Analysis
-
max time kernel
91s -
max time network
110s -
platform
windows10_x64 -
resource
win10 -
submitted
16/07/2020, 07:16
Static task
static1
Behavioral task
behavioral1
Sample
INV07162020PO28837pdf.exe
Resource
win7
windows7_x64
0 signatures
0 seconds
General
-
Target
INV07162020PO28837pdf.exe
-
Size
251KB
-
MD5
9fb52128f39355fcc2499fcc24c3c499
-
SHA1
d022b2aca43a3c45a3597d59ff21a04a547a301f
-
SHA256
0f7537146e93f39ade4fe8c3971b2db4c82f248b1a263d31a15b203e7e13e3c9
-
SHA512
6add079caaecb43421c286c6ef06f686c85028c4907635fc3b699da08de5d2ae2bccfbe5a0b43f4913081518fa3b1eb457803ee7dbe068d70a0a0b46238b53ad
Malware Config
Extracted
Family
lokibot
C2
http://modevin.ga/~zadmin/lmark/frega3/mode.php
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php
Signatures
-
Suspicious use of WriteProcessMemory 82 IoCs
description pid Process procid_target PID 3908 wrote to memory of 3884 3908 INV07162020PO28837pdf.exe 67 PID 3908 wrote to memory of 3884 3908 INV07162020PO28837pdf.exe 67 PID 3908 wrote to memory of 3884 3908 INV07162020PO28837pdf.exe 67 PID 3884 wrote to memory of 1880 3884 rundll32.exe 68 PID 3884 wrote to memory of 1880 3884 rundll32.exe 68 PID 3884 wrote to memory of 1880 3884 rundll32.exe 68 PID 3884 wrote to memory of 1880 3884 rundll32.exe 68 PID 3884 wrote to memory of 1880 3884 rundll32.exe 68 PID 3884 wrote to memory of 1880 3884 rundll32.exe 68 PID 3884 wrote to memory of 1880 3884 rundll32.exe 68 PID 3884 wrote to memory of 1880 3884 rundll32.exe 68 PID 3884 wrote to memory of 1880 3884 rundll32.exe 68 PID 3884 wrote to memory of 1880 3884 rundll32.exe 68 PID 3884 wrote to memory of 1880 3884 rundll32.exe 68 PID 3884 wrote to memory of 1880 3884 rundll32.exe 68 PID 3884 wrote to memory of 1880 3884 rundll32.exe 68 PID 3884 wrote to memory of 1880 3884 rundll32.exe 68 PID 3884 wrote to memory of 1880 3884 rundll32.exe 68 PID 3884 wrote to memory of 1880 3884 rundll32.exe 68 PID 3884 wrote to memory of 1880 3884 rundll32.exe 68 PID 3884 wrote to memory of 1880 3884 rundll32.exe 68 PID 3884 wrote to memory of 1880 3884 rundll32.exe 68 PID 3884 wrote to memory of 1880 3884 rundll32.exe 68 PID 3884 wrote to memory of 1880 3884 rundll32.exe 68 PID 3884 wrote to memory of 1880 3884 rundll32.exe 68 PID 3884 wrote to memory of 1880 3884 rundll32.exe 68 PID 3884 wrote to memory of 1880 3884 rundll32.exe 68 PID 3884 wrote to memory of 1880 3884 rundll32.exe 68 PID 3884 wrote to memory of 1880 3884 rundll32.exe 68 PID 3884 wrote to memory of 1880 3884 rundll32.exe 68 PID 3884 wrote to memory of 1880 3884 rundll32.exe 68 PID 3884 wrote to memory of 1880 3884 rundll32.exe 68 PID 3884 wrote to memory of 1880 3884 rundll32.exe 68 PID 3884 wrote to memory of 1880 3884 rundll32.exe 68 PID 3884 wrote to memory of 1880 3884 rundll32.exe 68 PID 3884 wrote to memory of 1880 3884 rundll32.exe 68 PID 3884 wrote to memory of 1880 3884 rundll32.exe 68 PID 3884 wrote to memory of 1880 3884 rundll32.exe 68 PID 3884 wrote to memory of 1880 3884 rundll32.exe 68 PID 3884 wrote to memory of 1880 3884 rundll32.exe 68 PID 3884 wrote to memory of 1880 3884 rundll32.exe 68 PID 3884 wrote to memory of 1880 3884 rundll32.exe 68 PID 3884 wrote to memory of 1880 3884 rundll32.exe 68 PID 3884 wrote to memory of 1880 3884 rundll32.exe 68 PID 3884 wrote to memory of 1880 3884 rundll32.exe 68 PID 3884 wrote to memory of 1880 3884 rundll32.exe 68 PID 3884 wrote to memory of 1880 3884 rundll32.exe 68 PID 3884 wrote to memory of 1880 3884 rundll32.exe 68 PID 3884 wrote to memory of 1880 3884 rundll32.exe 68 PID 3884 wrote to memory of 1880 3884 rundll32.exe 68 PID 3884 wrote to memory of 1880 3884 rundll32.exe 68 PID 3884 wrote to memory of 1880 3884 rundll32.exe 68 PID 3884 wrote to memory of 1880 3884 rundll32.exe 68 PID 3884 wrote to memory of 1880 3884 rundll32.exe 68 PID 3884 wrote to memory of 1880 3884 rundll32.exe 68 PID 3884 wrote to memory of 1880 3884 rundll32.exe 68 PID 3884 wrote to memory of 1880 3884 rundll32.exe 68 PID 3884 wrote to memory of 1880 3884 rundll32.exe 68 PID 3884 wrote to memory of 1880 3884 rundll32.exe 68 PID 3884 wrote to memory of 1880 3884 rundll32.exe 68 PID 3884 wrote to memory of 1880 3884 rundll32.exe 68 PID 3884 wrote to memory of 1880 3884 rundll32.exe 68 PID 3884 wrote to memory of 1880 3884 rundll32.exe 68 PID 3884 wrote to memory of 1880 3884 rundll32.exe 68 PID 3884 wrote to memory of 1880 3884 rundll32.exe 68 PID 3884 wrote to memory of 1880 3884 rundll32.exe 68 PID 3884 wrote to memory of 1880 3884 rundll32.exe 68 PID 3884 wrote to memory of 1880 3884 rundll32.exe 68 PID 3884 wrote to memory of 1880 3884 rundll32.exe 68 PID 3884 wrote to memory of 1880 3884 rundll32.exe 68 PID 3884 wrote to memory of 1880 3884 rundll32.exe 68 PID 3884 wrote to memory of 1880 3884 rundll32.exe 68 PID 3884 wrote to memory of 1880 3884 rundll32.exe 68 PID 3884 wrote to memory of 1880 3884 rundll32.exe 68 PID 3884 wrote to memory of 1880 3884 rundll32.exe 68 PID 3884 wrote to memory of 1880 3884 rundll32.exe 68 PID 3884 wrote to memory of 1880 3884 rundll32.exe 68 PID 3884 wrote to memory of 1880 3884 rundll32.exe 68 PID 3884 wrote to memory of 1880 3884 rundll32.exe 68 PID 3884 wrote to memory of 1880 3884 rundll32.exe 68 PID 3884 wrote to memory of 1880 3884 rundll32.exe 68 PID 3884 wrote to memory of 1880 3884 rundll32.exe 68 -
Loads dropped DLL 1 IoCs
pid Process 3884 rundll32.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 3884 rundll32.exe -
Suspicious behavior: MapViewOfSection 1 IoCs
pid Process 3884 rundll32.exe -
Blacklisted process makes network request 4 IoCs
flow pid Process 4 1880 cmd.exe 5 1880 cmd.exe 6 1880 cmd.exe 11 1880 cmd.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 1880 cmd.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
Processes
-
C:\Users\Admin\AppData\Local\Temp\INV07162020PO28837pdf.exe"C:\Users\Admin\AppData\Local\Temp\INV07162020PO28837pdf.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3908 -
C:\Windows\SysWOW64\rundll32.exeC:\Windows\system32\rundll32.exe GuestRummy,Michelle2⤵
- Suspicious use of WriteProcessMemory
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:3884 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe"3⤵
- Blacklisted process makes network request
- Suspicious use of AdjustPrivilegeToken
PID:1880
-
-