Analysis
-
max time kernel
124s -
max time network
129s -
platform
windows7_x64 -
resource
win7 -
submitted
15/07/2020, 06:50
Static task
static1
Behavioral task
behavioral1
Sample
scan-223872_pdf.exe
Resource
win7
0 signatures
0 seconds
General
-
Target
scan-223872_pdf.exe
-
Size
639KB
-
MD5
295ac83fb3787e22a798e76d17f38d00
-
SHA1
30c5629df163885569ba021773e10f4d7e2c69e6
-
SHA256
f2b9337a8bbc0c1eb333fad67f0e28237c7af593946cc17c8cd5aca466f2b472
-
SHA512
442a8f8470e1980324aae03198542c2f3f0af7231748270513109da34cc53f819b810d1754ac48030a39cc4f63706fa48334260bf508fbf430250d0a70ff19ec
Malware Config
Extracted
Family
lokibot
C2
http://rostovafile.gq/Colba2/fre.php
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php
Signatures
-
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 1508 set thread context of 1604 1508 scan-223872_pdf.exe 24 -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 1604 scan-223872_pdf.exe -
Suspicious behavior: RenamesItself 1 IoCs
pid Process 1604 scan-223872_pdf.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 1508 scan-223872_pdf.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1508 wrote to memory of 1604 1508 scan-223872_pdf.exe 24 PID 1508 wrote to memory of 1604 1508 scan-223872_pdf.exe 24 PID 1508 wrote to memory of 1604 1508 scan-223872_pdf.exe 24 PID 1508 wrote to memory of 1604 1508 scan-223872_pdf.exe 24 -
Suspicious behavior: MapViewOfSection 1 IoCs
pid Process 1508 scan-223872_pdf.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\scan-223872_pdf.exe"C:\Users\Admin\AppData\Local\Temp\scan-223872_pdf.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
- Suspicious behavior: MapViewOfSection
PID:1508 -
C:\Users\Admin\AppData\Local\Temp\scan-223872_pdf.exe"C:\Users\Admin\AppData\Local\Temp\scan-223872_pdf.exe"2⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious behavior: RenamesItself
PID:1604
-