 1460 1212 rundll32.exe 69 PID 1212 wrote to memory of 1460 1212 rundll32.exe 69 PID 1212 wrote to memory of 1460 1212 rundll32.exe 69 PID 1212 wrote to memory of 1460 1212 rundll32.exe 69 PID 1212 wrote to memory of 1460 1212 rundll32.exe 69 PID 1212 wrote to memory of 1460 1212 rundll32.exe 69 PID 1212 wrote to memory of 1460 1212 rundll32.exe 69 PID 1212 wrote to memory of 1460 1212 rundll32.exe 69 PID 1212 wrote to memory of 1460 1212 rundll32.exe 69 PID 1212 wrote to memory of 1460 1212 rundll32.exe 69 PID 1212 wrote to memory of 1460 1212 rundll32.exe 69 PID 1212 wrote to memory of 1460 1212 rundll32.exe 69 PID 1212 wrote to memory of 1460 1212 rundll32.exe 69 PID 1212 wrote to memory of 1460 1212 rundll32.exe 69 PID 1212 wrote to memory of 1460 1212 rundll32.exe 69 PID 1212 wrote to memory of 1460 1212 rundll32.exe 69 PID 1212 wrote to memory of 1460 1212 rundll32.exe 69 PID 1212 wrote to memory of 1460 1212 rundll32.exe 69 PID 1212 wrote to memory of 1460 1212 rundll32.exe 69 PID 1212 wrote to memory of 1460 1212 rundll32.exe 69 PID 1212 wrote to memory of 1460 1212 rundll32.exe 69 PID 1212 wrote to memory of 1460 1212 rundll32.exe 69 PID 1212 wrote to memory of 1460 1212 rundll32.exe 69 PID 1212 wrote to memory of 1460 1212 rundll32.exe 69 PID 1212 wrote to memory of 1460 1212 rundll32.exe 69 PID 1212 wrote to memory of 1460 1212 rundll32.exe 69 PID 1212 wrote to memory of 1460 1212 rundll32.exe 69 PID 1212 wrote to memory of 1460 1212 rundll32.exe 69 PID 1212 wrote to memory of 1460 1212 rundll32.exe 69 PID 1212 wrote to memory of 1460 1212 rundll32.exe 69 PID 1212 wrote to memory of 1460 1212 rundll32.exe 69 PID 1212 wrote to memory of 1460 1212 rundll32.exe 69 PID 1212 wrote to memory of 1460 1212 rundll32.exe 69 PID 1212 wrote to memory of 1460 1212 rundll32.exe 69 PID 1212 wrote to memory of 1460 1212 rundll32.exe 69 PID 1212 wrote to memory of 1460 1212 rundll32.exe 69 PID 1212 wrote to memory of 1460 1212 rundll32.exe 69 PID 1212 wrote to memory of 1460 1212 rundll32.exe 69 PID 1212 wrote to memory of 1460 1212 rundll32.exe 69 PID 1212 wrote to memory of 1460 1212 rundll32.exe 69 -
Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 1212 rundll32.exe -
Suspicious behavior: MapViewOfSection 1 IoCs
pid Process 1212 rundll32.exe -
Blacklisted process makes network request 4 IoCs
flow pid Process 5 1460 cmd.exe 6 1460 cmd.exe 7 1460 cmd.exe 11 1460 cmd.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Invoice_628377382.exe"C:\Users\Admin\AppData\Local\Temp\Invoice_628377382.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:3812 -
C:\Windows\SysWOW64\rundll32.exeC:\Windows\system32\rundll32.exe WootzRodeo,Epimers2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:1212 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe"3⤵
- Suspicious use of AdjustPrivilegeToken
- Blacklisted process makes network request
PID:1460
-
-