Analysis
- max time kernel
116s - max time network
130s - platform
windows7_x64 - resource
win7v20201028 - submitted
15/12/2020, 07:59
Static task
static1
Behavioral task
behavioral1
Sample
b2956955caf50380360313a33a6fb339.exe
Resource
win7v20201028
windows7_x64
0 signatures
0 seconds
General
- Target b2956955caf50380360313a33a6fb339.exe
- Size 1.2MB
- Sample201215-6ejed4ny7n
- SHA256 b46b5b42ac74dfcff2d6dcd0ea1492c7065428ced5276fff88bbb06415315bef
- MD5 b2956955caf50380360313a33a6fb339
- SHA1 7db33e9f19fa54dbf5962167962c03b1002277e6
- SHA512 a7edc61a6addbbcdf64d02fbd7dad93e3f616748e7b19dbb827d95649db5e3b4483ce66534875a1ff29c40a6e17e3b0e9627ee1e1bff473ddfef72685b4e7a45
- MD5 SHA1 SHA512
Malware Config
Extracted
Family
-
lokibot
C2
-
http://begadi.ga/chud/gate.php
-
http://kbfvzoboss.bid/alien/fre.php
-
http://alphastand.trade/alien/fre.php
-
http://alphastand.win/alien/fre.php
-
http://alphastand.top/alien/fre.php
Signatures
- Blocklisted process makes network request 4 IoCs
flow pid Process 8 1312 cmd.exe 9 1312 cmd.exe 10 1312 cmd.exe 11 1312 cmd.exe - Drops file in Windows directory 1 IoCs
description ioc Process File created C:\Windows\Tasks\svr.job cmd.exe - Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 1584 b2956955caf50380360313a33a6fb339.exe 1948 extrac32.exe - Suspicious behavior: MapViewOfSection 1 IoCs
pid Process 1948 extrac32.exe - Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 1312 cmd.exe - Suspicious use of WriteProcessMemory 81 IoCs
description pid Process procid_target PID 1584 wrote to memory of 1948 1584 b2956955caf50380360313a33a6fb339.exe 26 PID 1584 wrote to memory of 1948 1584 b2956955caf50380360313a33a6fb339.exe 26 PID 1584 wrote to memory of 1948 1584 b2956955caf50380360313a33a6fb339.exe 26 PID 1584 wrote to memory of 1948 1584 b2956955caf50380360313a33a6fb339.exe 26 PID 1584 wrote to memory of 1948 1584 b2956955caf50380360313a33a6fb339.exe 26 PID 1584 wrote to memory of 1948 1584 b2956955caf50380360313a33a6fb339.exe 26 PID 1584 wrote to memory of 1948 1584 b2956955caf50380360313a33a6fb339.exe 26 PID 1584 wrote to memory of 1948 1584 b2956955caf50380360313a33a6fb339.exe 26 PID 1584 wrote to memory of 1948 1584 b2956955caf50380360313a33a6fb339.exe 26 PID 1584 wrote to memory of 1948 1584 b2956955caf50380360313a33a6fb339.exe 26 PID 1584 wrote to memory of 1948 1584 b2956955caf50380360313a33a6fb339.exe 26 PID 1584 wrote to memory of 1948 1584 b2956955caf50380360313a33a6fb339.exe 26 PID 1584 wrote to memory of 1948 1584 b2956955caf50380360313a33a6fb339.exe 26 PID 1584 wrote to memory of 1948 1584 b2956955caf50380360313a33a6fb339.exe 26 PID 1584 wrote to memory of 1948 1584 b2956955caf50380360313a33a6fb339.exe 26 PID 1584 wrote to memory of 1948 1584 b2956955caf50380360313a33a6fb339.exe 26 PID 1584 wrote to memory of 1948 1584 b2956955caf50380360313a33a6fb339.exe 26 PID 1584 wrote to memory of 1948 1584 b2956955caf50380360313a33a6fb339.exe 26 PID 1584 wrote to memory of 1948 1584 b2956955caf50380360313a33a6fb339.exe 26 PID 1584 wrote to memory of 1948 1584 b2956955caf50380360313a33a6fb339.exe 26 PID 1584 wrote to memory of 1948 1584 b2956955caf50380360313a33a6fb339.exe 26 PID 1584 wrote to memory of 1948 1584 b2956955caf50380360313a33a6fb339.exe 26 PID 1584 wrote to memory of 1948 1584 b2956955caf50380360313a33a6fb339.exe 26 PID 1584 wrote to memory of 1948 1584 b2956955caf50380360313a33a6fb339.exe 26 PID 1584 wrote to memory of 1948 1584 b2956955caf50380360313a33a6fb339.exe 26 PID 1584 wrote to memory of 1948 1584 b2956955caf50380360313a33a6fb339.exe 26 PID 1584 wrote to memory of 1948 1584 b2956955caf50380360313a33a6fb339.exe 26 PID 1584 wrote to memory of 1948 1584 b2956955caf50380360313a33a6fb339.exe 26 PID 1584 wrote to memory of 1948 1584 b2956955caf50380360313a33a6fb339.exe 26 PID 1584 wrote to memory of 1948 1584 b2956955caf50380360313a33a6fb339.exe 26 PID 1584 wrote to memory of 1948 1584 b2956955caf50380360313a33a6fb339.exe 26 PID 1584 wrote to memory of 1948 1584 b2956955caf50380360313a33a6fb339.exe 26 PID 1584 wrote to memory of 1948 1584 b2956955caf50380360313a33a6fb339.exe 26 PID 1584 wrote to memory of 1948 1584 b2956955caf50380360313a33a6fb339.exe 26 PID 1584 wrote to memory of 1948 1584 b2956955caf50380360313a33a6fb339.exe 26 PID 1948 wrote to memory of 1312 1948 extrac32.exe 30 PID 1948 wrote to memory of 1312 1948 extrac32.exe 30 PID 1948 wrote to memory of 1312 1948 extrac32.exe 30 PID 1948 wrote to memory of 1312 1948 extrac32.exe 30 PID 1948 wrote to memory of 1312 1948 extrac32.exe 30 PID 1948 wrote to memory of 1312 1948 extrac32.exe 30 PID 1948 wrote to memory of 1312 1948 extrac32.exe 30 PID 1948 wrote to memory of 1312 1948 extrac32.exe 30 PID 1948 wrote to memory of 1312 1948 extrac32.exe 30 PID 1948 wrote to memory of 1312 1948 extrac32.exe 30 PID 1948 wrote to memory of 1312 1948 extrac32.exe 30 PID 1948 wrote to memory of 1312 1948 extrac32.exe 30 PID 1948 wrote to memory of 1312 1948 extrac32.exe 30 PID 1948 wrote to memory of 1312 1948 extrac32.exe 30 PID 1948 wrote to memory of 1312 1948 extrac32.exe 30 PID 1948 wrote to memory of 1312 1948 extrac32.exe 30 PID 1948 wrote to memory of 1312 1948 extrac32.exe 30 PID 1948 wrote to memory of 1312 1948 extrac32.exe 30 PID 1948 wrote to memory of 1312 1948 extrac32.exe 30 PID 1948 wrote to memory of 1312 1948 extrac32.exe 30 PID 1948 wrote to memory of 1312 1948 extrac32.exe 30 PID 1948 wrote to memory of 1312 1948 extrac32.exe 30 PID 1948 wrote to memory of 1312 1948 extrac32.exe 30 PID 1948 wrote to memory of 1312 1948 extrac32.exe 30 PID 1948 wrote to memory of 1312 1948 extrac32.exe 30 PID 1948 wrote to memory of 1312 1948 extrac32.exe 30 PID 1948 wrote to memory of 1312 1948 extrac32.exe 30 PID 1948 wrote to memory of 1312 1948 extrac32.exe 30 PID 1948 wrote to memory of 1312 1948 extrac32.exe 30 PID 1948 wrote to memory of 1312 1948 extrac32.exe 30 PID 1948 wrote to memory of 1312 1948 extrac32.exe 30 PID 1948 wrote to memory of 1312 1948 extrac32.exe 30 PID 1948 wrote to memory of 1312 1948 extrac32.exe 30 PID 1948 wrote to memory of 1312 1948 extrac32.exe 30 PID 1948 wrote to memory of 1312 1948 extrac32.exe 30 PID 1948 wrote to memory of 1312 1948 extrac32.exe 30 PID 1948 wrote to memory of 1312 1948 extrac32.exe 30 PID 1948 wrote to memory of 1312 1948 extrac32.exe 30 PID 1948 wrote to memory of 1312 1948 extrac32.exe 30 PID 1948 wrote to memory of 1312 1948 extrac32.exe 30 PID 1948 wrote to memory of 1312 1948 extrac32.exe 30 PID 1948 wrote to memory of 1312 1948 extrac32.exe 30 PID 1948 wrote to memory of 1312 1948 extrac32.exe 30 PID 1948 wrote to memory of 1312 1948 extrac32.exe 30 PID 1948 wrote to memory of 1312 1948 extrac32.exe 30 PID 1948 wrote to memory of 1312 1948 extrac32.exe 30
Processes
-
C:\Users\Admin\AppData\Local\Temp\b2956955caf50380360313a33a6fb339.exe"C:\Users\Admin\AppData\Local\Temp\b2956955caf50380360313a33a6fb339.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1584 -
C:\Windows\SysWOW64\extrac32.exe"C:\Windows\system32\extrac32.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1948 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe"3⤵
- Blocklisted process makes network request
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:1312
-
-