Analysis
- max time kernel
140s - max time network
149s - platform
windows7_x64 - resource
win7 - submitted
06/10/2020, 05:23
Static task
static1
Behavioral task
behavioral1
Sample
b7104d9645c1c8c9c054785027c6a33f.exe
Resource
win7
windows7_x64
0 signatures
0 seconds
General
- Target b7104d9645c1c8c9c054785027c6a33f.exe
- Size 582KB
- Sample201006-sqg4evmcxe
- SHA256 3e32845eeb74c41195c5ecdbb053ae6a29ec8b66dedac32ddd625ac8d4913fac
- MD5 b7104d9645c1c8c9c054785027c6a33f
- SHA1 86ee9d136ec2b24d329dfb5365884ef2b94bec9d
- SHA512 82fd0940fdf2cbef82fff0f0ba7ea0a596b57813d057b4141b01c9ea4de6e07d589c3ee658616cfe8b3a19738e0841f0fa3b2b81da36b3d3cb91fd4075daaa1e
- MD5 SHA1 SHA512
Malware Config
Extracted
Family
-
lokibot
C2
-
http://remzclot.ga/etc/main/l09/harl/mode.php
-
http://kbfvzoboss.bid/alien/fre.php
-
http://alphastand.trade/alien/fre.php
-
http://alphastand.win/alien/fre.php
-
http://alphastand.top/alien/fre.php
Signatures
- Blacklisted process makes network request 6 IoCs
flow pid Process 4 1304 cmd.exe 5 1304 cmd.exe 8 1304 cmd.exe 9 1304 cmd.exe 10 1304 cmd.exe 11 1304 cmd.exe - Loads dropped DLL 1 IoCs
pid Process 1888 rundll32.exe - Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 1888 rundll32.exe - Suspicious behavior: MapViewOfSection 1 IoCs
pid Process 1888 rundll32.exe - Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 1304 cmd.exe - Suspicious use of WriteProcessMemory 48 IoCs
description pid Process procid_target PID 1544 wrote to memory of 1888 1544 b7104d9645c1c8c9c054785027c6a33f.exe 26 PID 1544 wrote to memory of 1888 1544 b7104d9645c1c8c9c054785027c6a33f.exe 26 PID 1544 wrote to memory of 1888 1544 b7104d9645c1c8c9c054785027c6a33f.exe 26 PID 1544 wrote to memory of 1888 1544 b7104d9645c1c8c9c054785027c6a33f.exe 26 PID 1544 wrote to memory of 1888 1544 b7104d9645c1c8c9c054785027c6a33f.exe 26 PID 1544 wrote to memory of 1888 1544 b7104d9645c1c8c9c054785027c6a33f.exe 26 PID 1544 wrote to memory of 1888 1544 b7104d9645c1c8c9c054785027c6a33f.exe 26 PID 1888 wrote to memory of 1304 1888 rundll32.exe 27 PID 1888 wrote to memory of 1304 1888 rundll32.exe 27 PID 1888 wrote to memory of 1304 1888 rundll32.exe 27 PID 1888 wrote to memory of 1304 1888 rundll32.exe 27 PID 1888 wrote to memory of 1304 1888 rundll32.exe 27 PID 1888 wrote to memory of 1304 1888 rundll32.exe 27 PID 1888 wrote to memory of 1304 1888 rundll32.exe 27 PID 1888 wrote to memory of 1304 1888 rundll32.exe 27 PID 1888 wrote to memory of 1304 1888 rundll32.exe 27 PID 1888 wrote to memory of 1304 1888 rundll32.exe 27 PID 1888 wrote to memory of 1304 1888 rundll32.exe 27 PID 1888 wrote to memory of 1304 1888 rundll32.exe 27 PID 1888 wrote to memory of 1304 1888 rundll32.exe 27 PID 1888 wrote to memory of 1304 1888 rundll32.exe 27 PID 1888 wrote to memory of 1304 1888 rundll32.exe 27 PID 1888 wrote to memory of 1304 1888 rundll32.exe 27 PID 1888 wrote to memory of 1304 1888 rundll32.exe 27 PID 1888 wrote to memory of 1304 1888 rundll32.exe 27 PID 1888 wrote to memory of 1304 1888 rundll32.exe 27 PID 1888 wrote to memory of 1304 1888 rundll32.exe 27 PID 1888 wrote to memory of 1304 1888 rundll32.exe 27 PID 1888 wrote to memory of 1304 1888 rundll32.exe 27 PID 1888 wrote to memory of 1304 1888 rundll32.exe 27 PID 1888 wrote to memory of 1304 1888 rundll32.exe 27 PID 1888 wrote to memory of 1304 1888 rundll32.exe 27 PID 1888 wrote to memory of 1304 1888 rundll32.exe 27 PID 1888 wrote to memory of 1304 1888 rundll32.exe 27 PID 1888 wrote to memory of 1304 1888 rundll32.exe 27 PID 1888 wrote to memory of 1304 1888 rundll32.exe 27 PID 1888 wrote to memory of 1304 1888 rundll32.exe 27 PID 1888 wrote to memory of 1304 1888 rundll32.exe 27 PID 1888 wrote to memory of 1304 1888 rundll32.exe 27 PID 1888 wrote to memory of 1304 1888 rundll32.exe 27 PID 1888 wrote to memory of 1304 1888 rundll32.exe 27 PID 1888 wrote to memory of 1304 1888 rundll32.exe 27 PID 1888 wrote to memory of 1304 1888 rundll32.exe 27 PID 1888 wrote to memory of 1304 1888 rundll32.exe 27 PID 1888 wrote to memory of 1304 1888 rundll32.exe 27 PID 1888 wrote to memory of 1304 1888 rundll32.exe 27 PID 1888 wrote to memory of 1304 1888 rundll32.exe 27 PID 1888 wrote to memory of 1304 1888 rundll32.exe 27
Processes
-
C:\Users\Admin\AppData\Local\Temp\b7104d9645c1c8c9c054785027c6a33f.exe"C:\Users\Admin\AppData\Local\Temp\b7104d9645c1c8c9c054785027c6a33f.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1544 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe KinemaPergola,Chuddar2⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1888 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe"3⤵
- Blacklisted process makes network request
- Suspicious use of AdjustPrivilegeToken
PID:1304
-
-