Analysis
- max time kernel
99s - max time network
112s - platform
windows10_x64 - resource
win10v200722 - submitted
07/10/2020, 04:31
Static task
static1
Behavioral task
behavioral1
Sample
1ec221318f9a34c8ef6a7b1ca8de8597.exe
Resource
win7
windows7_x64
0 signatures
0 seconds
General
- Target 1ec221318f9a34c8ef6a7b1ca8de8597.exe
- Size 258KB
- Sample201007-rpgcllw5fn
- SHA256 0aa79342c00ecadc1a8771b574911abbc7bd89d833598ea1bf9ad7ffa63c2ee9
- MD5 1ec221318f9a34c8ef6a7b1ca8de8597
- SHA1 a63f4c0161f4c419541ccc88efdfe3870b32fdec
- SHA512 a961ba728636510abd3cbff99876296c8edcde7eb0a1afaae44cd192f626732ff3eaea83acdd2cc458a796d2ab14448f873750a48e639aa68e39ebae70672c8f
- MD5 SHA1 SHA512
Malware Config
Extracted
Family
-
lokibot
C2
-
http://remzclot.ga/etc/main/l09/ap0s/home.php
-
http://kbfvzoboss.bid/alien/fre.php
-
http://alphastand.trade/alien/fre.php
-
http://alphastand.win/alien/fre.php
-
http://alphastand.top/alien/fre.php
Signatures
- Blacklisted process makes network request 4 IoCs
flow pid Process 16 3012 cmd.exe 17 3012 cmd.exe 18 3012 cmd.exe 19 3012 cmd.exe - Loads dropped DLL 1 IoCs
pid Process 2388 rundll32.exe - Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Suspicious behavior: EnumeratesProcesses 3 IoCs
pid Process 2388 rundll32.exe 2388 rundll32.exe 2388 rundll32.exe - Suspicious behavior: MapViewOfSection 3 IoCs
pid Process 2388 rundll32.exe 2388 rundll32.exe 2388 rundll32.exe - Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 3012 cmd.exe - Suspicious use of WriteProcessMemory 91 IoCs
description pid Process procid_target PID 968 wrote to memory of 2388 968 1ec221318f9a34c8ef6a7b1ca8de8597.exe 72 PID 968 wrote to memory of 2388 968 1ec221318f9a34c8ef6a7b1ca8de8597.exe 72 PID 968 wrote to memory of 2388 968 1ec221318f9a34c8ef6a7b1ca8de8597.exe 72 PID 2388 wrote to memory of 2668 2388 rundll32.exe 73 PID 2388 wrote to memory of 2668 2388 rundll32.exe 73 PID 2388 wrote to memory of 2668 2388 rundll32.exe 73 PID 2388 wrote to memory of 2668 2388 rundll32.exe 73 PID 2388 wrote to memory of 2688 2388 rundll32.exe 74 PID 2388 wrote to memory of 2688 2388 rundll32.exe 74 PID 2388 wrote to memory of 2688 2388 rundll32.exe 74 PID 2388 wrote to memory of 2688 2388 rundll32.exe 74 PID 2388 wrote to memory of 3012 2388 rundll32.exe 75 PID 2388 wrote to memory of 3012 2388 rundll32.exe 75 PID 2388 wrote to memory of 3012 2388 rundll32.exe 75 PID 2388 wrote to memory of 3012 2388 rundll32.exe 75 PID 2388 wrote to memory of 3012 2388 rundll32.exe 75 PID 2388 wrote to memory of 3012 2388 rundll32.exe 75 PID 2388 wrote to memory of 3012 2388 rundll32.exe 75 PID 2388 wrote to memory of 3012 2388 rundll32.exe 75 PID 2388 wrote to memory of 3012 2388 rundll32.exe 75 PID 2388 wrote to memory of 3012 2388 rundll32.exe 75 PID 2388 wrote to memory of 3012 2388 rundll32.exe 75 PID 2388 wrote to memory of 3012 2388 rundll32.exe 75 PID 2388 wrote to memory of 3012 2388 rundll32.exe 75 PID 2388 wrote to memory of 3012 2388 rundll32.exe 75 PID 2388 wrote to memory of 3012 2388 rundll32.exe 75 PID 2388 wrote to memory of 3012 2388 rundll32.exe 75 PID 2388 wrote to memory of 3012 2388 rundll32.exe 75 PID 2388 wrote to memory of 3012 2388 rundll32.exe 75 PID 2388 wrote to memory of 3012 2388 rundll32.exe 75 PID 2388 wrote to memory of 3012 2388 rundll32.exe 75 PID 2388 wrote to memory of 3012 2388 rundll32.exe 75 PID 2388 wrote to memory of 3012 2388 rundll32.exe 75 PID 2388 wrote to memory of 3012 2388 rundll32.exe 75 PID 2388 wrote to memory of 3012 2388 rundll32.exe 75 PID 2388 wrote to memory of 3012 2388 rundll32.exe 75 PID 2388 wrote to memory of 3012 2388 rundll32.exe 75 PID 2388 wrote to memory of 3012 2388 rundll32.exe 75 PID 2388 wrote to memory of 3012 2388 rundll32.exe 75 PID 2388 wrote to memory of 3012 2388 rundll32.exe 75 PID 2388 wrote to memory of 3012 2388 rundll32.exe 75 PID 2388 wrote to memory of 3012 2388 rundll32.exe 75 PID 2388 wrote to memory of 3012 2388 rundll32.exe 75 PID 2388 wrote to memory of 3012 2388 rundll32.exe 75 PID 2388 wrote to memory of 3012 2388 rundll32.exe 75 PID 2388 wrote to memory of 3012 2388 rundll32.exe 75 PID 2388 wrote to memory of 3012 2388 rundll32.exe 75 PID 2388 wrote to memory of 3012 2388 rundll32.exe 75 PID 2388 wrote to memory of 3012 2388 rundll32.exe 75 PID 2388 wrote to memory of 3012 2388 rundll32.exe 75 PID 2388 wrote to memory of 3012 2388 rundll32.exe 75 PID 2388 wrote to memory of 3012 2388 rundll32.exe 75 PID 2388 wrote to memory of 3012 2388 rundll32.exe 75 PID 2388 wrote to memory of 3012 2388 rundll32.exe 75 PID 2388 wrote to memory of 3012 2388 rundll32.exe 75 PID 2388 wrote to memory of 3012 2388 rundll32.exe 75 PID 2388 wrote to memory of 3012 2388 rundll32.exe 75 PID 2388 wrote to memory of 3012 2388 rundll32.exe 75 PID 2388 wrote to memory of 3012 2388 rundll32.exe 75 PID 2388 wrote to memory of 3012 2388 rundll32.exe 75 PID 2388 wrote to memory of 3012 2388 rundll32.exe 75 PID 2388 wrote to memory of 3012 2388 rundll32.exe 75 PID 2388 wrote to memory of 3012 2388 rundll32.exe 75 PID 2388 wrote to memory of 3012 2388 rundll32.exe 75 PID 2388 wrote to memory of 3012 2388 rundll32.exe 75 PID 2388 wrote to memory of 3012 2388 rundll32.exe 75 PID 2388 wrote to memory of 3012 2388 rundll32.exe 75 PID 2388 wrote to memory of 3012 2388 rundll32.exe 75 PID 2388 wrote to memory of 3012 2388 rundll32.exe 75 PID 2388 wrote to memory of 3012 2388 rundll32.exe 75 PID 2388 wrote to memory of 3012 2388 rundll32.exe 75 PID 2388 wrote to memory of 3012 2388 rundll32.exe 75 PID 2388 wrote to memory of 3012 2388 rundll32.exe 75 PID 2388 wrote to memory of 3012 2388 rundll32.exe 75 PID 2388 wrote to memory of 3012 2388 rundll32.exe 75 PID 2388 wrote to memory of 3012 2388 rundll32.exe 75 PID 2388 wrote to memory of 3012 2388 rundll32.exe 75 PID 2388 wrote to memory of 3012 2388 rundll32.exe 75 PID 2388 wrote to memory of 3012 2388 rundll32.exe 75 PID 2388 wrote to memory of 3012 2388 rundll32.exe 75 PID 2388 wrote to memory of 3012 2388 rundll32.exe 75 PID 2388 wrote to memory of 3012 2388 rundll32.exe 75 PID 2388 wrote to memory of 3012 2388 rundll32.exe 75 PID 2388 wrote to memory of 3012 2388 rundll32.exe 75 PID 2388 wrote to memory of 3012 2388 rundll32.exe 75 PID 2388 wrote to memory of 3012 2388 rundll32.exe 75 PID 2388 wrote to memory of 3012 2388 rundll32.exe 75 PID 2388 wrote to memory of 3012 2388 rundll32.exe 75 PID 2388 wrote to memory of 3012 2388 rundll32.exe 75 PID 2388 wrote to memory of 3012 2388 rundll32.exe 75 PID 2388 wrote to memory of 3012 2388 rundll32.exe 75
Processes
-
C:\Users\Admin\AppData\Local\Temp\1ec221318f9a34c8ef6a7b1ca8de8597.exe"C:\Users\Admin\AppData\Local\Temp\1ec221318f9a34c8ef6a7b1ca8de8597.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:968 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe Branchiopod,Chuddar2⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:2388 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe"3⤵PID:2668
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe"3⤵PID:2688
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe"3⤵
- Blacklisted process makes network request
- Suspicious use of AdjustPrivilegeToken
PID:3012
-
-