Analysis
-
max time kernel
151s -
max time network
140s -
platform
windows7_x64 -
resource
win7v20201028 -
submitted
06-11-2020 11:23
Static task
static1
Behavioral task
behavioral1
Sample
8b7059f28e99b14fb924b26e03e210053a9162b91407f043162bb8067046d648.exe
Resource
win7v20201028
General
-
Target
8b7059f28e99b14fb924b26e03e210053a9162b91407f043162bb8067046d648.exe
-
Size
783KB
-
MD5
18c9fa704c5ddcaa2f7760abf418847c
-
SHA1
ffdfdc5a23d760e22638e47f335e99f3d18db650
-
SHA256
8b7059f28e99b14fb924b26e03e210053a9162b91407f043162bb8067046d648
-
SHA512
be4ffd927633b4a9c18280fc0b01d48ee9865ca511749e3a9660b3945a391cc30625bf12edbd80c0bfa7d91e60e89e9d11882f2d41f430485c9df2e72d1b767a
Malware Config
Extracted
lokibot
http://craftdistilleries.com/auth/xloki/Panel/five/fre.php
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php
Signatures
-
Executes dropped EXE 3 IoCs
Processes:
Pony.exeorder.exeorder.exepid process 836 Pony.exe 1248 order.exe 1088 order.exe -
Processes:
resource yara_rule \Users\Admin\AppData\Local\Temp\Pony.exe upx \Users\Admin\AppData\Local\Temp\Pony.exe upx C:\Users\Admin\AppData\Local\Temp\Pony.exe upx C:\Users\Admin\AppData\Local\Temp\Pony.exe upx -
Loads dropped DLL 4 IoCs
Processes:
8b7059f28e99b14fb924b26e03e210053a9162b91407f043162bb8067046d648.exeorder.exepid process 1632 8b7059f28e99b14fb924b26e03e210053a9162b91407f043162bb8067046d648.exe 1632 8b7059f28e99b14fb924b26e03e210053a9162b91407f043162bb8067046d648.exe 1632 8b7059f28e99b14fb924b26e03e210053a9162b91407f043162bb8067046d648.exe 1248 order.exe -
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
reg.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce reg.exe Set value (str) \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\Load = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\DwiDesk\\order.lnk" reg.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious use of SetThreadContext 3 IoCs
Processes:
order.exedescription pid process target process PID 1248 set thread context of 1088 1248 order.exe order.exe PID 1248 set thread context of 1088 1248 order.exe order.exe PID 1248 set thread context of 292 1248 order.exe MSBuild.exe -
Suspicious behavior: EnumeratesProcesses 336 IoCs
Processes:
order.exeMSBuild.exepid process 1248 order.exe 1248 order.exe 1248 order.exe 1248 order.exe 1248 order.exe 1248 order.exe 1248 order.exe 1248 order.exe 1248 order.exe 1248 order.exe 292 MSBuild.exe 1248 order.exe 292 MSBuild.exe 1248 order.exe 1248 order.exe 292 MSBuild.exe 1248 order.exe 292 MSBuild.exe 1248 order.exe 1248 order.exe 1248 order.exe 292 MSBuild.exe 292 MSBuild.exe 1248 order.exe 1248 order.exe 1248 order.exe 292 MSBuild.exe 1248 order.exe 292 MSBuild.exe 1248 order.exe 1248 order.exe 292 MSBuild.exe 1248 order.exe 292 MSBuild.exe 1248 order.exe 1248 order.exe 1248 order.exe 292 MSBuild.exe 292 MSBuild.exe 1248 order.exe 1248 order.exe 1248 order.exe 292 MSBuild.exe 1248 order.exe 1248 order.exe 292 MSBuild.exe 1248 order.exe 292 MSBuild.exe 1248 order.exe 1248 order.exe 1248 order.exe 292 MSBuild.exe 292 MSBuild.exe 1248 order.exe 1248 order.exe 1248 order.exe 292 MSBuild.exe 1248 order.exe 292 MSBuild.exe 1248 order.exe 1248 order.exe 292 MSBuild.exe 1248 order.exe 292 MSBuild.exe -
Suspicious use of AdjustPrivilegeToken 35 IoCs
Processes:
Pony.exeorder.exeorder.exeMSBuild.exedescription pid process Token: SeImpersonatePrivilege 836 Pony.exe Token: SeTcbPrivilege 836 Pony.exe Token: SeChangeNotifyPrivilege 836 Pony.exe Token: SeCreateTokenPrivilege 836 Pony.exe Token: SeBackupPrivilege 836 Pony.exe Token: SeRestorePrivilege 836 Pony.exe Token: SeIncreaseQuotaPrivilege 836 Pony.exe Token: SeAssignPrimaryTokenPrivilege 836 Pony.exe Token: SeDebugPrivilege 1248 order.exe Token: SeImpersonatePrivilege 836 Pony.exe Token: SeTcbPrivilege 836 Pony.exe Token: SeChangeNotifyPrivilege 836 Pony.exe Token: SeCreateTokenPrivilege 836 Pony.exe Token: SeBackupPrivilege 836 Pony.exe Token: SeRestorePrivilege 836 Pony.exe Token: SeIncreaseQuotaPrivilege 836 Pony.exe Token: SeAssignPrimaryTokenPrivilege 836 Pony.exe Token: SeImpersonatePrivilege 836 Pony.exe Token: SeTcbPrivilege 836 Pony.exe Token: SeChangeNotifyPrivilege 836 Pony.exe Token: SeCreateTokenPrivilege 836 Pony.exe Token: SeBackupPrivilege 836 Pony.exe Token: SeRestorePrivilege 836 Pony.exe Token: SeIncreaseQuotaPrivilege 836 Pony.exe Token: SeAssignPrimaryTokenPrivilege 836 Pony.exe Token: SeImpersonatePrivilege 836 Pony.exe Token: SeTcbPrivilege 836 Pony.exe Token: SeChangeNotifyPrivilege 836 Pony.exe Token: SeCreateTokenPrivilege 836 Pony.exe Token: SeBackupPrivilege 836 Pony.exe Token: SeRestorePrivilege 836 Pony.exe Token: SeIncreaseQuotaPrivilege 836 Pony.exe Token: SeAssignPrimaryTokenPrivilege 836 Pony.exe Token: SeDebugPrivilege 1088 order.exe Token: SeDebugPrivilege 292 MSBuild.exe -
Suspicious use of WriteProcessMemory 39 IoCs
Processes:
8b7059f28e99b14fb924b26e03e210053a9162b91407f043162bb8067046d648.exeorder.execmd.exePony.exedescription pid process target process PID 1632 wrote to memory of 836 1632 8b7059f28e99b14fb924b26e03e210053a9162b91407f043162bb8067046d648.exe Pony.exe PID 1632 wrote to memory of 836 1632 8b7059f28e99b14fb924b26e03e210053a9162b91407f043162bb8067046d648.exe Pony.exe PID 1632 wrote to memory of 836 1632 8b7059f28e99b14fb924b26e03e210053a9162b91407f043162bb8067046d648.exe Pony.exe PID 1632 wrote to memory of 836 1632 8b7059f28e99b14fb924b26e03e210053a9162b91407f043162bb8067046d648.exe Pony.exe PID 1632 wrote to memory of 1248 1632 8b7059f28e99b14fb924b26e03e210053a9162b91407f043162bb8067046d648.exe order.exe PID 1632 wrote to memory of 1248 1632 8b7059f28e99b14fb924b26e03e210053a9162b91407f043162bb8067046d648.exe order.exe PID 1632 wrote to memory of 1248 1632 8b7059f28e99b14fb924b26e03e210053a9162b91407f043162bb8067046d648.exe order.exe PID 1632 wrote to memory of 1248 1632 8b7059f28e99b14fb924b26e03e210053a9162b91407f043162bb8067046d648.exe order.exe PID 1248 wrote to memory of 1572 1248 order.exe cmd.exe PID 1248 wrote to memory of 1572 1248 order.exe cmd.exe PID 1248 wrote to memory of 1572 1248 order.exe cmd.exe PID 1248 wrote to memory of 1572 1248 order.exe cmd.exe PID 1572 wrote to memory of 1856 1572 cmd.exe reg.exe PID 1572 wrote to memory of 1856 1572 cmd.exe reg.exe PID 1572 wrote to memory of 1856 1572 cmd.exe reg.exe PID 1572 wrote to memory of 1856 1572 cmd.exe reg.exe PID 1248 wrote to memory of 1088 1248 order.exe order.exe PID 1248 wrote to memory of 1088 1248 order.exe order.exe PID 1248 wrote to memory of 1088 1248 order.exe order.exe PID 1248 wrote to memory of 1088 1248 order.exe order.exe PID 1248 wrote to memory of 1088 1248 order.exe order.exe PID 1248 wrote to memory of 1088 1248 order.exe order.exe PID 1248 wrote to memory of 1088 1248 order.exe order.exe PID 1248 wrote to memory of 1088 1248 order.exe order.exe PID 1248 wrote to memory of 1088 1248 order.exe order.exe PID 1248 wrote to memory of 1088 1248 order.exe order.exe PID 836 wrote to memory of 972 836 Pony.exe cmd.exe PID 836 wrote to memory of 972 836 Pony.exe cmd.exe PID 836 wrote to memory of 972 836 Pony.exe cmd.exe PID 836 wrote to memory of 972 836 Pony.exe cmd.exe PID 1248 wrote to memory of 292 1248 order.exe MSBuild.exe PID 1248 wrote to memory of 292 1248 order.exe MSBuild.exe PID 1248 wrote to memory of 292 1248 order.exe MSBuild.exe PID 1248 wrote to memory of 292 1248 order.exe MSBuild.exe PID 1248 wrote to memory of 292 1248 order.exe MSBuild.exe PID 1248 wrote to memory of 292 1248 order.exe MSBuild.exe PID 1248 wrote to memory of 292 1248 order.exe MSBuild.exe PID 1248 wrote to memory of 292 1248 order.exe MSBuild.exe PID 1248 wrote to memory of 292 1248 order.exe MSBuild.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\8b7059f28e99b14fb924b26e03e210053a9162b91407f043162bb8067046d648.exe"C:\Users\Admin\AppData\Local\Temp\8b7059f28e99b14fb924b26e03e210053a9162b91407f043162bb8067046d648.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Pony.exe"C:\Users\Admin\AppData\Local\Temp\Pony.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\259299214.bat" "C:\Users\Admin\AppData\Local\Temp\Pony.exe" "3⤵
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\DwiDesk\order.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\DwiDesk\order.exe" -n2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v "Load" /d "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\DwiDesk\order.lnk" /f3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\reg.exereg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v "Load" /d "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\DwiDesk\order.lnk" /f4⤵
- Adds Run key to start application
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\DwiDesk\order.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\DwiDesk\order.exe"3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\259299214.batMD5
3880eeb1c736d853eb13b44898b718ab
SHA14eec9d50360cd815211e3c4e6bdd08271b6ec8e6
SHA256936d9411d5226b7c5a150ecaf422987590a8870c8e095e1caa072273041a86e7
SHA5123eaa3dddd7a11942e75acd44208fbe3d3ff8f4006951cd970fb9ab748c160739409803450d28037e577443504707fc310c634e9dc54d0c25e8cfe6094f017c6b
-
C:\Users\Admin\AppData\Local\Temp\Pony.exeMD5
e30be32379449d1df8c722f446588ea7
SHA131259d9c383acd64725d4ca3193fa6fac2aece0e
SHA2567e261813997c6166847a966533d33650415ee6d9b6af8b9f64debbb2633cab50
SHA512a1026c67fed1a5103d424e1554d9ce40d79561574661cbfe2a61f90f5aeb629fa2040e92863370309c222a78f9bfb224738feedaeb899e867fae56f74b5de2b9
-
C:\Users\Admin\AppData\Local\Temp\Pony.exeMD5
e30be32379449d1df8c722f446588ea7
SHA131259d9c383acd64725d4ca3193fa6fac2aece0e
SHA2567e261813997c6166847a966533d33650415ee6d9b6af8b9f64debbb2633cab50
SHA512a1026c67fed1a5103d424e1554d9ce40d79561574661cbfe2a61f90f5aeb629fa2040e92863370309c222a78f9bfb224738feedaeb899e867fae56f74b5de2b9
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\DwiDesk\fl.txtMD5
cdf226025efd59c0fc4d93411905816f
SHA1312753ead35c255096d96a2eae0971f59eb438d2
SHA25696a7e24e69b6f27377531f918b4a58dd42bdc96d763443aa08bd16a00ff5e762
SHA5120eb10838d62db7c48b71dba5a2e5d7dc53979a13ce280d4188abb802f904196faea039e57c79ffe74be8ae77a6185232e2868271d6844159f825d866763bdb3b
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\DwiDesk\order.exeMD5
18c9fa704c5ddcaa2f7760abf418847c
SHA1ffdfdc5a23d760e22638e47f335e99f3d18db650
SHA2568b7059f28e99b14fb924b26e03e210053a9162b91407f043162bb8067046d648
SHA512be4ffd927633b4a9c18280fc0b01d48ee9865ca511749e3a9660b3945a391cc30625bf12edbd80c0bfa7d91e60e89e9d11882f2d41f430485c9df2e72d1b767a
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\DwiDesk\order.exeMD5
18c9fa704c5ddcaa2f7760abf418847c
SHA1ffdfdc5a23d760e22638e47f335e99f3d18db650
SHA2568b7059f28e99b14fb924b26e03e210053a9162b91407f043162bb8067046d648
SHA512be4ffd927633b4a9c18280fc0b01d48ee9865ca511749e3a9660b3945a391cc30625bf12edbd80c0bfa7d91e60e89e9d11882f2d41f430485c9df2e72d1b767a
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\DwiDesk\order.exeMD5
18c9fa704c5ddcaa2f7760abf418847c
SHA1ffdfdc5a23d760e22638e47f335e99f3d18db650
SHA2568b7059f28e99b14fb924b26e03e210053a9162b91407f043162bb8067046d648
SHA512be4ffd927633b4a9c18280fc0b01d48ee9865ca511749e3a9660b3945a391cc30625bf12edbd80c0bfa7d91e60e89e9d11882f2d41f430485c9df2e72d1b767a
-
\Users\Admin\AppData\Local\Temp\Pony.exeMD5
e30be32379449d1df8c722f446588ea7
SHA131259d9c383acd64725d4ca3193fa6fac2aece0e
SHA2567e261813997c6166847a966533d33650415ee6d9b6af8b9f64debbb2633cab50
SHA512a1026c67fed1a5103d424e1554d9ce40d79561574661cbfe2a61f90f5aeb629fa2040e92863370309c222a78f9bfb224738feedaeb899e867fae56f74b5de2b9
-
\Users\Admin\AppData\Local\Temp\Pony.exeMD5
e30be32379449d1df8c722f446588ea7
SHA131259d9c383acd64725d4ca3193fa6fac2aece0e
SHA2567e261813997c6166847a966533d33650415ee6d9b6af8b9f64debbb2633cab50
SHA512a1026c67fed1a5103d424e1554d9ce40d79561574661cbfe2a61f90f5aeb629fa2040e92863370309c222a78f9bfb224738feedaeb899e867fae56f74b5de2b9
-
\Users\Admin\AppData\Roaming\Microsoft\Windows\DwiDesk\order.exeMD5
18c9fa704c5ddcaa2f7760abf418847c
SHA1ffdfdc5a23d760e22638e47f335e99f3d18db650
SHA2568b7059f28e99b14fb924b26e03e210053a9162b91407f043162bb8067046d648
SHA512be4ffd927633b4a9c18280fc0b01d48ee9865ca511749e3a9660b3945a391cc30625bf12edbd80c0bfa7d91e60e89e9d11882f2d41f430485c9df2e72d1b767a
-
\Users\Admin\AppData\Roaming\Microsoft\Windows\DwiDesk\order.exeMD5
18c9fa704c5ddcaa2f7760abf418847c
SHA1ffdfdc5a23d760e22638e47f335e99f3d18db650
SHA2568b7059f28e99b14fb924b26e03e210053a9162b91407f043162bb8067046d648
SHA512be4ffd927633b4a9c18280fc0b01d48ee9865ca511749e3a9660b3945a391cc30625bf12edbd80c0bfa7d91e60e89e9d11882f2d41f430485c9df2e72d1b767a
-
memory/292-31-0x0000000000400000-0x0000000000408000-memory.dmpFilesize
32KB
-
memory/292-29-0x000000000040342E-mapping.dmp
-
memory/292-30-0x0000000000400000-0x0000000000408000-memory.dmpFilesize
32KB
-
memory/292-28-0x0000000000400000-0x0000000000408000-memory.dmpFilesize
32KB
-
memory/292-32-0x0000000074450000-0x0000000074B3E000-memory.dmpFilesize
6.9MB
-
memory/836-6-0x0000000000000000-mapping.dmp
-
memory/972-24-0x0000000000000000-mapping.dmp
-
memory/1088-20-0x00000000004139DE-mapping.dmp
-
memory/1088-22-0x00000000004139DE-mapping.dmp
-
memory/1088-19-0x0000000000400000-0x00000000004A2000-memory.dmpFilesize
648KB
-
memory/1248-13-0x00000000000B0000-0x00000000000B1000-memory.dmpFilesize
4KB
-
memory/1248-12-0x0000000074450000-0x0000000074B3E000-memory.dmpFilesize
6.9MB
-
memory/1248-9-0x0000000000000000-mapping.dmp
-
memory/1572-17-0x0000000000000000-mapping.dmp
-
memory/1632-0-0x0000000074450000-0x0000000074B3E000-memory.dmpFilesize
6.9MB
-
memory/1632-3-0x0000000004ED0000-0x0000000004F97000-memory.dmpFilesize
796KB
-
memory/1632-1-0x0000000000F50000-0x0000000000F51000-memory.dmpFilesize
4KB
-
memory/1820-23-0x000007FEF7540000-0x000007FEF77BA000-memory.dmpFilesize
2.5MB
-
memory/1856-18-0x0000000000000000-mapping.dmp