Analysis
- max time kernel
139s - max time network
150s - platform
windows10_x64 - resource
win10v200722 - submitted
06/10/2020, 05:23
Static task
static1
Behavioral task
behavioral1
Sample
b7104d9645c1c8c9c054785027c6a33f.exe
Resource
win7
windows7_x64
0 signatures
0 seconds
General
- Target b7104d9645c1c8c9c054785027c6a33f.exe
- Size 582KB
- Sample201006-sqg4evmcxe
- SHA256 3e32845eeb74c41195c5ecdbb053ae6a29ec8b66dedac32ddd625ac8d4913fac
- MD5 b7104d9645c1c8c9c054785027c6a33f
- SHA1 86ee9d136ec2b24d329dfb5365884ef2b94bec9d
- SHA512 82fd0940fdf2cbef82fff0f0ba7ea0a596b57813d057b4141b01c9ea4de6e07d589c3ee658616cfe8b3a19738e0841f0fa3b2b81da36b3d3cb91fd4075daaa1e
- MD5 SHA1 SHA512
Malware Config
Extracted
Family
-
lokibot
C2
-
http://remzclot.ga/etc/main/l09/harl/mode.php
-
http://kbfvzoboss.bid/alien/fre.php
-
http://alphastand.trade/alien/fre.php
-
http://alphastand.win/alien/fre.php
-
http://alphastand.top/alien/fre.php
Signatures
- Blacklisted process makes network request 6 IoCs
flow pid Process 16 3848 cmd.exe 17 3848 cmd.exe 19 3848 cmd.exe 20 3848 cmd.exe 21 3848 cmd.exe 22 3848 cmd.exe - Loads dropped DLL 1 IoCs
pid Process 2620 rundll32.exe - Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 2620 rundll32.exe 2620 rundll32.exe - Suspicious behavior: MapViewOfSection 2 IoCs
pid Process 2620 rundll32.exe 2620 rundll32.exe - Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 3848 cmd.exe - Suspicious use of WriteProcessMemory 87 IoCs
description pid Process procid_target PID 4040 wrote to memory of 2620 4040 b7104d9645c1c8c9c054785027c6a33f.exe 72 PID 4040 wrote to memory of 2620 4040 b7104d9645c1c8c9c054785027c6a33f.exe 72 PID 4040 wrote to memory of 2620 4040 b7104d9645c1c8c9c054785027c6a33f.exe 72 PID 2620 wrote to memory of 3860 2620 rundll32.exe 73 PID 2620 wrote to memory of 3860 2620 rundll32.exe 73 PID 2620 wrote to memory of 3860 2620 rundll32.exe 73 PID 2620 wrote to memory of 3860 2620 rundll32.exe 73 PID 2620 wrote to memory of 3848 2620 rundll32.exe 74 PID 2620 wrote to memory of 3848 2620 rundll32.exe 74 PID 2620 wrote to memory of 3848 2620 rundll32.exe 74 PID 2620 wrote to memory of 3848 2620 rundll32.exe 74 PID 2620 wrote to memory of 3848 2620 rundll32.exe 74 PID 2620 wrote to memory of 3848 2620 rundll32.exe 74 PID 2620 wrote to memory of 3848 2620 rundll32.exe 74 PID 2620 wrote to memory of 3848 2620 rundll32.exe 74 PID 2620 wrote to memory of 3848 2620 rundll32.exe 74 PID 2620 wrote to memory of 3848 2620 rundll32.exe 74 PID 2620 wrote to memory of 3848 2620 rundll32.exe 74 PID 2620 wrote to memory of 3848 2620 rundll32.exe 74 PID 2620 wrote to memory of 3848 2620 rundll32.exe 74 PID 2620 wrote to memory of 3848 2620 rundll32.exe 74 PID 2620 wrote to memory of 3848 2620 rundll32.exe 74 PID 2620 wrote to memory of 3848 2620 rundll32.exe 74 PID 2620 wrote to memory of 3848 2620 rundll32.exe 74 PID 2620 wrote to memory of 3848 2620 rundll32.exe 74 PID 2620 wrote to memory of 3848 2620 rundll32.exe 74 PID 2620 wrote to memory of 3848 2620 rundll32.exe 74 PID 2620 wrote to memory of 3848 2620 rundll32.exe 74 PID 2620 wrote to memory of 3848 2620 rundll32.exe 74 PID 2620 wrote to memory of 3848 2620 rundll32.exe 74 PID 2620 wrote to memory of 3848 2620 rundll32.exe 74 PID 2620 wrote to memory of 3848 2620 rundll32.exe 74 PID 2620 wrote to memory of 3848 2620 rundll32.exe 74 PID 2620 wrote to memory of 3848 2620 rundll32.exe 74 PID 2620 wrote to memory of 3848 2620 rundll32.exe 74 PID 2620 wrote to memory of 3848 2620 rundll32.exe 74 PID 2620 wrote to memory of 3848 2620 rundll32.exe 74 PID 2620 wrote to memory of 3848 2620 rundll32.exe 74 PID 2620 wrote to memory of 3848 2620 rundll32.exe 74 PID 2620 wrote to memory of 3848 2620 rundll32.exe 74 PID 2620 wrote to memory of 3848 2620 rundll32.exe 74 PID 2620 wrote to memory of 3848 2620 rundll32.exe 74 PID 2620 wrote to memory of 3848 2620 rundll32.exe 74 PID 2620 wrote to memory of 3848 2620 rundll32.exe 74 PID 2620 wrote to memory of 3848 2620 rundll32.exe 74 PID 2620 wrote to memory of 3848 2620 rundll32.exe 74 PID 2620 wrote to memory of 3848 2620 rundll32.exe 74 PID 2620 wrote to memory of 3848 2620 rundll32.exe 74 PID 2620 wrote to memory of 3848 2620 rundll32.exe 74 PID 2620 wrote to memory of 3848 2620 rundll32.exe 74 PID 2620 wrote to memory of 3848 2620 rundll32.exe 74 PID 2620 wrote to memory of 3848 2620 rundll32.exe 74 PID 2620 wrote to memory of 3848 2620 rundll32.exe 74 PID 2620 wrote to memory of 3848 2620 rundll32.exe 74 PID 2620 wrote to memory of 3848 2620 rundll32.exe 74 PID 2620 wrote to memory of 3848 2620 rundll32.exe 74 PID 2620 wrote to memory of 3848 2620 rundll32.exe 74 PID 2620 wrote to memory of 3848 2620 rundll32.exe 74 PID 2620 wrote to memory of 3848 2620 rundll32.exe 74 PID 2620 wrote to memory of 3848 2620 rundll32.exe 74 PID 2620 wrote to memory of 3848 2620 rundll32.exe 74 PID 2620 wrote to memory of 3848 2620 rundll32.exe 74 PID 2620 wrote to memory of 3848 2620 rundll32.exe 74 PID 2620 wrote to memory of 3848 2620 rundll32.exe 74 PID 2620 wrote to memory of 3848 2620 rundll32.exe 74 PID 2620 wrote to memory of 3848 2620 rundll32.exe 74 PID 2620 wrote to memory of 3848 2620 rundll32.exe 74 PID 2620 wrote to memory of 3848 2620 rundll32.exe 74 PID 2620 wrote to memory of 3848 2620 rundll32.exe 74 PID 2620 wrote to memory of 3848 2620 rundll32.exe 74 PID 2620 wrote to memory of 3848 2620 rundll32.exe 74 PID 2620 wrote to memory of 3848 2620 rundll32.exe 74 PID 2620 wrote to memory of 3848 2620 rundll32.exe 74 PID 2620 wrote to memory of 3848 2620 rundll32.exe 74 PID 2620 wrote to memory of 3848 2620 rundll32.exe 74 PID 2620 wrote to memory of 3848 2620 rundll32.exe 74 PID 2620 wrote to memory of 3848 2620 rundll32.exe 74 PID 2620 wrote to memory of 3848 2620 rundll32.exe 74 PID 2620 wrote to memory of 3848 2620 rundll32.exe 74 PID 2620 wrote to memory of 3848 2620 rundll32.exe 74 PID 2620 wrote to memory of 3848 2620 rundll32.exe 74 PID 2620 wrote to memory of 3848 2620 rundll32.exe 74 PID 2620 wrote to memory of 3848 2620 rundll32.exe 74 PID 2620 wrote to memory of 3848 2620 rundll32.exe 74 PID 2620 wrote to memory of 3848 2620 rundll32.exe 74 PID 2620 wrote to memory of 3848 2620 rundll32.exe 74 PID 2620 wrote to memory of 3848 2620 rundll32.exe 74
Processes
-
C:\Users\Admin\AppData\Local\Temp\b7104d9645c1c8c9c054785027c6a33f.exe"C:\Users\Admin\AppData\Local\Temp\b7104d9645c1c8c9c054785027c6a33f.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4040 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe KinemaPergola,Chuddar2⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:2620 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe"3⤵PID:3860
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe"3⤵
- Blacklisted process makes network request
- Suspicious use of AdjustPrivilegeToken
PID:3848
-
-