Analysis
- max time kernel
145s - max time network
156s - platform
windows7_x64 - resource
win7 - submitted
06/10/2020, 05:24
Static task
static1
Behavioral task
behavioral1
Sample
98b619b55b0fa736d5d1aec2ad1aa36c.exe
Resource
win7
windows7_x64
0 signatures
0 seconds
General
- Target 98b619b55b0fa736d5d1aec2ad1aa36c.exe
- Size 582KB
- Sample201006-y8bml4am8x
- SHA256 df8b425e4f5ce5faef299b2f83aabdc9a1d9f2d28be9aaf4e41215488820c0d9
- MD5 98b619b55b0fa736d5d1aec2ad1aa36c
- SHA1 2ddcbf17dc3b2a26598b90ed06c4742d1d2153e4
- SHA512 d0da6752bd175860940095f7e5994b42a974784aab0bafd638ca58a52080c9d43fb620c44f92b07b1b992357fc688493a874f7f0c5e588d48f2803ad945237bf
- MD5 SHA1 SHA512
Malware Config
Extracted
Family
-
lokibot
C2
-
http://remzclot.ga/etc/main/l09/ap0s/home.php
-
http://kbfvzoboss.bid/alien/fre.php
-
http://alphastand.trade/alien/fre.php
-
http://alphastand.win/alien/fre.php
-
http://alphastand.top/alien/fre.php
Signatures
- Blacklisted process makes network request 6 IoCs
flow pid Process 5 1576 cmd.exe 8 1576 cmd.exe 9 1576 cmd.exe 10 1576 cmd.exe 11 1576 cmd.exe 12 1576 cmd.exe - Loads dropped DLL 1 IoCs
pid Process 1748 rundll32.exe - Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 1748 rundll32.exe - Suspicious behavior: MapViewOfSection 1 IoCs
pid Process 1748 rundll32.exe - Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 1576 cmd.exe - Suspicious use of WriteProcessMemory 48 IoCs
description pid Process procid_target PID 1496 wrote to memory of 1748 1496 98b619b55b0fa736d5d1aec2ad1aa36c.exe 28 PID 1496 wrote to memory of 1748 1496 98b619b55b0fa736d5d1aec2ad1aa36c.exe 28 PID 1496 wrote to memory of 1748 1496 98b619b55b0fa736d5d1aec2ad1aa36c.exe 28 PID 1496 wrote to memory of 1748 1496 98b619b55b0fa736d5d1aec2ad1aa36c.exe 28 PID 1496 wrote to memory of 1748 1496 98b619b55b0fa736d5d1aec2ad1aa36c.exe 28 PID 1496 wrote to memory of 1748 1496 98b619b55b0fa736d5d1aec2ad1aa36c.exe 28 PID 1496 wrote to memory of 1748 1496 98b619b55b0fa736d5d1aec2ad1aa36c.exe 28 PID 1748 wrote to memory of 1576 1748 rundll32.exe 29 PID 1748 wrote to memory of 1576 1748 rundll32.exe 29 PID 1748 wrote to memory of 1576 1748 rundll32.exe 29 PID 1748 wrote to memory of 1576 1748 rundll32.exe 29 PID 1748 wrote to memory of 1576 1748 rundll32.exe 29 PID 1748 wrote to memory of 1576 1748 rundll32.exe 29 PID 1748 wrote to memory of 1576 1748 rundll32.exe 29 PID 1748 wrote to memory of 1576 1748 rundll32.exe 29 PID 1748 wrote to memory of 1576 1748 rundll32.exe 29 PID 1748 wrote to memory of 1576 1748 rundll32.exe 29 PID 1748 wrote to memory of 1576 1748 rundll32.exe 29 PID 1748 wrote to memory of 1576 1748 rundll32.exe 29 PID 1748 wrote to memory of 1576 1748 rundll32.exe 29 PID 1748 wrote to memory of 1576 1748 rundll32.exe 29 PID 1748 wrote to memory of 1576 1748 rundll32.exe 29 PID 1748 wrote to memory of 1576 1748 rundll32.exe 29 PID 1748 wrote to memory of 1576 1748 rundll32.exe 29 PID 1748 wrote to memory of 1576 1748 rundll32.exe 29 PID 1748 wrote to memory of 1576 1748 rundll32.exe 29 PID 1748 wrote to memory of 1576 1748 rundll32.exe 29 PID 1748 wrote to memory of 1576 1748 rundll32.exe 29 PID 1748 wrote to memory of 1576 1748 rundll32.exe 29 PID 1748 wrote to memory of 1576 1748 rundll32.exe 29 PID 1748 wrote to memory of 1576 1748 rundll32.exe 29 PID 1748 wrote to memory of 1576 1748 rundll32.exe 29 PID 1748 wrote to memory of 1576 1748 rundll32.exe 29 PID 1748 wrote to memory of 1576 1748 rundll32.exe 29 PID 1748 wrote to memory of 1576 1748 rundll32.exe 29 PID 1748 wrote to memory of 1576 1748 rundll32.exe 29 PID 1748 wrote to memory of 1576 1748 rundll32.exe 29 PID 1748 wrote to memory of 1576 1748 rundll32.exe 29 PID 1748 wrote to memory of 1576 1748 rundll32.exe 29 PID 1748 wrote to memory of 1576 1748 rundll32.exe 29 PID 1748 wrote to memory of 1576 1748 rundll32.exe 29 PID 1748 wrote to memory of 1576 1748 rundll32.exe 29 PID 1748 wrote to memory of 1576 1748 rundll32.exe 29 PID 1748 wrote to memory of 1576 1748 rundll32.exe 29 PID 1748 wrote to memory of 1576 1748 rundll32.exe 29 PID 1748 wrote to memory of 1576 1748 rundll32.exe 29 PID 1748 wrote to memory of 1576 1748 rundll32.exe 29 PID 1748 wrote to memory of 1576 1748 rundll32.exe 29
Processes
-
C:\Users\Admin\AppData\Local\Temp\98b619b55b0fa736d5d1aec2ad1aa36c.exe"C:\Users\Admin\AppData\Local\Temp\98b619b55b0fa736d5d1aec2ad1aa36c.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1496 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe KinemaPergola,Chuddar2⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1748 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe"3⤵
- Blacklisted process makes network request
- Suspicious use of AdjustPrivilegeToken
PID:1576
-
-