Analysis
- max time kernel
142s - max time network
125s - platform
windows10_x64 - resource
win10v20201028 - submitted
09/11/2020, 19:56
Static task
static1
Behavioral task
behavioral1
Sample
Encomenda_TR-08839-9AG.exe
Resource
win7v20201028
windows7_x64
0 signatures
0 seconds
General
- Target Encomenda_TR-08839-9AG.exe
- Size 1.5MB
- Sample201109-wapbmlp9ns
- SHA256 b6423a90227ed2d30952943cdfc63e4f31b2c79a15f80e5f2fb6aa9efb75dcbe
- MD5 10e9f2787ea44f79b805208d2de5e467
- SHA1 6324730bbfbdffac916d7092f0b3c03b66264688
- SHA512 a5f94faad953042676b36d2ca7ae1e722f781535f65a0f2827cd9eb4fafbf4b473df2148900e023ee5965a96361366c94013ac96e727b72d006bcfc498c705f8
- MD5 SHA1 SHA512
Malware Config
Extracted
Family
-
lokibot
C2
-
http://focal-com.me/P1/five/fre.php
-
http://kbfvzoboss.bid/alien/fre.php
-
http://alphastand.trade/alien/fre.php
-
http://alphastand.win/alien/fre.php
-
http://alphastand.top/alien/fre.php
Signatures
- Drops startup file 1 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\mcbuilder.url Encomenda_TR-08839-9AG.exe - Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 4700 set thread context of 3644 4700 Encomenda_TR-08839-9AG.exe 75 - Suspicious behavior: EnumeratesProcesses 28 IoCs
pid Process 4700 Encomenda_TR-08839-9AG.exe 4700 Encomenda_TR-08839-9AG.exe 4700 Encomenda_TR-08839-9AG.exe 4700 Encomenda_TR-08839-9AG.exe 4700 Encomenda_TR-08839-9AG.exe 4700 Encomenda_TR-08839-9AG.exe 4700 Encomenda_TR-08839-9AG.exe 4700 Encomenda_TR-08839-9AG.exe 4700 Encomenda_TR-08839-9AG.exe 4700 Encomenda_TR-08839-9AG.exe 4700 Encomenda_TR-08839-9AG.exe 4700 Encomenda_TR-08839-9AG.exe 4700 Encomenda_TR-08839-9AG.exe 4700 Encomenda_TR-08839-9AG.exe 4700 Encomenda_TR-08839-9AG.exe 4700 Encomenda_TR-08839-9AG.exe 4700 Encomenda_TR-08839-9AG.exe 4700 Encomenda_TR-08839-9AG.exe 4700 Encomenda_TR-08839-9AG.exe 4700 Encomenda_TR-08839-9AG.exe 4700 Encomenda_TR-08839-9AG.exe 4700 Encomenda_TR-08839-9AG.exe 4700 Encomenda_TR-08839-9AG.exe 4700 Encomenda_TR-08839-9AG.exe 4700 Encomenda_TR-08839-9AG.exe 4700 Encomenda_TR-08839-9AG.exe 4700 Encomenda_TR-08839-9AG.exe 4700 Encomenda_TR-08839-9AG.exe - Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 3644 svchost.exe - Suspicious use of FindShellTrayWindow 3 IoCs
pid Process 4700 Encomenda_TR-08839-9AG.exe 4700 Encomenda_TR-08839-9AG.exe 4700 Encomenda_TR-08839-9AG.exe - Suspicious use of SendNotifyMessage 3 IoCs
pid Process 4700 Encomenda_TR-08839-9AG.exe 4700 Encomenda_TR-08839-9AG.exe 4700 Encomenda_TR-08839-9AG.exe - Suspicious use of WriteProcessMemory 5 IoCs
description pid Process procid_target PID 4700 wrote to memory of 3644 4700 Encomenda_TR-08839-9AG.exe 75 PID 4700 wrote to memory of 3644 4700 Encomenda_TR-08839-9AG.exe 75 PID 4700 wrote to memory of 3644 4700 Encomenda_TR-08839-9AG.exe 75 PID 4700 wrote to memory of 3644 4700 Encomenda_TR-08839-9AG.exe 75 PID 4700 wrote to memory of 3644 4700 Encomenda_TR-08839-9AG.exe 75
Processes
-
C:\Users\Admin\AppData\Local\Temp\Encomenda_TR-08839-9AG.exe"C:\Users\Admin\AppData\Local\Temp\Encomenda_TR-08839-9AG.exe"1⤵
- Drops startup file
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4700 -
C:\Windows\SysWOW64\svchost.exe"C:\Windows\SysWOW64\svchost.exe"2⤵
- Suspicious use of AdjustPrivilegeToken
PID:3644
-