Analysis
- max time kernel
127s - max time network
140s - platform
windows10_x64 - resource
win10 - submitted
13/08/2020, 10:21
Static task
static1
Behavioral task
behavioral1
Sample
svchost.exe
Resource
win7
windows7_x64
0 signatures
0 seconds
General
- Target svchost.exe
- Size 387KB
- Sample200813-5fvca68nq6
- SHA256 088999945f71cb731f4fa4d6e73591ecdf1829306a6dca66be75947fc0c8d00b
- MD5 af9d22c150caf1b9885db08677b3a1b2
- SHA1 eb10c7b23f2c3a881699a14b3c2b7cd4d5cad579
- SHA512 a05a68639ab1d3f3003a70633db5646f020cbf062b296ecd6b4d091d51c27fbe1b9c698675e4b60d30c09a7ddc0aae37c2d24a2befdd16ebd7e5ae6245595791
- MD5 SHA1 SHA512
Malware Config
Extracted
Family
-
lokibot
C2
-
http://goldrealestate.ga/choolee/gate.php
-
http://kbfvzoboss.bid/alien/fre.php
-
http://alphastand.trade/alien/fre.php
-
http://alphastand.win/alien/fre.php
-
http://alphastand.top/alien/fre.php
Signatures
- Blacklisted process makes network request 4 IoCs
flow pid Process 5 1840 cmd.exe 6 1840 cmd.exe 7 1840 cmd.exe 12 1840 cmd.exe - Loads dropped DLL 1 IoCs
pid Process 3800 rundll32.exe - Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Drops file in Program Files directory 1 IoCs
description ioc Process File created C:\Program Files (x86)\Unbound\uninstall.exe svchost.exe - Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 3800 rundll32.exe 3800 rundll32.exe - Suspicious behavior: MapViewOfSection 2 IoCs
pid Process 3800 rundll32.exe 3800 rundll32.exe - Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 1840 cmd.exe - Suspicious use of WriteProcessMemory 87 IoCs
description pid Process procid_target PID 3888 wrote to memory of 3800 3888 svchost.exe 67 PID 3888 wrote to memory of 3800 3888 svchost.exe 67 PID 3888 wrote to memory of 3800 3888 svchost.exe 67 PID 3800 wrote to memory of 3780 3800 rundll32.exe 68 PID 3800 wrote to memory of 3780 3800 rundll32.exe 68 PID 3800 wrote to memory of 3780 3800 rundll32.exe 68 PID 3800 wrote to memory of 3780 3800 rundll32.exe 68 PID 3800 wrote to memory of 1840 3800 rundll32.exe 69 PID 3800 wrote to memory of 1840 3800 rundll32.exe 69 PID 3800 wrote to memory of 1840 3800 rundll32.exe 69 PID 3800 wrote to memory of 1840 3800 rundll32.exe 69 PID 3800 wrote to memory of 1840 3800 rundll32.exe 69 PID 3800 wrote to memory of 1840 3800 rundll32.exe 69 PID 3800 wrote to memory of 1840 3800 rundll32.exe 69 PID 3800 wrote to memory of 1840 3800 rundll32.exe 69 PID 3800 wrote to memory of 1840 3800 rundll32.exe 69 PID 3800 wrote to memory of 1840 3800 rundll32.exe 69 PID 3800 wrote to memory of 1840 3800 rundll32.exe 69 PID 3800 wrote to memory of 1840 3800 rundll32.exe 69 PID 3800 wrote to memory of 1840 3800 rundll32.exe 69 PID 3800 wrote to memory of 1840 3800 rundll32.exe 69 PID 3800 wrote to memory of 1840 3800 rundll32.exe 69 PID 3800 wrote to memory of 1840 3800 rundll32.exe 69 PID 3800 wrote to memory of 1840 3800 rundll32.exe 69 PID 3800 wrote to memory of 1840 3800 rundll32.exe 69 PID 3800 wrote to memory of 1840 3800 rundll32.exe 69 PID 3800 wrote to memory of 1840 3800 rundll32.exe 69 PID 3800 wrote to memory of 1840 3800 rundll32.exe 69 PID 3800 wrote to memory of 1840 3800 rundll32.exe 69 PID 3800 wrote to memory of 1840 3800 rundll32.exe 69 PID 3800 wrote to memory of 1840 3800 rundll32.exe 69 PID 3800 wrote to memory of 1840 3800 rundll32.exe 69 PID 3800 wrote to memory of 1840 3800 rundll32.exe 69 PID 3800 wrote to memory of 1840 3800 rundll32.exe 69 PID 3800 wrote to memory of 1840 3800 rundll32.exe 69 PID 3800 wrote to memory of 1840 3800 rundll32.exe 69 PID 3800 wrote to memory of 1840 3800 rundll32.exe 69 PID 3800 wrote to memory of 1840 3800 rundll32.exe 69 PID 3800 wrote to memory of 1840 3800 rundll32.exe 69 PID 3800 wrote to memory of 1840 3800 rundll32.exe 69 PID 3800 wrote to memory of 1840 3800 rundll32.exe 69 PID 3800 wrote to memory of 1840 3800 rundll32.exe 69 PID 3800 wrote to memory of 1840 3800 rundll32.exe 69 PID 3800 wrote to memory of 1840 3800 rundll32.exe 69 PID 3800 wrote to memory of 1840 3800 rundll32.exe 69 PID 3800 wrote to memory of 1840 3800 rundll32.exe 69 PID 3800 wrote to memory of 1840 3800 rundll32.exe 69 PID 3800 wrote to memory of 1840 3800 rundll32.exe 69 PID 3800 wrote to memory of 1840 3800 rundll32.exe 69 PID 3800 wrote to memory of 1840 3800 rundll32.exe 69 PID 3800 wrote to memory of 1840 3800 rundll32.exe 69 PID 3800 wrote to memory of 1840 3800 rundll32.exe 69 PID 3800 wrote to memory of 1840 3800 rundll32.exe 69 PID 3800 wrote to memory of 1840 3800 rundll32.exe 69 PID 3800 wrote to memory of 1840 3800 rundll32.exe 69 PID 3800 wrote to memory of 1840 3800 rundll32.exe 69 PID 3800 wrote to memory of 1840 3800 rundll32.exe 69 PID 3800 wrote to memory of 1840 3800 rundll32.exe 69 PID 3800 wrote to memory of 1840 3800 rundll32.exe 69 PID 3800 wrote to memory of 1840 3800 rundll32.exe 69 PID 3800 wrote to memory of 1840 3800 rundll32.exe 69 PID 3800 wrote to memory of 1840 3800 rundll32.exe 69 PID 3800 wrote to memory of 1840 3800 rundll32.exe 69 PID 3800 wrote to memory of 1840 3800 rundll32.exe 69 PID 3800 wrote to memory of 1840 3800 rundll32.exe 69 PID 3800 wrote to memory of 1840 3800 rundll32.exe 69 PID 3800 wrote to memory of 1840 3800 rundll32.exe 69 PID 3800 wrote to memory of 1840 3800 rundll32.exe 69 PID 3800 wrote to memory of 1840 3800 rundll32.exe 69 PID 3800 wrote to memory of 1840 3800 rundll32.exe 69 PID 3800 wrote to memory of 1840 3800 rundll32.exe 69 PID 3800 wrote to memory of 1840 3800 rundll32.exe 69 PID 3800 wrote to memory of 1840 3800 rundll32.exe 69 PID 3800 wrote to memory of 1840 3800 rundll32.exe 69 PID 3800 wrote to memory of 1840 3800 rundll32.exe 69 PID 3800 wrote to memory of 1840 3800 rundll32.exe 69 PID 3800 wrote to memory of 1840 3800 rundll32.exe 69 PID 3800 wrote to memory of 1840 3800 rundll32.exe 69 PID 3800 wrote to memory of 1840 3800 rundll32.exe 69 PID 3800 wrote to memory of 1840 3800 rundll32.exe 69 PID 3800 wrote to memory of 1840 3800 rundll32.exe 69 PID 3800 wrote to memory of 1840 3800 rundll32.exe 69 PID 3800 wrote to memory of 1840 3800 rundll32.exe 69 PID 3800 wrote to memory of 1840 3800 rundll32.exe 69 PID 3800 wrote to memory of 1840 3800 rundll32.exe 69 PID 3800 wrote to memory of 1840 3800 rundll32.exe 69 PID 3800 wrote to memory of 1840 3800 rundll32.exe 69
Processes
-
C:\Users\Admin\AppData\Local\Temp\svchost.exe"C:\Users\Admin\AppData\Local\Temp\svchost.exe"1⤵
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:3888 -
C:\Windows\SysWOW64\rundll32.exeC:\Windows\system32\rundll32.exe LobeliaHalide,Minyan2⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:3800 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe"3⤵PID:3780
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe"3⤵
- Blacklisted process makes network request
- Suspicious use of AdjustPrivilegeToken
PID:1840
-
-