Analysis
-
max time kernel
117s -
max time network
125s -
platform
windows10_x64 -
resource
win10v20201028 -
submitted
05-12-2020 00:03
Static task
static1
Behavioral task
behavioral1
Sample
0c7b624462f4f6adc240631b4c6f0ff2b2af456b2d86880716e744d943f10b29.exe
Resource
win7v20201028
Behavioral task
behavioral2
Sample
0c7b624462f4f6adc240631b4c6f0ff2b2af456b2d86880716e744d943f10b29.exe
Resource
win10v20201028
General
-
Target
0c7b624462f4f6adc240631b4c6f0ff2b2af456b2d86880716e744d943f10b29.exe
-
Size
611KB
-
MD5
af6956c3441b679ff98850c499c3c45e
-
SHA1
de44a12ab89fbecfa350ce21d679c0c04cbe64b2
-
SHA256
0c7b624462f4f6adc240631b4c6f0ff2b2af456b2d86880716e744d943f10b29
-
SHA512
0b7cd09d545b703a743c10882e446d2572925d56b3a947480107d6ebc8d6607d527a4898d9eb6dea643a9d969bf5d2da77d65c6778aa8c4bfe2dd532f48b5265
Malware Config
Extracted
lokibot
http://185.239.242.195/os/2b/cgi.php
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php
Signatures
-
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
0c7b624462f4f6adc240631b4c6f0ff2b2af456b2d86880716e744d943f10b29.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Windows\CurrentVersion\Run\vlc = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\VideoLAN\\vlc.exe\"" 0c7b624462f4f6adc240631b4c6f0ff2b2af456b2d86880716e744d943f10b29.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
0c7b624462f4f6adc240631b4c6f0ff2b2af456b2d86880716e744d943f10b29.exedescription pid process target process PID 644 set thread context of 188 644 0c7b624462f4f6adc240631b4c6f0ff2b2af456b2d86880716e744d943f10b29.exe 0c7b624462f4f6adc240631b4c6f0ff2b2af456b2d86880716e744d943f10b29.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
0c7b624462f4f6adc240631b4c6f0ff2b2af456b2d86880716e744d943f10b29.exepid process 644 0c7b624462f4f6adc240631b4c6f0ff2b2af456b2d86880716e744d943f10b29.exe 644 0c7b624462f4f6adc240631b4c6f0ff2b2af456b2d86880716e744d943f10b29.exe -
Suspicious behavior: RenamesItself 1 IoCs
Processes:
0c7b624462f4f6adc240631b4c6f0ff2b2af456b2d86880716e744d943f10b29.exepid process 188 0c7b624462f4f6adc240631b4c6f0ff2b2af456b2d86880716e744d943f10b29.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
0c7b624462f4f6adc240631b4c6f0ff2b2af456b2d86880716e744d943f10b29.exe0c7b624462f4f6adc240631b4c6f0ff2b2af456b2d86880716e744d943f10b29.exedescription pid process Token: SeDebugPrivilege 644 0c7b624462f4f6adc240631b4c6f0ff2b2af456b2d86880716e744d943f10b29.exe Token: SeDebugPrivilege 188 0c7b624462f4f6adc240631b4c6f0ff2b2af456b2d86880716e744d943f10b29.exe -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
0c7b624462f4f6adc240631b4c6f0ff2b2af456b2d86880716e744d943f10b29.exedescription pid process target process PID 644 wrote to memory of 2644 644 0c7b624462f4f6adc240631b4c6f0ff2b2af456b2d86880716e744d943f10b29.exe 0c7b624462f4f6adc240631b4c6f0ff2b2af456b2d86880716e744d943f10b29.exe PID 644 wrote to memory of 2644 644 0c7b624462f4f6adc240631b4c6f0ff2b2af456b2d86880716e744d943f10b29.exe 0c7b624462f4f6adc240631b4c6f0ff2b2af456b2d86880716e744d943f10b29.exe PID 644 wrote to memory of 2644 644 0c7b624462f4f6adc240631b4c6f0ff2b2af456b2d86880716e744d943f10b29.exe 0c7b624462f4f6adc240631b4c6f0ff2b2af456b2d86880716e744d943f10b29.exe PID 644 wrote to memory of 188 644 0c7b624462f4f6adc240631b4c6f0ff2b2af456b2d86880716e744d943f10b29.exe 0c7b624462f4f6adc240631b4c6f0ff2b2af456b2d86880716e744d943f10b29.exe PID 644 wrote to memory of 188 644 0c7b624462f4f6adc240631b4c6f0ff2b2af456b2d86880716e744d943f10b29.exe 0c7b624462f4f6adc240631b4c6f0ff2b2af456b2d86880716e744d943f10b29.exe PID 644 wrote to memory of 188 644 0c7b624462f4f6adc240631b4c6f0ff2b2af456b2d86880716e744d943f10b29.exe 0c7b624462f4f6adc240631b4c6f0ff2b2af456b2d86880716e744d943f10b29.exe PID 644 wrote to memory of 188 644 0c7b624462f4f6adc240631b4c6f0ff2b2af456b2d86880716e744d943f10b29.exe 0c7b624462f4f6adc240631b4c6f0ff2b2af456b2d86880716e744d943f10b29.exe PID 644 wrote to memory of 188 644 0c7b624462f4f6adc240631b4c6f0ff2b2af456b2d86880716e744d943f10b29.exe 0c7b624462f4f6adc240631b4c6f0ff2b2af456b2d86880716e744d943f10b29.exe PID 644 wrote to memory of 188 644 0c7b624462f4f6adc240631b4c6f0ff2b2af456b2d86880716e744d943f10b29.exe 0c7b624462f4f6adc240631b4c6f0ff2b2af456b2d86880716e744d943f10b29.exe PID 644 wrote to memory of 188 644 0c7b624462f4f6adc240631b4c6f0ff2b2af456b2d86880716e744d943f10b29.exe 0c7b624462f4f6adc240631b4c6f0ff2b2af456b2d86880716e744d943f10b29.exe PID 644 wrote to memory of 188 644 0c7b624462f4f6adc240631b4c6f0ff2b2af456b2d86880716e744d943f10b29.exe 0c7b624462f4f6adc240631b4c6f0ff2b2af456b2d86880716e744d943f10b29.exe PID 644 wrote to memory of 188 644 0c7b624462f4f6adc240631b4c6f0ff2b2af456b2d86880716e744d943f10b29.exe 0c7b624462f4f6adc240631b4c6f0ff2b2af456b2d86880716e744d943f10b29.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\0c7b624462f4f6adc240631b4c6f0ff2b2af456b2d86880716e744d943f10b29.exe"C:\Users\Admin\AppData\Local\Temp\0c7b624462f4f6adc240631b4c6f0ff2b2af456b2d86880716e744d943f10b29.exe"1⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\0c7b624462f4f6adc240631b4c6f0ff2b2af456b2d86880716e744d943f10b29.exe"C:\Users\Admin\AppData\Local\Temp\0c7b624462f4f6adc240631b4c6f0ff2b2af456b2d86880716e744d943f10b29.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\0c7b624462f4f6adc240631b4c6f0ff2b2af456b2d86880716e744d943f10b29.exe"C:\Users\Admin\AppData\Local\Temp\0c7b624462f4f6adc240631b4c6f0ff2b2af456b2d86880716e744d943f10b29.exe"2⤵
- Suspicious behavior: RenamesItself
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/188-11-0x0000000000400000-0x00000000004A2000-memory.dmpFilesize
648KB
-
memory/188-12-0x00000000004139DE-mapping.dmp
-
memory/188-13-0x0000000000400000-0x00000000004A2000-memory.dmpFilesize
648KB
-
memory/644-2-0x0000000073F80000-0x000000007466E000-memory.dmpFilesize
6.9MB
-
memory/644-3-0x0000000000170000-0x0000000000171000-memory.dmpFilesize
4KB
-
memory/644-5-0x0000000004F90000-0x0000000004F91000-memory.dmpFilesize
4KB
-
memory/644-6-0x0000000004A90000-0x0000000004A91000-memory.dmpFilesize
4KB
-
memory/644-7-0x0000000004A30000-0x0000000004A31000-memory.dmpFilesize
4KB
-
memory/644-8-0x0000000007FD0000-0x0000000008019000-memory.dmpFilesize
292KB
-
memory/644-9-0x0000000008090000-0x0000000008091000-memory.dmpFilesize
4KB
-
memory/644-10-0x0000000009090000-0x00000000090A6000-memory.dmpFilesize
88KB