Analysis
- max time kernel
136s - max time network
145s - platform
windows10_x64 - resource
win10 - submitted
20/07/2020, 10:58
Static task
static1
Behavioral task
behavioral1
Sample
data.exe
Resource
win7v200430
windows7_x64
0 signatures
0 seconds
General
- Target data.exe
- Size 679KB
- Sample200720-epf884ahvs
- SHA256 8043fce8f83dc87396532c20107397ebf5889f802cb588d26bbf0822b39ed27a
- MD5 67ef1442471f759cb626ccaae6199f20
- SHA1 078497fc8e6e89e36b7e16e882054a5924bd4196
- SHA512 9ef9cbcd8619cbb2183d0682b75a76de672d1867dfadf9479c5b8d3e6b9c429124a6bda410f49f39bf026681da7081753c25c90b155ea3aad38d0ce6b704a8d3
- MD5 SHA1 SHA512
Malware Config
Extracted
Family
-
lokibot
C2
-
http://madibalohilalamb.duckdns.org/Panel/five/fre.php
-
http://kbfvzoboss.bid/alien/fre.php
-
http://alphastand.trade/alien/fre.php
-
http://alphastand.win/alien/fre.php
-
http://alphastand.top/alien/fre.php
Signatures
- Executes dropped EXE 8 IoCs
pid Process 3992 utbi.exe 1840 rlzw.exe 3320 burm.exe 748 uyby.exe 3208 eisb.exe 3504 qldv.exe 2956 ddjz.exe 3812 eisb.exe - Program crash 2 IoCs
pid pid_target Process procid_target 2476 3504 WerFault.exe 73 2936 2956 WerFault.exe 74 - Suspicious use of AdjustPrivilegeToken 10 IoCs
description pid Process Token: SeRestorePrivilege 2936 WerFault.exe Token: SeBackupPrivilege 2936 WerFault.exe Token: SeRestorePrivilege 2476 WerFault.exe Token: SeBackupPrivilege 2476 WerFault.exe Token: SeBackupPrivilege 2936 WerFault.exe Token: SeDebugPrivilege 2476 WerFault.exe Token: SeDebugPrivilege 2936 WerFault.exe Token: SeDebugPrivilege 3208 eisb.exe Token: SeDebugPrivilege 748 uyby.exe Token: SeDebugPrivilege 2212 ieinstal.exe - Suspicious behavior: MapViewOfSection 1 IoCs
pid Process 2212 ieinstal.exe - Adds Run key to start application 2 TTPs 4 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000\Software\Microsoft\Windows\CurrentVersion\Run\explorer = "C:\\Users\\Admin\\AppData\\Roaming\\eisb.exe" eisb.exe Set value (str) \REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000\Software\Microsoft\Windows\CurrentVersion\Run\dbrd = "C:\\Users\\Admin\\AppData\\Local\\dbrd\\dbrd.hta" rlzw.exe Set value (str) \REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000\Software\Microsoft\Windows\CurrentVersion\Run\fmrd = "C:\\Users\\Admin\\AppData\\Local\\fmrd\\fmrd.hta" utbi.exe Set value (str) \REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000\Software\Microsoft\Windows\CurrentVersion\Run\rmrd = "C:\\Users\\Admin\\AppData\\Local\\rmrd\\rmrd.hta" burm.exe - Suspicious use of SetThreadContext 6 IoCs
description pid Process procid_target PID 3748 set thread context of 3836 3748 data.exe 67 PID 3208 set thread context of 3812 3208 eisb.exe 84 PID 748 set thread context of 2024 748 uyby.exe 88 PID 1840 set thread context of 1532 1840 rlzw.exe 89 PID 3992 set thread context of 2212 3992 utbi.exe 90 PID 3320 set thread context of 2044 3320 burm.exe 91 - Script User-Agent 3 IoCs
Uses user-agent string associated with script host/environment.
description flow ioc HTTP User-Agent header 29 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) HTTP User-Agent header 30 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) HTTP User-Agent header 31 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) - Drops file in Windows directory 1 IoCs
description ioc Process File created C:\Windows\AppCompat\Programs\Amcache.hve.tmp WerFault.exe - Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 3924 schtasks.exe - Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Suspicious use of WriteProcessMemory 63 IoCs
description pid Process procid_target PID 3748 wrote to memory of 3836 3748 data.exe 67 PID 3748 wrote to memory of 3836 3748 data.exe 67 PID 3748 wrote to memory of 3836 3748 data.exe 67 PID 3748 wrote to memory of 3836 3748 data.exe 67 PID 3748 wrote to memory of 3836 3748 data.exe 67 PID 3836 wrote to memory of 3992 3836 ieinstal.exe 68 PID 3836 wrote to memory of 3992 3836 ieinstal.exe 68 PID 3836 wrote to memory of 3992 3836 ieinstal.exe 68 PID 3836 wrote to memory of 1840 3836 ieinstal.exe 69 PID 3836 wrote to memory of 1840 3836 ieinstal.exe 69 PID 3836 wrote to memory of 1840 3836 ieinstal.exe 69 PID 3836 wrote to memory of 3320 3836 ieinstal.exe 70 PID 3836 wrote to memory of 3320 3836 ieinstal.exe 70 PID 3836 wrote to memory of 3320 3836 ieinstal.exe 70 PID 3836 wrote to memory of 748 3836 ieinstal.exe 71 PID 3836 wrote to memory of 748 3836 ieinstal.exe 71 PID 3836 wrote to memory of 748 3836 ieinstal.exe 71 PID 3836 wrote to memory of 3208 3836 ieinstal.exe 72 PID 3836 wrote to memory of 3208 3836 ieinstal.exe 72 PID 3836 wrote to memory of 3208 3836 ieinstal.exe 72 PID 3836 wrote to memory of 3504 3836 ieinstal.exe 73 PID 3836 wrote to memory of 3504 3836 ieinstal.exe 73 PID 3836 wrote to memory of 3504 3836 ieinstal.exe 73 PID 3836 wrote to memory of 2956 3836 ieinstal.exe 74 PID 3836 wrote to memory of 2956 3836 ieinstal.exe 74 PID 3836 wrote to memory of 2956 3836 ieinstal.exe 74 PID 3208 wrote to memory of 3812 3208 eisb.exe 84 PID 3208 wrote to memory of 3812 3208 eisb.exe 84 PID 3208 wrote to memory of 3812 3208 eisb.exe 84 PID 3208 wrote to memory of 3812 3208 eisb.exe 84 PID 3208 wrote to memory of 3812 3208 eisb.exe 84 PID 3208 wrote to memory of 3812 3208 eisb.exe 84 PID 3208 wrote to memory of 3812 3208 eisb.exe 84 PID 3208 wrote to memory of 3812 3208 eisb.exe 84 PID 748 wrote to memory of 3924 748 uyby.exe 85 PID 748 wrote to memory of 3924 748 uyby.exe 85 PID 748 wrote to memory of 3924 748 uyby.exe 85 PID 748 wrote to memory of 932 748 uyby.exe 87 PID 748 wrote to memory of 932 748 uyby.exe 87 PID 748 wrote to memory of 932 748 uyby.exe 87 PID 748 wrote to memory of 2024 748 uyby.exe 88 PID 748 wrote to memory of 2024 748 uyby.exe 88 PID 748 wrote to memory of 2024 748 uyby.exe 88 PID 748 wrote to memory of 2024 748 uyby.exe 88 PID 748 wrote to memory of 2024 748 uyby.exe 88 PID 748 wrote to memory of 2024 748 uyby.exe 88 PID 748 wrote to memory of 2024 748 uyby.exe 88 PID 748 wrote to memory of 2024 748 uyby.exe 88 PID 1840 wrote to memory of 1532 1840 rlzw.exe 89 PID 1840 wrote to memory of 1532 1840 rlzw.exe 89 PID 1840 wrote to memory of 1532 1840 rlzw.exe 89 PID 1840 wrote to memory of 1532 1840 rlzw.exe 89 PID 1840 wrote to memory of 1532 1840 rlzw.exe 89 PID 3992 wrote to memory of 2212 3992 utbi.exe 90 PID 3992 wrote to memory of 2212 3992 utbi.exe 90 PID 3992 wrote to memory of 2212 3992 utbi.exe 90 PID 3992 wrote to memory of 2212 3992 utbi.exe 90 PID 3992 wrote to memory of 2212 3992 utbi.exe 90 PID 3320 wrote to memory of 2044 3320 burm.exe 91 PID 3320 wrote to memory of 2044 3320 burm.exe 91 PID 3320 wrote to memory of 2044 3320 burm.exe 91 PID 3320 wrote to memory of 2044 3320 burm.exe 91 PID 3320 wrote to memory of 2044 3320 burm.exe 91 - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 3836 ieinstal.exe 2044 ieinstal.exe - Suspicious behavior: EnumeratesProcesses 36 IoCs
pid Process 2936 WerFault.exe 2476 WerFault.exe 2476 WerFault.exe 2936 WerFault.exe 2936 WerFault.exe 2476 WerFault.exe 2936 WerFault.exe 2476 WerFault.exe 2936 WerFault.exe 2476 WerFault.exe 2936 WerFault.exe 2476 WerFault.exe 2936 WerFault.exe 2476 WerFault.exe 2936 WerFault.exe 2476 WerFault.exe 2936 WerFault.exe 2476 WerFault.exe 2936 WerFault.exe 2476 WerFault.exe 2936 WerFault.exe 2476 WerFault.exe 2476 WerFault.exe 2936 WerFault.exe 2476 WerFault.exe 2936 WerFault.exe 2476 WerFault.exe 2936 WerFault.exe 3208 eisb.exe 748 uyby.exe 748 uyby.exe 748 uyby.exe 2212 ieinstal.exe 2212 ieinstal.exe 2212 ieinstal.exe 2212 ieinstal.exe - Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 3812 eisb.exe -
description ioc Process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA ieinstal.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\data.exe"C:\Users\Admin\AppData\Local\Temp\data.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3748 -
C:\Program Files (x86)\internet explorer\ieinstal.exe"C:\Program Files (x86)\internet explorer\ieinstal.exe"2⤵
- Suspicious use of WriteProcessMemory
- Suspicious use of SetWindowsHookEx
- Checks whether UAC is enabled
PID:3836 -
C:\Users\Admin\AppData\Roaming\utbi.exe"C:\Users\Admin\AppData\Roaming\utbi.exe" 03⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3992 -
C:\Program Files (x86)\internet explorer\ieinstal.exe"C:\Program Files (x86)\internet explorer\ieinstal.exe"4⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious behavior: MapViewOfSection
- Suspicious behavior: EnumeratesProcesses
PID:2212
-
-
-
C:\Users\Admin\AppData\Roaming\rlzw.exe"C:\Users\Admin\AppData\Roaming\rlzw.exe" 03⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1840 -
C:\Program Files (x86)\internet explorer\ieinstal.exe"C:\Program Files (x86)\internet explorer\ieinstal.exe"4⤵PID:1532
-
-
-
C:\Users\Admin\AppData\Roaming\burm.exe"C:\Users\Admin\AppData\Roaming\burm.exe" 03⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3320 -
C:\Program Files (x86)\internet explorer\ieinstal.exe"C:\Program Files (x86)\internet explorer\ieinstal.exe"4⤵
- Suspicious use of SetWindowsHookEx
PID:2044
-
-
-
C:\Users\Admin\AppData\Roaming\uyby.exe"C:\Users\Admin\AppData\Roaming\uyby.exe" 03⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
- Suspicious behavior: EnumeratesProcesses
PID:748 -
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\RVQwOvPQSm" /XML "C:\Users\Admin\AppData\Local\Temp\tmpB00C.tmp"4⤵
- Creates scheduled task(s)
PID:3924
-
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe"{path}"4⤵PID:932
-
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe"{path}"4⤵PID:2024
-
-
-
C:\Users\Admin\AppData\Roaming\eisb.exe"C:\Users\Admin\AppData\Roaming\eisb.exe" 03⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
- Suspicious behavior: EnumeratesProcesses
PID:3208 -
C:\Users\Admin\AppData\Roaming\eisb.exe"{path}"4⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: AddClipboardFormatListener
PID:3812
-
-
-
C:\Users\Admin\AppData\Roaming\qldv.exe"C:\Users\Admin\AppData\Roaming\qldv.exe" 03⤵
- Executes dropped EXE
PID:3504 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3504 -s 8964⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
- Suspicious behavior: EnumeratesProcesses
PID:2476
-
-
-
C:\Users\Admin\AppData\Roaming\ddjz.exe"C:\Users\Admin\AppData\Roaming\ddjz.exe" 03⤵
- Executes dropped EXE
PID:2956 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2956 -s 8964⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
PID:2936
-
-
-