Analysis
- max time kernel
130s - max time network
138s - platform
windows10_x64 - resource
win10v20201028 - submitted
09/11/2020, 20:36
Static task
static1
Behavioral task
behavioral1
Sample
winlog.exe
Resource
win7v20201028
windows7_x64
0 signatures
0 seconds
General
- Target winlog.exe
- Size 239KB
- Sample201109-9sfwe77vq2
- SHA256 ea9f9e089c4fc8a4fcf55c3456402a90812b5656ee8036ef68828a6f92a18ca1
- MD5 c54cb95be7a4e340ed8ae7f423dc48d5
- SHA1 b9228137c33b5b921d6a6ff8655083cbd3c37887
- SHA512 48079502dc2608f1143cdef5e7461feb548facc2b435da8b2a1e982717e2adb5c2ce7ea4d88b21beca1d0fbbb687dc7ec8243a07cc55caa4b70c4fd4f3408898
- MD5 SHA1 SHA512
Malware Config
Extracted
Family
-
lokibot
C2
-
http://b2bseller.ga/choolee/gate.php
-
http://kbfvzoboss.bid/alien/fre.php
-
http://alphastand.trade/alien/fre.php
-
http://alphastand.win/alien/fre.php
-
http://alphastand.top/alien/fre.php
Signatures
- Loads dropped DLL 1 IoCs
pid Process 2444 rundll32.exe - Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 2444 rundll32.exe - Suspicious behavior: MapViewOfSection 1 IoCs
pid Process 2444 rundll32.exe - Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 2816 cmd.exe - Suspicious use of WriteProcessMemory 83 IoCs
description pid Process procid_target PID 3932 wrote to memory of 2444 3932 winlog.exe 75 PID 3932 wrote to memory of 2444 3932 winlog.exe 75 PID 3932 wrote to memory of 2444 3932 winlog.exe 75 PID 2444 wrote to memory of 2816 2444 rundll32.exe 76 PID 2444 wrote to memory of 2816 2444 rundll32.exe 76 PID 2444 wrote to memory of 2816 2444 rundll32.exe 76 PID 2444 wrote to memory of 2816 2444 rundll32.exe 76 PID 2444 wrote to memory of 2816 2444 rundll32.exe 76 PID 2444 wrote to memory of 2816 2444 rundll32.exe 76 PID 2444 wrote to memory of 2816 2444 rundll32.exe 76 PID 2444 wrote to memory of 2816 2444 rundll32.exe 76 PID 2444 wrote to memory of 2816 2444 rundll32.exe 76 PID 2444 wrote to memory of 2816 2444 rundll32.exe 76 PID 2444 wrote to memory of 2816 2444 rundll32.exe 76 PID 2444 wrote to memory of 2816 2444 rundll32.exe 76 PID 2444 wrote to memory of 2816 2444 rundll32.exe 76 PID 2444 wrote to memory of 2816 2444 rundll32.exe 76 PID 2444 wrote to memory of 2816 2444 rundll32.exe 76 PID 2444 wrote to memory of 2816 2444 rundll32.exe 76 PID 2444 wrote to memory of 2816 2444 rundll32.exe 76 PID 2444 wrote to memory of 2816 2444 rundll32.exe 76 PID 2444 wrote to memory of 2816 2444 rundll32.exe 76 PID 2444 wrote to memory of 2816 2444 rundll32.exe 76 PID 2444 wrote to memory of 2816 2444 rundll32.exe 76 PID 2444 wrote to memory of 2816 2444 rundll32.exe 76 PID 2444 wrote to memory of 2816 2444 rundll32.exe 76 PID 2444 wrote to memory of 2816 2444 rundll32.exe 76 PID 2444 wrote to memory of 2816 2444 rundll32.exe 76 PID 2444 wrote to memory of 2816 2444 rundll32.exe 76 PID 2444 wrote to memory of 2816 2444 rundll32.exe 76 PID 2444 wrote to memory of 2816 2444 rundll32.exe 76 PID 2444 wrote to memory of 2816 2444 rundll32.exe 76 PID 2444 wrote to memory of 2816 2444 rundll32.exe 76 PID 2444 wrote to memory of 2816 2444 rundll32.exe 76 PID 2444 wrote to memory of 2816 2444 rundll32.exe 76 PID 2444 wrote to memory of 2816 2444 rundll32.exe 76 PID 2444 wrote to memory of 2816 2444 rundll32.exe 76 PID 2444 wrote to memory of 2816 2444 rundll32.exe 76 PID 2444 wrote to memory of 2816 2444 rundll32.exe 76 PID 2444 wrote to memory of 2816 2444 rundll32.exe 76 PID 2444 wrote to memory of 2816 2444 rundll32.exe 76 PID 2444 wrote to memory of 2816 2444 rundll32.exe 76 PID 2444 wrote to memory of 2816 2444 rundll32.exe 76 PID 2444 wrote to memory of 2816 2444 rundll32.exe 76 PID 2444 wrote to memory of 2816 2444 rundll32.exe 76 PID 2444 wrote to memory of 2816 2444 rundll32.exe 76 PID 2444 wrote to memory of 2816 2444 rundll32.exe 76 PID 2444 wrote to memory of 2816 2444 rundll32.exe 76 PID 2444 wrote to memory of 2816 2444 rundll32.exe 76 PID 2444 wrote to memory of 2816 2444 rundll32.exe 76 PID 2444 wrote to memory of 2816 2444 rundll32.exe 76 PID 2444 wrote to memory of 2816 2444 rundll32.exe 76 PID 2444 wrote to memory of 2816 2444 rundll32.exe 76 PID 2444 wrote to memory of 2816 2444 rundll32.exe 76 PID 2444 wrote to memory of 2816 2444 rundll32.exe 76 PID 2444 wrote to memory of 2816 2444 rundll32.exe 76 PID 2444 wrote to memory of 2816 2444 rundll32.exe 76 PID 2444 wrote to memory of 2816 2444 rundll32.exe 76 PID 2444 wrote to memory of 2816 2444 rundll32.exe 76 PID 2444 wrote to memory of 2816 2444 rundll32.exe 76 PID 2444 wrote to memory of 2816 2444 rundll32.exe 76 PID 2444 wrote to memory of 2816 2444 rundll32.exe 76 PID 2444 wrote to memory of 2816 2444 rundll32.exe 76 PID 2444 wrote to memory of 2816 2444 rundll32.exe 76 PID 2444 wrote to memory of 2816 2444 rundll32.exe 76 PID 2444 wrote to memory of 2816 2444 rundll32.exe 76 PID 2444 wrote to memory of 2816 2444 rundll32.exe 76 PID 2444 wrote to memory of 2816 2444 rundll32.exe 76 PID 2444 wrote to memory of 2816 2444 rundll32.exe 76 PID 2444 wrote to memory of 2816 2444 rundll32.exe 76 PID 2444 wrote to memory of 2816 2444 rundll32.exe 76 PID 2444 wrote to memory of 2816 2444 rundll32.exe 76 PID 2444 wrote to memory of 2816 2444 rundll32.exe 76 PID 2444 wrote to memory of 2816 2444 rundll32.exe 76 PID 2444 wrote to memory of 2816 2444 rundll32.exe 76 PID 2444 wrote to memory of 2816 2444 rundll32.exe 76 PID 2444 wrote to memory of 2816 2444 rundll32.exe 76 PID 2444 wrote to memory of 2816 2444 rundll32.exe 76 PID 2444 wrote to memory of 2816 2444 rundll32.exe 76 PID 2444 wrote to memory of 2816 2444 rundll32.exe 76 PID 2444 wrote to memory of 2816 2444 rundll32.exe 76 PID 2444 wrote to memory of 2816 2444 rundll32.exe 76 PID 2444 wrote to memory of 2816 2444 rundll32.exe 76
Processes
-
C:\Users\Admin\AppData\Local\Temp\winlog.exe"C:\Users\Admin\AppData\Local\Temp\winlog.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3932 -
C:\Windows\SysWOW64\rundll32.exeC:\Windows\system32\rundll32.exe AvocetRoquette,Vitta2⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:2444 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe"3⤵
- Suspicious use of AdjustPrivilegeToken
PID:2816
-
-