Analysis
-
max time kernel
113s -
max time network
119s -
platform
windows7_x64 -
resource
win7 -
submitted
10-07-2020 05:47
Static task
static1
Behavioral task
behavioral1
Sample
SHIPPING DOC.exe
Resource
win7
Behavioral task
behavioral2
Sample
SHIPPING DOC.exe
Resource
win10v200430
General
-
Target
SHIPPING DOC.exe
-
Size
251KB
-
MD5
09c2c6e212675f9a716af51853a74aba
-
SHA1
a443db12216d17d224f831080b4b4f76967c1e9c
-
SHA256
9742adf8c511be66c57c236b2849338090c3b7cc0f7ac13f5ff14cdcbfe19912
-
SHA512
a18a1e6ab993a4390f66afb8d531d22312c86b0a51d6bc22f9984f80b28a83fe062b227892fb8813197000480f91cac08a4080af6db36155bad6952dc33eb4a1
Malware Config
Extracted
lokibot
http://mecharnise.ir/ea7/fre.php
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php
Signatures
-
Suspicious use of WriteProcessMemory 14 IoCs
Processes:
SHIPPING DOC.exedescription pid process target process PID 1440 wrote to memory of 292 1440 SHIPPING DOC.exe schtasks.exe PID 1440 wrote to memory of 292 1440 SHIPPING DOC.exe schtasks.exe PID 1440 wrote to memory of 292 1440 SHIPPING DOC.exe schtasks.exe PID 1440 wrote to memory of 292 1440 SHIPPING DOC.exe schtasks.exe PID 1440 wrote to memory of 1044 1440 SHIPPING DOC.exe SHIPPING DOC.exe PID 1440 wrote to memory of 1044 1440 SHIPPING DOC.exe SHIPPING DOC.exe PID 1440 wrote to memory of 1044 1440 SHIPPING DOC.exe SHIPPING DOC.exe PID 1440 wrote to memory of 1044 1440 SHIPPING DOC.exe SHIPPING DOC.exe PID 1440 wrote to memory of 1044 1440 SHIPPING DOC.exe SHIPPING DOC.exe PID 1440 wrote to memory of 1044 1440 SHIPPING DOC.exe SHIPPING DOC.exe PID 1440 wrote to memory of 1044 1440 SHIPPING DOC.exe SHIPPING DOC.exe PID 1440 wrote to memory of 1044 1440 SHIPPING DOC.exe SHIPPING DOC.exe PID 1440 wrote to memory of 1044 1440 SHIPPING DOC.exe SHIPPING DOC.exe PID 1440 wrote to memory of 1044 1440 SHIPPING DOC.exe SHIPPING DOC.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
SHIPPING DOC.exedescription pid process target process PID 1440 set thread context of 1044 1440 SHIPPING DOC.exe SHIPPING DOC.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
SHIPPING DOC.exedescription pid process Token: SeDebugPrivilege 1044 SHIPPING DOC.exe -
Suspicious behavior: RenamesItself 1 IoCs
Processes:
SHIPPING DOC.exepid process 1044 SHIPPING DOC.exe -
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
Processes
-
C:\Users\Admin\AppData\Local\Temp\SHIPPING DOC.exe"C:\Users\Admin\AppData\Local\Temp\SHIPPING DOC.exe"1⤵
- Suspicious use of WriteProcessMemory
- Suspicious use of SetThreadContext
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\hAhhISRXXBjJ" /XML "C:\Users\Admin\AppData\Local\Temp\tmp94EE.tmp"2⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Local\Temp\SHIPPING DOC.exe"{path}"2⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious behavior: RenamesItself
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\tmp94EE.tmp
-
memory/292-2-0x0000000000000000-mapping.dmp
-
memory/1044-4-0x0000000000400000-0x00000000004A2000-memory.dmpFilesize
648KB
-
memory/1044-5-0x00000000004139DE-mapping.dmp
-
memory/1044-6-0x0000000000400000-0x00000000004A2000-memory.dmpFilesize
648KB
-
memory/1440-1-0x0000000000000000-0x0000000000000000-disk.dmp