Analysis
- max time kernel
120s - max time network
122s - platform
windows10_x64 - resource
win10 - submitted
31/07/2020, 11:08
Static task
static1
Behavioral task
behavioral1
Sample
Quotation_pdf.exe
Resource
win7v200722
windows7_x64
0 signatures
0 seconds
General
- Target Quotation_pdf.exe
- Size 363KB
- Sample200731-5x4prdzfg6
- SHA256 74e6a167dff835aee34f4896f9745ef7113baefbb8bf0610c4ec8e1827c79f2e
- MD5 de7567dcc1d3608f5c45cadcc56b6b30
- SHA1 19c2de0a634d65fb3312ea2e5c71298369685648
- SHA512 a6a638cf9036b55401695255a41f54827c1007814d4a0e47de827c098583106dbeac3b10e64604e68ae3c86d975ad8abf5ead04e4b701388d9b5e8ef5db43902
- MD5 SHA1 SHA512
Malware Config
Extracted
Family
-
lokibot
C2
-
http://modevin.ga/~zadmin/lmark/gld/mode.php
-
http://kbfvzoboss.bid/alien/fre.php
-
http://alphastand.trade/alien/fre.php
-
http://alphastand.win/alien/fre.php
-
http://alphastand.top/alien/fre.php
Signatures
- Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Suspicious use of WriteProcessMemory 82 IoCs
description pid Process procid_target PID 2460 wrote to memory of 3916 2460 Quotation_pdf.exe 67 PID 2460 wrote to memory of 3916 2460 Quotation_pdf.exe 67 PID 2460 wrote to memory of 3916 2460 Quotation_pdf.exe 67 PID 3916 wrote to memory of 3448 3916 rundll32.exe 68 PID 3916 wrote to memory of 3448 3916 rundll32.exe 68 PID 3916 wrote to memory of 3448 3916 rundll32.exe 68 PID 3916 wrote to memory of 3448 3916 rundll32.exe 68 PID 3916 wrote to memory of 3448 3916 rundll32.exe 68 PID 3916 wrote to memory of 3448 3916 rundll32.exe 68 PID 3916 wrote to memory of 3448 3916 rundll32.exe 68 PID 3916 wrote to memory of 3448 3916 rundll32.exe 68 PID 3916 wrote to memory of 3448 3916 rundll32.exe 68 PID 3916 wrote to memory of 3448 3916 rundll32.exe 68 PID 3916 wrote to memory of 3448 3916 rundll32.exe 68 PID 3916 wrote to memory of 3448 3916 rundll32.exe 68 PID 3916 wrote to memory of 3448 3916 rundll32.exe 68 PID 3916 wrote to memory of 3448 3916 rundll32.exe 68 PID 3916 wrote to memory of 3448 3916 rundll32.exe 68 PID 3916 wrote to memory of 3448 3916 rundll32.exe 68 PID 3916 wrote to memory of 3448 3916 rundll32.exe 68 PID 3916 wrote to memory of 3448 3916 rundll32.exe 68 PID 3916 wrote to memory of 3448 3916 rundll32.exe 68 PID 3916 wrote to memory of 3448 3916 rundll32.exe 68 PID 3916 wrote to memory of 3448 3916 rundll32.exe 68 PID 3916 wrote to memory of 3448 3916 rundll32.exe 68 PID 3916 wrote to memory of 3448 3916 rundll32.exe 68 PID 3916 wrote to memory of 3448 3916 rundll32.exe 68 PID 3916 wrote to memory of 3448 3916 rundll32.exe 68 PID 3916 wrote to memory of 3448 3916 rundll32.exe 68 PID 3916 wrote to memory of 3448 3916 rundll32.exe 68 PID 3916 wrote to memory of 3448 3916 rundll32.exe 68 PID 3916 wrote to memory of 3448 3916 rundll32.exe 68 PID 3916 wrote to memory of 3448 3916 rundll32.exe 68 PID 3916 wrote to memory of 3448 3916 rundll32.exe 68 PID 3916 wrote to memory of 3448 3916 rundll32.exe 68 PID 3916 wrote to memory of 3448 3916 rundll32.exe 68 PID 3916 wrote to memory of 3448 3916 rundll32.exe 68 PID 3916 wrote to memory of 3448 3916 rundll32.exe 68 PID 3916 wrote to memory of 3448 3916 rundll32.exe 68 PID 3916 wrote to memory of 3448 3916 rundll32.exe 68 PID 3916 wrote to memory of 3448 3916 rundll32.exe 68 PID 3916 wrote to memory of 3448 3916 rundll32.exe 68 PID 3916 wrote to memory of 3448 3916 rundll32.exe 68 PID 3916 wrote to memory of 3448 3916 rundll32.exe 68 PID 3916 wrote to memory of 3448 3916 rundll32.exe 68 PID 3916 wrote to memory of 3448 3916 rundll32.exe 68 PID 3916 wrote to memory of 3448 3916 rundll32.exe 68 PID 3916 wrote to memory of 3448 3916 rundll32.exe 68 PID 3916 wrote to memory of 3448 3916 rundll32.exe 68 PID 3916 wrote to memory of 3448 3916 rundll32.exe 68 PID 3916 wrote to memory of 3448 3916 rundll32.exe 68 PID 3916 wrote to memory of 3448 3916 rundll32.exe 68 PID 3916 wrote to memory of 3448 3916 rundll32.exe 68 PID 3916 wrote to memory of 3448 3916 rundll32.exe 68 PID 3916 wrote to memory of 3448 3916 rundll32.exe 68 PID 3916 wrote to memory of 3448 3916 rundll32.exe 68 PID 3916 wrote to memory of 3448 3916 rundll32.exe 68 PID 3916 wrote to memory of 3448 3916 rundll32.exe 68 PID 3916 wrote to memory of 3448 3916 rundll32.exe 68 PID 3916 wrote to memory of 3448 3916 rundll32.exe 68 PID 3916 wrote to memory of 3448 3916 rundll32.exe 68 PID 3916 wrote to memory of 3448 3916 rundll32.exe 68 PID 3916 wrote to memory of 3448 3916 rundll32.exe 68 PID 3916 wrote to memory of 3448 3916 rundll32.exe 68 PID 3916 wrote to memory of 3448 3916 rundll32.exe 68 PID 3916 wrote to memory of 3448 3916 rundll32.exe 68 PID 3916 wrote to memory of 3448 3916 rundll32.exe 68 PID 3916 wrote to memory of 3448 3916 rundll32.exe 68 PID 3916 wrote to memory of 3448 3916 rundll32.exe 68 PID 3916 wrote to memory of 3448 3916 rundll32.exe 68 PID 3916 wrote to memory of 3448 3916 rundll32.exe 68 PID 3916 wrote to memory of 3448 3916 rundll32.exe 68 PID 3916 wrote to memory of 3448 3916 rundll32.exe 68 PID 3916 wrote to memory of 3448 3916 rundll32.exe 68 PID 3916 wrote to memory of 3448 3916 rundll32.exe 68 PID 3916 wrote to memory of 3448 3916 rundll32.exe 68 PID 3916 wrote to memory of 3448 3916 rundll32.exe 68 PID 3916 wrote to memory of 3448 3916 rundll32.exe 68 PID 3916 wrote to memory of 3448 3916 rundll32.exe 68 PID 3916 wrote to memory of 3448 3916 rundll32.exe 68 PID 3916 wrote to memory of 3448 3916 rundll32.exe 68 PID 3916 wrote to memory of 3448 3916 rundll32.exe 68 - Loads dropped DLL 1 IoCs
pid Process 3916 rundll32.exe - Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 3916 rundll32.exe - Suspicious behavior: MapViewOfSection 1 IoCs
pid Process 3916 rundll32.exe - Blacklisted process makes network request 4 IoCs
flow pid Process 3 3448 cmd.exe 4 3448 cmd.exe 5 3448 cmd.exe 12 3448 cmd.exe - Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 3448 cmd.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Quotation_pdf.exe"C:\Users\Admin\AppData\Local\Temp\Quotation_pdf.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2460 -
C:\Windows\SysWOW64\rundll32.exeC:\Windows\system32\rundll32.exe BicornGasohol,Sunhats2⤵
- Suspicious use of WriteProcessMemory
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:3916 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe"3⤵
- Blacklisted process makes network request
- Suspicious use of AdjustPrivilegeToken
PID:3448
-
-