Analysis
-
max time kernel
53s -
max time network
53s -
platform
windows7_x64 -
resource
win7 -
submitted
17-07-2020 00:09
Static task
static1
Behavioral task
behavioral1
Sample
af72965aecd13c67c0e1416b597871dfe4ded290d17b4e267cce1e7bc6002e52.exe
Resource
win7
Behavioral task
behavioral2
Sample
af72965aecd13c67c0e1416b597871dfe4ded290d17b4e267cce1e7bc6002e52.exe
Resource
win10v200430
General
-
Target
af72965aecd13c67c0e1416b597871dfe4ded290d17b4e267cce1e7bc6002e52.exe
-
Size
321KB
-
MD5
44743f989b05acaa14c474923202da53
-
SHA1
081dfcd3b9beccf1892092e0405914e244c55e2b
-
SHA256
af72965aecd13c67c0e1416b597871dfe4ded290d17b4e267cce1e7bc6002e52
-
SHA512
83a02a9d22cc407dbf9faf1d07171b7bd05555c3c867c791655e2d510ff5349c11748c117dca54862edd9fd93be6472629dc548e842e999b1ea9939ac6836e98
Malware Config
Extracted
lokibot
http://195.69.140.147/.op/cr.php/QQ9RX53CNTMRH
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php
Signatures
-
Suspicious use of WriteProcessMemory 10 IoCs
Processes:
af72965aecd13c67c0e1416b597871dfe4ded290d17b4e267cce1e7bc6002e52.exedescription pid process target process PID 1496 wrote to memory of 1848 1496 af72965aecd13c67c0e1416b597871dfe4ded290d17b4e267cce1e7bc6002e52.exe af72965aecd13c67c0e1416b597871dfe4ded290d17b4e267cce1e7bc6002e52.exe PID 1496 wrote to memory of 1848 1496 af72965aecd13c67c0e1416b597871dfe4ded290d17b4e267cce1e7bc6002e52.exe af72965aecd13c67c0e1416b597871dfe4ded290d17b4e267cce1e7bc6002e52.exe PID 1496 wrote to memory of 1848 1496 af72965aecd13c67c0e1416b597871dfe4ded290d17b4e267cce1e7bc6002e52.exe af72965aecd13c67c0e1416b597871dfe4ded290d17b4e267cce1e7bc6002e52.exe PID 1496 wrote to memory of 1848 1496 af72965aecd13c67c0e1416b597871dfe4ded290d17b4e267cce1e7bc6002e52.exe af72965aecd13c67c0e1416b597871dfe4ded290d17b4e267cce1e7bc6002e52.exe PID 1496 wrote to memory of 1848 1496 af72965aecd13c67c0e1416b597871dfe4ded290d17b4e267cce1e7bc6002e52.exe af72965aecd13c67c0e1416b597871dfe4ded290d17b4e267cce1e7bc6002e52.exe PID 1496 wrote to memory of 1848 1496 af72965aecd13c67c0e1416b597871dfe4ded290d17b4e267cce1e7bc6002e52.exe af72965aecd13c67c0e1416b597871dfe4ded290d17b4e267cce1e7bc6002e52.exe PID 1496 wrote to memory of 1848 1496 af72965aecd13c67c0e1416b597871dfe4ded290d17b4e267cce1e7bc6002e52.exe af72965aecd13c67c0e1416b597871dfe4ded290d17b4e267cce1e7bc6002e52.exe PID 1496 wrote to memory of 1848 1496 af72965aecd13c67c0e1416b597871dfe4ded290d17b4e267cce1e7bc6002e52.exe af72965aecd13c67c0e1416b597871dfe4ded290d17b4e267cce1e7bc6002e52.exe PID 1496 wrote to memory of 1848 1496 af72965aecd13c67c0e1416b597871dfe4ded290d17b4e267cce1e7bc6002e52.exe af72965aecd13c67c0e1416b597871dfe4ded290d17b4e267cce1e7bc6002e52.exe PID 1496 wrote to memory of 1848 1496 af72965aecd13c67c0e1416b597871dfe4ded290d17b4e267cce1e7bc6002e52.exe af72965aecd13c67c0e1416b597871dfe4ded290d17b4e267cce1e7bc6002e52.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
af72965aecd13c67c0e1416b597871dfe4ded290d17b4e267cce1e7bc6002e52.exedescription pid process target process PID 1496 set thread context of 1848 1496 af72965aecd13c67c0e1416b597871dfe4ded290d17b4e267cce1e7bc6002e52.exe af72965aecd13c67c0e1416b597871dfe4ded290d17b4e267cce1e7bc6002e52.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
af72965aecd13c67c0e1416b597871dfe4ded290d17b4e267cce1e7bc6002e52.exedescription pid process Token: SeDebugPrivilege 1848 af72965aecd13c67c0e1416b597871dfe4ded290d17b4e267cce1e7bc6002e52.exe -
Suspicious behavior: RenamesItself 1 IoCs
Processes:
af72965aecd13c67c0e1416b597871dfe4ded290d17b4e267cce1e7bc6002e52.exepid process 1848 af72965aecd13c67c0e1416b597871dfe4ded290d17b4e267cce1e7bc6002e52.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
Processes
-
C:\Users\Admin\AppData\Local\Temp\af72965aecd13c67c0e1416b597871dfe4ded290d17b4e267cce1e7bc6002e52.exe"C:\Users\Admin\AppData\Local\Temp\af72965aecd13c67c0e1416b597871dfe4ded290d17b4e267cce1e7bc6002e52.exe"1⤵
- Suspicious use of WriteProcessMemory
- Suspicious use of SetThreadContext
PID:1496 -
C:\Users\Admin\AppData\Local\Temp\af72965aecd13c67c0e1416b597871dfe4ded290d17b4e267cce1e7bc6002e52.exe"{path}"2⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious behavior: RenamesItself
PID:1848