Analysis
- max time kernel
100s - max time network
101s - platform
windows10_x64 - resource
win10v200722 - submitted
20/09/2020, 03:59
Static task
static1
Behavioral task
behavioral1
Sample
46b674fd08c91d314f0f03c3a4f11b8f.exe
Resource
win7
windows7_x64
0 signatures
0 seconds
General
- Target 46b674fd08c91d314f0f03c3a4f11b8f.exe
- Size 364KB
- Sample200920-ess2bsz1lx
- SHA256 14b23833a0069ece9c114d554b406c7f1da45fdcd910ecee37fbf0136aa09af2
- MD5 46b674fd08c91d314f0f03c3a4f11b8f
- SHA1 5fd81f98e511e67a3c0bbca16dcb7802f3a3308b
- SHA512 bbb93ecd4ca9bc9fd08f2fc73437647dfa2c2433c0349edf7ec8d091d428444090b4c7d178e6a55c62554393db987e906b16115c578d6b8deef317ea8b24e19b
- MD5 SHA1 SHA512
Malware Config
Extracted
Family
-
lokibot
C2
-
http://remzclot.ga/etc/main/l09/ap0s/home.php
-
http://kbfvzoboss.bid/alien/fre.php
-
http://alphastand.trade/alien/fre.php
-
http://alphastand.win/alien/fre.php
-
http://alphastand.top/alien/fre.php
Signatures
- Blacklisted process makes network request 4 IoCs
flow pid Process 15 3940 cmd.exe 16 3940 cmd.exe 17 3940 cmd.exe 18 3940 cmd.exe - Loads dropped DLL 1 IoCs
pid Process 2740 rundll32.exe - Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 2740 rundll32.exe 2740 rundll32.exe - Suspicious behavior: MapViewOfSection 2 IoCs
pid Process 2740 rundll32.exe 2740 rundll32.exe - Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 3940 cmd.exe - Suspicious use of WriteProcessMemory 87 IoCs
description pid Process procid_target PID 2096 wrote to memory of 2740 2096 46b674fd08c91d314f0f03c3a4f11b8f.exe 72 PID 2096 wrote to memory of 2740 2096 46b674fd08c91d314f0f03c3a4f11b8f.exe 72 PID 2096 wrote to memory of 2740 2096 46b674fd08c91d314f0f03c3a4f11b8f.exe 72 PID 2740 wrote to memory of 3876 2740 rundll32.exe 73 PID 2740 wrote to memory of 3876 2740 rundll32.exe 73 PID 2740 wrote to memory of 3876 2740 rundll32.exe 73 PID 2740 wrote to memory of 3876 2740 rundll32.exe 73 PID 2740 wrote to memory of 3940 2740 rundll32.exe 74 PID 2740 wrote to memory of 3940 2740 rundll32.exe 74 PID 2740 wrote to memory of 3940 2740 rundll32.exe 74 PID 2740 wrote to memory of 3940 2740 rundll32.exe 74 PID 2740 wrote to memory of 3940 2740 rundll32.exe 74 PID 2740 wrote to memory of 3940 2740 rundll32.exe 74 PID 2740 wrote to memory of 3940 2740 rundll32.exe 74 PID 2740 wrote to memory of 3940 2740 rundll32.exe 74 PID 2740 wrote to memory of 3940 2740 rundll32.exe 74 PID 2740 wrote to memory of 3940 2740 rundll32.exe 74 PID 2740 wrote to memory of 3940 2740 rundll32.exe 74 PID 2740 wrote to memory of 3940 2740 rundll32.exe 74 PID 2740 wrote to memory of 3940 2740 rundll32.exe 74 PID 2740 wrote to memory of 3940 2740 rundll32.exe 74 PID 2740 wrote to memory of 3940 2740 rundll32.exe 74 PID 2740 wrote to memory of 3940 2740 rundll32.exe 74 PID 2740 wrote to memory of 3940 2740 rundll32.exe 74 PID 2740 wrote to memory of 3940 2740 rundll32.exe 74 PID 2740 wrote to memory of 3940 2740 rundll32.exe 74 PID 2740 wrote to memory of 3940 2740 rundll32.exe 74 PID 2740 wrote to memory of 3940 2740 rundll32.exe 74 PID 2740 wrote to memory of 3940 2740 rundll32.exe 74 PID 2740 wrote to memory of 3940 2740 rundll32.exe 74 PID 2740 wrote to memory of 3940 2740 rundll32.exe 74 PID 2740 wrote to memory of 3940 2740 rundll32.exe 74 PID 2740 wrote to memory of 3940 2740 rundll32.exe 74 PID 2740 wrote to memory of 3940 2740 rundll32.exe 74 PID 2740 wrote to memory of 3940 2740 rundll32.exe 74 PID 2740 wrote to memory of 3940 2740 rundll32.exe 74 PID 2740 wrote to memory of 3940 2740 rundll32.exe 74 PID 2740 wrote to memory of 3940 2740 rundll32.exe 74 PID 2740 wrote to memory of 3940 2740 rundll32.exe 74 PID 2740 wrote to memory of 3940 2740 rundll32.exe 74 PID 2740 wrote to memory of 3940 2740 rundll32.exe 74 PID 2740 wrote to memory of 3940 2740 rundll32.exe 74 PID 2740 wrote to memory of 3940 2740 rundll32.exe 74 PID 2740 wrote to memory of 3940 2740 rundll32.exe 74 PID 2740 wrote to memory of 3940 2740 rundll32.exe 74 PID 2740 wrote to memory of 3940 2740 rundll32.exe 74 PID 2740 wrote to memory of 3940 2740 rundll32.exe 74 PID 2740 wrote to memory of 3940 2740 rundll32.exe 74 PID 2740 wrote to memory of 3940 2740 rundll32.exe 74 PID 2740 wrote to memory of 3940 2740 rundll32.exe 74 PID 2740 wrote to memory of 3940 2740 rundll32.exe 74 PID 2740 wrote to memory of 3940 2740 rundll32.exe 74 PID 2740 wrote to memory of 3940 2740 rundll32.exe 74 PID 2740 wrote to memory of 3940 2740 rundll32.exe 74 PID 2740 wrote to memory of 3940 2740 rundll32.exe 74 PID 2740 wrote to memory of 3940 2740 rundll32.exe 74 PID 2740 wrote to memory of 3940 2740 rundll32.exe 74 PID 2740 wrote to memory of 3940 2740 rundll32.exe 74 PID 2740 wrote to memory of 3940 2740 rundll32.exe 74 PID 2740 wrote to memory of 3940 2740 rundll32.exe 74 PID 2740 wrote to memory of 3940 2740 rundll32.exe 74 PID 2740 wrote to memory of 3940 2740 rundll32.exe 74 PID 2740 wrote to memory of 3940 2740 rundll32.exe 74 PID 2740 wrote to memory of 3940 2740 rundll32.exe 74 PID 2740 wrote to memory of 3940 2740 rundll32.exe 74 PID 2740 wrote to memory of 3940 2740 rundll32.exe 74 PID 2740 wrote to memory of 3940 2740 rundll32.exe 74 PID 2740 wrote to memory of 3940 2740 rundll32.exe 74 PID 2740 wrote to memory of 3940 2740 rundll32.exe 74 PID 2740 wrote to memory of 3940 2740 rundll32.exe 74 PID 2740 wrote to memory of 3940 2740 rundll32.exe 74 PID 2740 wrote to memory of 3940 2740 rundll32.exe 74 PID 2740 wrote to memory of 3940 2740 rundll32.exe 74 PID 2740 wrote to memory of 3940 2740 rundll32.exe 74 PID 2740 wrote to memory of 3940 2740 rundll32.exe 74 PID 2740 wrote to memory of 3940 2740 rundll32.exe 74 PID 2740 wrote to memory of 3940 2740 rundll32.exe 74 PID 2740 wrote to memory of 3940 2740 rundll32.exe 74 PID 2740 wrote to memory of 3940 2740 rundll32.exe 74 PID 2740 wrote to memory of 3940 2740 rundll32.exe 74 PID 2740 wrote to memory of 3940 2740 rundll32.exe 74 PID 2740 wrote to memory of 3940 2740 rundll32.exe 74 PID 2740 wrote to memory of 3940 2740 rundll32.exe 74 PID 2740 wrote to memory of 3940 2740 rundll32.exe 74 PID 2740 wrote to memory of 3940 2740 rundll32.exe 74 PID 2740 wrote to memory of 3940 2740 rundll32.exe 74 PID 2740 wrote to memory of 3940 2740 rundll32.exe 74
Processes
-
C:\Users\Admin\AppData\Local\Temp\46b674fd08c91d314f0f03c3a4f11b8f.exe"C:\Users\Admin\AppData\Local\Temp\46b674fd08c91d314f0f03c3a4f11b8f.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2096 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe Antipodean,Uboats2⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:2740 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe"3⤵PID:3876
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe"3⤵
- Blacklisted process makes network request
- Suspicious use of AdjustPrivilegeToken
PID:3940
-
-