Analysis
-
max time kernel
130s -
max time network
129s -
platform
windows10_x64 -
resource
win10v200430 -
submitted
16-07-2020 12:10
Static task
static1
Behavioral task
behavioral1
Sample
58af5a72f21e64e635661aaa2d09a72f6eb3e12117eef93ee5d4cb0840a5a31d.exe
Resource
win7
General
-
Target
58af5a72f21e64e635661aaa2d09a72f6eb3e12117eef93ee5d4cb0840a5a31d.exe
-
Size
588KB
-
MD5
0d9e0a5ee2370181e6df2d49bf3245b0
-
SHA1
1c5a84f18225c10123f2f96879976eacda666c65
-
SHA256
58af5a72f21e64e635661aaa2d09a72f6eb3e12117eef93ee5d4cb0840a5a31d
-
SHA512
9276f6794455ec0c3143af07d9bb299261c875ce3f342ade786ded83bd4f2835972089429870835398b46a0aa5ca6b3cf244df47e52f3397e8a2e1f649db8f3a
Malware Config
Extracted
lokibot
http://flexpak-th.com/osama/aboki/fre.php
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php
Signatures
-
Suspicious use of SetThreadContext 1 IoCs
Processes:
58af5a72f21e64e635661aaa2d09a72f6eb3e12117eef93ee5d4cb0840a5a31d.exedescription pid process target process PID 1916 set thread context of 3792 1916 58af5a72f21e64e635661aaa2d09a72f6eb3e12117eef93ee5d4cb0840a5a31d.exe 58af5a72f21e64e635661aaa2d09a72f6eb3e12117eef93ee5d4cb0840a5a31d.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
58af5a72f21e64e635661aaa2d09a72f6eb3e12117eef93ee5d4cb0840a5a31d.exedescription pid process Token: SeDebugPrivilege 3792 58af5a72f21e64e635661aaa2d09a72f6eb3e12117eef93ee5d4cb0840a5a31d.exe -
Suspicious behavior: RenamesItself 1 IoCs
Processes:
58af5a72f21e64e635661aaa2d09a72f6eb3e12117eef93ee5d4cb0840a5a31d.exepid process 3792 58af5a72f21e64e635661aaa2d09a72f6eb3e12117eef93ee5d4cb0840a5a31d.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
58af5a72f21e64e635661aaa2d09a72f6eb3e12117eef93ee5d4cb0840a5a31d.exepid process 1916 58af5a72f21e64e635661aaa2d09a72f6eb3e12117eef93ee5d4cb0840a5a31d.exe 1916 58af5a72f21e64e635661aaa2d09a72f6eb3e12117eef93ee5d4cb0840a5a31d.exe -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
58af5a72f21e64e635661aaa2d09a72f6eb3e12117eef93ee5d4cb0840a5a31d.exedescription pid process target process PID 1916 wrote to memory of 3792 1916 58af5a72f21e64e635661aaa2d09a72f6eb3e12117eef93ee5d4cb0840a5a31d.exe 58af5a72f21e64e635661aaa2d09a72f6eb3e12117eef93ee5d4cb0840a5a31d.exe PID 1916 wrote to memory of 3792 1916 58af5a72f21e64e635661aaa2d09a72f6eb3e12117eef93ee5d4cb0840a5a31d.exe 58af5a72f21e64e635661aaa2d09a72f6eb3e12117eef93ee5d4cb0840a5a31d.exe PID 1916 wrote to memory of 3792 1916 58af5a72f21e64e635661aaa2d09a72f6eb3e12117eef93ee5d4cb0840a5a31d.exe 58af5a72f21e64e635661aaa2d09a72f6eb3e12117eef93ee5d4cb0840a5a31d.exe -
Suspicious behavior: MapViewOfSection 1 IoCs
Processes:
58af5a72f21e64e635661aaa2d09a72f6eb3e12117eef93ee5d4cb0840a5a31d.exepid process 1916 58af5a72f21e64e635661aaa2d09a72f6eb3e12117eef93ee5d4cb0840a5a31d.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\58af5a72f21e64e635661aaa2d09a72f6eb3e12117eef93ee5d4cb0840a5a31d.exe"C:\Users\Admin\AppData\Local\Temp\58af5a72f21e64e635661aaa2d09a72f6eb3e12117eef93ee5d4cb0840a5a31d.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
- Suspicious behavior: MapViewOfSection
-
C:\Users\Admin\AppData\Local\Temp\58af5a72f21e64e635661aaa2d09a72f6eb3e12117eef93ee5d4cb0840a5a31d.exe"C:\Users\Admin\AppData\Local\Temp\58af5a72f21e64e635661aaa2d09a72f6eb3e12117eef93ee5d4cb0840a5a31d.exe"2⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious behavior: RenamesItself