Analysis
- max time kernel
137s - max time network
146s - platform
windows10_x64 - resource
win10 - submitted
06/10/2020, 05:24
Static task
static1
Behavioral task
behavioral1
Sample
98b619b55b0fa736d5d1aec2ad1aa36c.exe
Resource
win7
windows7_x64
0 signatures
0 seconds
General
- Target 98b619b55b0fa736d5d1aec2ad1aa36c.exe
- Size 582KB
- Sample201006-y8bml4am8x
- SHA256 df8b425e4f5ce5faef299b2f83aabdc9a1d9f2d28be9aaf4e41215488820c0d9
- MD5 98b619b55b0fa736d5d1aec2ad1aa36c
- SHA1 2ddcbf17dc3b2a26598b90ed06c4742d1d2153e4
- SHA512 d0da6752bd175860940095f7e5994b42a974784aab0bafd638ca58a52080c9d43fb620c44f92b07b1b992357fc688493a874f7f0c5e588d48f2803ad945237bf
- MD5 SHA1 SHA512
Malware Config
Extracted
Family
-
lokibot
C2
-
http://remzclot.ga/etc/main/l09/ap0s/home.php
-
http://kbfvzoboss.bid/alien/fre.php
-
http://alphastand.trade/alien/fre.php
-
http://alphastand.win/alien/fre.php
-
http://alphastand.top/alien/fre.php
Signatures
- Blacklisted process makes network request 6 IoCs
flow pid Process 11 512 cmd.exe 12 512 cmd.exe 13 512 cmd.exe 14 512 cmd.exe 15 512 cmd.exe 16 512 cmd.exe - Loads dropped DLL 1 IoCs
pid Process 2180 rundll32.exe - Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 2180 rundll32.exe - Suspicious behavior: MapViewOfSection 1 IoCs
pid Process 2180 rundll32.exe - Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 512 cmd.exe - Suspicious use of WriteProcessMemory 83 IoCs
description pid Process procid_target PID 792 wrote to memory of 2180 792 98b619b55b0fa736d5d1aec2ad1aa36c.exe 72 PID 792 wrote to memory of 2180 792 98b619b55b0fa736d5d1aec2ad1aa36c.exe 72 PID 792 wrote to memory of 2180 792 98b619b55b0fa736d5d1aec2ad1aa36c.exe 72 PID 2180 wrote to memory of 512 2180 rundll32.exe 73 PID 2180 wrote to memory of 512 2180 rundll32.exe 73 PID 2180 wrote to memory of 512 2180 rundll32.exe 73 PID 2180 wrote to memory of 512 2180 rundll32.exe 73 PID 2180 wrote to memory of 512 2180 rundll32.exe 73 PID 2180 wrote to memory of 512 2180 rundll32.exe 73 PID 2180 wrote to memory of 512 2180 rundll32.exe 73 PID 2180 wrote to memory of 512 2180 rundll32.exe 73 PID 2180 wrote to memory of 512 2180 rundll32.exe 73 PID 2180 wrote to memory of 512 2180 rundll32.exe 73 PID 2180 wrote to memory of 512 2180 rundll32.exe 73 PID 2180 wrote to memory of 512 2180 rundll32.exe 73 PID 2180 wrote to memory of 512 2180 rundll32.exe 73 PID 2180 wrote to memory of 512 2180 rundll32.exe 73 PID 2180 wrote to memory of 512 2180 rundll32.exe 73 PID 2180 wrote to memory of 512 2180 rundll32.exe 73 PID 2180 wrote to memory of 512 2180 rundll32.exe 73 PID 2180 wrote to memory of 512 2180 rundll32.exe 73 PID 2180 wrote to memory of 512 2180 rundll32.exe 73 PID 2180 wrote to memory of 512 2180 rundll32.exe 73 PID 2180 wrote to memory of 512 2180 rundll32.exe 73 PID 2180 wrote to memory of 512 2180 rundll32.exe 73 PID 2180 wrote to memory of 512 2180 rundll32.exe 73 PID 2180 wrote to memory of 512 2180 rundll32.exe 73 PID 2180 wrote to memory of 512 2180 rundll32.exe 73 PID 2180 wrote to memory of 512 2180 rundll32.exe 73 PID 2180 wrote to memory of 512 2180 rundll32.exe 73 PID 2180 wrote to memory of 512 2180 rundll32.exe 73 PID 2180 wrote to memory of 512 2180 rundll32.exe 73 PID 2180 wrote to memory of 512 2180 rundll32.exe 73 PID 2180 wrote to memory of 512 2180 rundll32.exe 73 PID 2180 wrote to memory of 512 2180 rundll32.exe 73 PID 2180 wrote to memory of 512 2180 rundll32.exe 73 PID 2180 wrote to memory of 512 2180 rundll32.exe 73 PID 2180 wrote to memory of 512 2180 rundll32.exe 73 PID 2180 wrote to memory of 512 2180 rundll32.exe 73 PID 2180 wrote to memory of 512 2180 rundll32.exe 73 PID 2180 wrote to memory of 512 2180 rundll32.exe 73 PID 2180 wrote to memory of 512 2180 rundll32.exe 73 PID 2180 wrote to memory of 512 2180 rundll32.exe 73 PID 2180 wrote to memory of 512 2180 rundll32.exe 73 PID 2180 wrote to memory of 512 2180 rundll32.exe 73 PID 2180 wrote to memory of 512 2180 rundll32.exe 73 PID 2180 wrote to memory of 512 2180 rundll32.exe 73 PID 2180 wrote to memory of 512 2180 rundll32.exe 73 PID 2180 wrote to memory of 512 2180 rundll32.exe 73 PID 2180 wrote to memory of 512 2180 rundll32.exe 73 PID 2180 wrote to memory of 512 2180 rundll32.exe 73 PID 2180 wrote to memory of 512 2180 rundll32.exe 73 PID 2180 wrote to memory of 512 2180 rundll32.exe 73 PID 2180 wrote to memory of 512 2180 rundll32.exe 73 PID 2180 wrote to memory of 512 2180 rundll32.exe 73 PID 2180 wrote to memory of 512 2180 rundll32.exe 73 PID 2180 wrote to memory of 512 2180 rundll32.exe 73 PID 2180 wrote to memory of 512 2180 rundll32.exe 73 PID 2180 wrote to memory of 512 2180 rundll32.exe 73 PID 2180 wrote to memory of 512 2180 rundll32.exe 73 PID 2180 wrote to memory of 512 2180 rundll32.exe 73 PID 2180 wrote to memory of 512 2180 rundll32.exe 73 PID 2180 wrote to memory of 512 2180 rundll32.exe 73 PID 2180 wrote to memory of 512 2180 rundll32.exe 73 PID 2180 wrote to memory of 512 2180 rundll32.exe 73 PID 2180 wrote to memory of 512 2180 rundll32.exe 73 PID 2180 wrote to memory of 512 2180 rundll32.exe 73 PID 2180 wrote to memory of 512 2180 rundll32.exe 73 PID 2180 wrote to memory of 512 2180 rundll32.exe 73 PID 2180 wrote to memory of 512 2180 rundll32.exe 73 PID 2180 wrote to memory of 512 2180 rundll32.exe 73 PID 2180 wrote to memory of 512 2180 rundll32.exe 73 PID 2180 wrote to memory of 512 2180 rundll32.exe 73 PID 2180 wrote to memory of 512 2180 rundll32.exe 73 PID 2180 wrote to memory of 512 2180 rundll32.exe 73 PID 2180 wrote to memory of 512 2180 rundll32.exe 73 PID 2180 wrote to memory of 512 2180 rundll32.exe 73 PID 2180 wrote to memory of 512 2180 rundll32.exe 73 PID 2180 wrote to memory of 512 2180 rundll32.exe 73 PID 2180 wrote to memory of 512 2180 rundll32.exe 73 PID 2180 wrote to memory of 512 2180 rundll32.exe 73 PID 2180 wrote to memory of 512 2180 rundll32.exe 73 PID 2180 wrote to memory of 512 2180 rundll32.exe 73
Processes
-
C:\Users\Admin\AppData\Local\Temp\98b619b55b0fa736d5d1aec2ad1aa36c.exe"C:\Users\Admin\AppData\Local\Temp\98b619b55b0fa736d5d1aec2ad1aa36c.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:792 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe KinemaPergola,Chuddar2⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:2180 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe"3⤵
- Blacklisted process makes network request
- Suspicious use of AdjustPrivilegeToken
PID:512
-
-