Analysis
-
max time kernel
119s -
max time network
131s -
platform
windows7_x64 -
resource
win7v20201028 -
submitted
05-12-2020 00:03
Static task
static1
Behavioral task
behavioral1
Sample
0c7b624462f4f6adc240631b4c6f0ff2b2af456b2d86880716e744d943f10b29.exe
Resource
win7v20201028
Behavioral task
behavioral2
Sample
0c7b624462f4f6adc240631b4c6f0ff2b2af456b2d86880716e744d943f10b29.exe
Resource
win10v20201028
General
-
Target
0c7b624462f4f6adc240631b4c6f0ff2b2af456b2d86880716e744d943f10b29.exe
-
Size
611KB
-
MD5
af6956c3441b679ff98850c499c3c45e
-
SHA1
de44a12ab89fbecfa350ce21d679c0c04cbe64b2
-
SHA256
0c7b624462f4f6adc240631b4c6f0ff2b2af456b2d86880716e744d943f10b29
-
SHA512
0b7cd09d545b703a743c10882e446d2572925d56b3a947480107d6ebc8d6607d527a4898d9eb6dea643a9d969bf5d2da77d65c6778aa8c4bfe2dd532f48b5265
Malware Config
Extracted
lokibot
http://185.239.242.195/os/2b/cgi.php
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php
Signatures
-
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
0c7b624462f4f6adc240631b4c6f0ff2b2af456b2d86880716e744d943f10b29.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Windows\CurrentVersion\Run\vlc = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\VideoLAN\\vlc.exe\"" 0c7b624462f4f6adc240631b4c6f0ff2b2af456b2d86880716e744d943f10b29.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
0c7b624462f4f6adc240631b4c6f0ff2b2af456b2d86880716e744d943f10b29.exedescription pid process target process PID 648 set thread context of 1316 648 0c7b624462f4f6adc240631b4c6f0ff2b2af456b2d86880716e744d943f10b29.exe 0c7b624462f4f6adc240631b4c6f0ff2b2af456b2d86880716e744d943f10b29.exe -
Suspicious behavior: RenamesItself 1 IoCs
Processes:
0c7b624462f4f6adc240631b4c6f0ff2b2af456b2d86880716e744d943f10b29.exepid process 1316 0c7b624462f4f6adc240631b4c6f0ff2b2af456b2d86880716e744d943f10b29.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
0c7b624462f4f6adc240631b4c6f0ff2b2af456b2d86880716e744d943f10b29.exe0c7b624462f4f6adc240631b4c6f0ff2b2af456b2d86880716e744d943f10b29.exedescription pid process Token: SeDebugPrivilege 648 0c7b624462f4f6adc240631b4c6f0ff2b2af456b2d86880716e744d943f10b29.exe Token: SeDebugPrivilege 1316 0c7b624462f4f6adc240631b4c6f0ff2b2af456b2d86880716e744d943f10b29.exe -
Suspicious use of WriteProcessMemory 13 IoCs
Processes:
0c7b624462f4f6adc240631b4c6f0ff2b2af456b2d86880716e744d943f10b29.exedescription pid process target process PID 648 wrote to memory of 1316 648 0c7b624462f4f6adc240631b4c6f0ff2b2af456b2d86880716e744d943f10b29.exe 0c7b624462f4f6adc240631b4c6f0ff2b2af456b2d86880716e744d943f10b29.exe PID 648 wrote to memory of 1316 648 0c7b624462f4f6adc240631b4c6f0ff2b2af456b2d86880716e744d943f10b29.exe 0c7b624462f4f6adc240631b4c6f0ff2b2af456b2d86880716e744d943f10b29.exe PID 648 wrote to memory of 1316 648 0c7b624462f4f6adc240631b4c6f0ff2b2af456b2d86880716e744d943f10b29.exe 0c7b624462f4f6adc240631b4c6f0ff2b2af456b2d86880716e744d943f10b29.exe PID 648 wrote to memory of 1316 648 0c7b624462f4f6adc240631b4c6f0ff2b2af456b2d86880716e744d943f10b29.exe 0c7b624462f4f6adc240631b4c6f0ff2b2af456b2d86880716e744d943f10b29.exe PID 648 wrote to memory of 1316 648 0c7b624462f4f6adc240631b4c6f0ff2b2af456b2d86880716e744d943f10b29.exe 0c7b624462f4f6adc240631b4c6f0ff2b2af456b2d86880716e744d943f10b29.exe PID 648 wrote to memory of 1316 648 0c7b624462f4f6adc240631b4c6f0ff2b2af456b2d86880716e744d943f10b29.exe 0c7b624462f4f6adc240631b4c6f0ff2b2af456b2d86880716e744d943f10b29.exe PID 648 wrote to memory of 1316 648 0c7b624462f4f6adc240631b4c6f0ff2b2af456b2d86880716e744d943f10b29.exe 0c7b624462f4f6adc240631b4c6f0ff2b2af456b2d86880716e744d943f10b29.exe PID 648 wrote to memory of 1316 648 0c7b624462f4f6adc240631b4c6f0ff2b2af456b2d86880716e744d943f10b29.exe 0c7b624462f4f6adc240631b4c6f0ff2b2af456b2d86880716e744d943f10b29.exe PID 648 wrote to memory of 1316 648 0c7b624462f4f6adc240631b4c6f0ff2b2af456b2d86880716e744d943f10b29.exe 0c7b624462f4f6adc240631b4c6f0ff2b2af456b2d86880716e744d943f10b29.exe PID 648 wrote to memory of 1316 648 0c7b624462f4f6adc240631b4c6f0ff2b2af456b2d86880716e744d943f10b29.exe 0c7b624462f4f6adc240631b4c6f0ff2b2af456b2d86880716e744d943f10b29.exe PID 648 wrote to memory of 1316 648 0c7b624462f4f6adc240631b4c6f0ff2b2af456b2d86880716e744d943f10b29.exe 0c7b624462f4f6adc240631b4c6f0ff2b2af456b2d86880716e744d943f10b29.exe PID 648 wrote to memory of 1316 648 0c7b624462f4f6adc240631b4c6f0ff2b2af456b2d86880716e744d943f10b29.exe 0c7b624462f4f6adc240631b4c6f0ff2b2af456b2d86880716e744d943f10b29.exe PID 648 wrote to memory of 1316 648 0c7b624462f4f6adc240631b4c6f0ff2b2af456b2d86880716e744d943f10b29.exe 0c7b624462f4f6adc240631b4c6f0ff2b2af456b2d86880716e744d943f10b29.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\0c7b624462f4f6adc240631b4c6f0ff2b2af456b2d86880716e744d943f10b29.exe"C:\Users\Admin\AppData\Local\Temp\0c7b624462f4f6adc240631b4c6f0ff2b2af456b2d86880716e744d943f10b29.exe"1⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\0c7b624462f4f6adc240631b4c6f0ff2b2af456b2d86880716e744d943f10b29.exe"C:\Users\Admin\AppData\Local\Temp\0c7b624462f4f6adc240631b4c6f0ff2b2af456b2d86880716e744d943f10b29.exe"2⤵
- Suspicious behavior: RenamesItself
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/648-2-0x00000000746F0000-0x0000000074DDE000-memory.dmpFilesize
6.9MB
-
memory/648-3-0x0000000001240000-0x0000000001241000-memory.dmpFilesize
4KB
-
memory/648-5-0x0000000000840000-0x0000000000889000-memory.dmpFilesize
292KB
-
memory/648-6-0x0000000000A10000-0x0000000000A26000-memory.dmpFilesize
88KB
-
memory/1316-8-0x00000000004139DE-mapping.dmp
-
memory/1316-7-0x0000000000400000-0x00000000004A2000-memory.dmpFilesize
648KB
-
memory/1316-9-0x0000000000400000-0x00000000004A2000-memory.dmpFilesize
648KB
-
memory/1516-10-0x000007FEF6380000-0x000007FEF65FA000-memory.dmpFilesize
2.5MB