Analysis
-
max time kernel
109s -
max time network
111s -
platform
windows10_x64 -
resource
win10v20201028 -
submitted
05-12-2020 00:03
Static task
static1
Behavioral task
behavioral1
Sample
56790883c5da2b30d0f089454ab67a354d98de2a7796e34d0438e0b515a3ec3d.exe
Resource
win7v20201028
General
-
Target
56790883c5da2b30d0f089454ab67a354d98de2a7796e34d0438e0b515a3ec3d.exe
-
Size
632KB
-
MD5
f6c704a0363a8b530d9beb4e07cea5de
-
SHA1
2c3096f67064ffa63e785dd34b4b0ecdce975e77
-
SHA256
56790883c5da2b30d0f089454ab67a354d98de2a7796e34d0438e0b515a3ec3d
-
SHA512
619c49e75074d696759a4cb4ce1f95eb9f1295c8870b73864dea9452fb6e88adeebdda5c32b79eb909bd336cf319baeb8f01f5323c761651eacff803f6382b7a
Malware Config
Extracted
lokibot
http://webtex.ga/rojas/gate.php
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php
Signatures
-
Suspicious use of SetThreadContext 1 IoCs
Processes:
56790883c5da2b30d0f089454ab67a354d98de2a7796e34d0438e0b515a3ec3d.exedescription pid process target process PID 3988 set thread context of 2216 3988 56790883c5da2b30d0f089454ab67a354d98de2a7796e34d0438e0b515a3ec3d.exe 56790883c5da2b30d0f089454ab67a354d98de2a7796e34d0438e0b515a3ec3d.exe -
Suspicious behavior: RenamesItself 1 IoCs
Processes:
56790883c5da2b30d0f089454ab67a354d98de2a7796e34d0438e0b515a3ec3d.exepid process 2216 56790883c5da2b30d0f089454ab67a354d98de2a7796e34d0438e0b515a3ec3d.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
56790883c5da2b30d0f089454ab67a354d98de2a7796e34d0438e0b515a3ec3d.exedescription pid process Token: SeDebugPrivilege 2216 56790883c5da2b30d0f089454ab67a354d98de2a7796e34d0438e0b515a3ec3d.exe -
Suspicious use of WriteProcessMemory 9 IoCs
Processes:
56790883c5da2b30d0f089454ab67a354d98de2a7796e34d0438e0b515a3ec3d.exedescription pid process target process PID 3988 wrote to memory of 2216 3988 56790883c5da2b30d0f089454ab67a354d98de2a7796e34d0438e0b515a3ec3d.exe 56790883c5da2b30d0f089454ab67a354d98de2a7796e34d0438e0b515a3ec3d.exe PID 3988 wrote to memory of 2216 3988 56790883c5da2b30d0f089454ab67a354d98de2a7796e34d0438e0b515a3ec3d.exe 56790883c5da2b30d0f089454ab67a354d98de2a7796e34d0438e0b515a3ec3d.exe PID 3988 wrote to memory of 2216 3988 56790883c5da2b30d0f089454ab67a354d98de2a7796e34d0438e0b515a3ec3d.exe 56790883c5da2b30d0f089454ab67a354d98de2a7796e34d0438e0b515a3ec3d.exe PID 3988 wrote to memory of 2216 3988 56790883c5da2b30d0f089454ab67a354d98de2a7796e34d0438e0b515a3ec3d.exe 56790883c5da2b30d0f089454ab67a354d98de2a7796e34d0438e0b515a3ec3d.exe PID 3988 wrote to memory of 2216 3988 56790883c5da2b30d0f089454ab67a354d98de2a7796e34d0438e0b515a3ec3d.exe 56790883c5da2b30d0f089454ab67a354d98de2a7796e34d0438e0b515a3ec3d.exe PID 3988 wrote to memory of 2216 3988 56790883c5da2b30d0f089454ab67a354d98de2a7796e34d0438e0b515a3ec3d.exe 56790883c5da2b30d0f089454ab67a354d98de2a7796e34d0438e0b515a3ec3d.exe PID 3988 wrote to memory of 2216 3988 56790883c5da2b30d0f089454ab67a354d98de2a7796e34d0438e0b515a3ec3d.exe 56790883c5da2b30d0f089454ab67a354d98de2a7796e34d0438e0b515a3ec3d.exe PID 3988 wrote to memory of 2216 3988 56790883c5da2b30d0f089454ab67a354d98de2a7796e34d0438e0b515a3ec3d.exe 56790883c5da2b30d0f089454ab67a354d98de2a7796e34d0438e0b515a3ec3d.exe PID 3988 wrote to memory of 2216 3988 56790883c5da2b30d0f089454ab67a354d98de2a7796e34d0438e0b515a3ec3d.exe 56790883c5da2b30d0f089454ab67a354d98de2a7796e34d0438e0b515a3ec3d.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\56790883c5da2b30d0f089454ab67a354d98de2a7796e34d0438e0b515a3ec3d.exe"C:\Users\Admin\AppData\Local\Temp\56790883c5da2b30d0f089454ab67a354d98de2a7796e34d0438e0b515a3ec3d.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\56790883c5da2b30d0f089454ab67a354d98de2a7796e34d0438e0b515a3ec3d.exe"{path}"2⤵
- Suspicious behavior: RenamesItself
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/2216-11-0x0000000000400000-0x00000000004A2000-memory.dmpFilesize
648KB
-
memory/2216-12-0x00000000004139DE-mapping.dmp
-
memory/2216-13-0x0000000000400000-0x00000000004A2000-memory.dmpFilesize
648KB
-
memory/3988-2-0x00000000738E0000-0x0000000073FCE000-memory.dmpFilesize
6.9MB
-
memory/3988-3-0x0000000000900000-0x0000000000901000-memory.dmpFilesize
4KB
-
memory/3988-5-0x00000000058F0000-0x00000000058F1000-memory.dmpFilesize
4KB
-
memory/3988-6-0x0000000005360000-0x000000000536E000-memory.dmpFilesize
56KB
-
memory/3988-7-0x0000000005E20000-0x0000000005E21000-memory.dmpFilesize
4KB
-
memory/3988-8-0x0000000005480000-0x0000000005481000-memory.dmpFilesize
4KB
-
memory/3988-9-0x0000000006650000-0x000000000669E000-memory.dmpFilesize
312KB
-
memory/3988-10-0x0000000006740000-0x0000000006741000-memory.dmpFilesize
4KB