Analysis
- max time kernel
111s - max time network
124s - platform
windows10_x64 - resource
win10v20201028 - submitted
15/12/2020, 07:59
Static task
static1
Behavioral task
behavioral1
Sample
b2956955caf50380360313a33a6fb339.exe
Resource
win7v20201028
windows7_x64
0 signatures
0 seconds
General
- Target b2956955caf50380360313a33a6fb339.exe
- Size 1.2MB
- Sample201215-6ejed4ny7n
- SHA256 b46b5b42ac74dfcff2d6dcd0ea1492c7065428ced5276fff88bbb06415315bef
- MD5 b2956955caf50380360313a33a6fb339
- SHA1 7db33e9f19fa54dbf5962167962c03b1002277e6
- SHA512 a7edc61a6addbbcdf64d02fbd7dad93e3f616748e7b19dbb827d95649db5e3b4483ce66534875a1ff29c40a6e17e3b0e9627ee1e1bff473ddfef72685b4e7a45
- MD5 SHA1 SHA512
Malware Config
Extracted
Family
-
lokibot
C2
-
http://begadi.ga/chud/gate.php
-
http://kbfvzoboss.bid/alien/fre.php
-
http://alphastand.trade/alien/fre.php
-
http://alphastand.win/alien/fre.php
-
http://alphastand.top/alien/fre.php
Signatures
- Drops file in Windows directory 1 IoCs
description ioc Process File created C:\Windows\Tasks\svr.job notepad.exe - Suspicious behavior: EnumeratesProcesses 7 IoCs
pid Process 508 b2956955caf50380360313a33a6fb339.exe 2228 extrac32.exe 2228 extrac32.exe 2228 extrac32.exe 2228 extrac32.exe 2228 extrac32.exe 2228 extrac32.exe - Suspicious behavior: MapViewOfSection 6 IoCs
pid Process 2228 extrac32.exe 2228 extrac32.exe 2228 extrac32.exe 2228 extrac32.exe 2228 extrac32.exe 2228 extrac32.exe - Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 3584 notepad.exe - Suspicious use of WriteProcessMemory 204 IoCs
description pid Process procid_target PID 508 wrote to memory of 2228 508 b2956955caf50380360313a33a6fb339.exe 75 PID 508 wrote to memory of 2228 508 b2956955caf50380360313a33a6fb339.exe 75 PID 508 wrote to memory of 2228 508 b2956955caf50380360313a33a6fb339.exe 75 PID 508 wrote to memory of 2228 508 b2956955caf50380360313a33a6fb339.exe 75 PID 508 wrote to memory of 2228 508 b2956955caf50380360313a33a6fb339.exe 75 PID 508 wrote to memory of 2228 508 b2956955caf50380360313a33a6fb339.exe 75 PID 508 wrote to memory of 2228 508 b2956955caf50380360313a33a6fb339.exe 75 PID 508 wrote to memory of 2228 508 b2956955caf50380360313a33a6fb339.exe 75 PID 508 wrote to memory of 2228 508 b2956955caf50380360313a33a6fb339.exe 75 PID 508 wrote to memory of 2228 508 b2956955caf50380360313a33a6fb339.exe 75 PID 508 wrote to memory of 2228 508 b2956955caf50380360313a33a6fb339.exe 75 PID 508 wrote to memory of 2228 508 b2956955caf50380360313a33a6fb339.exe 75 PID 508 wrote to memory of 2228 508 b2956955caf50380360313a33a6fb339.exe 75 PID 508 wrote to memory of 2228 508 b2956955caf50380360313a33a6fb339.exe 75 PID 508 wrote to memory of 2228 508 b2956955caf50380360313a33a6fb339.exe 75 PID 508 wrote to memory of 2228 508 b2956955caf50380360313a33a6fb339.exe 75 PID 508 wrote to memory of 2228 508 b2956955caf50380360313a33a6fb339.exe 75 PID 508 wrote to memory of 2228 508 b2956955caf50380360313a33a6fb339.exe 75 PID 508 wrote to memory of 2228 508 b2956955caf50380360313a33a6fb339.exe 75 PID 508 wrote to memory of 2228 508 b2956955caf50380360313a33a6fb339.exe 75 PID 508 wrote to memory of 2228 508 b2956955caf50380360313a33a6fb339.exe 75 PID 508 wrote to memory of 2228 508 b2956955caf50380360313a33a6fb339.exe 75 PID 508 wrote to memory of 2228 508 b2956955caf50380360313a33a6fb339.exe 75 PID 508 wrote to memory of 2228 508 b2956955caf50380360313a33a6fb339.exe 75 PID 508 wrote to memory of 2228 508 b2956955caf50380360313a33a6fb339.exe 75 PID 508 wrote to memory of 2228 508 b2956955caf50380360313a33a6fb339.exe 75 PID 508 wrote to memory of 2228 508 b2956955caf50380360313a33a6fb339.exe 75 PID 508 wrote to memory of 2228 508 b2956955caf50380360313a33a6fb339.exe 75 PID 508 wrote to memory of 2228 508 b2956955caf50380360313a33a6fb339.exe 75 PID 508 wrote to memory of 2228 508 b2956955caf50380360313a33a6fb339.exe 75 PID 508 wrote to memory of 2228 508 b2956955caf50380360313a33a6fb339.exe 75 PID 508 wrote to memory of 2228 508 b2956955caf50380360313a33a6fb339.exe 75 PID 508 wrote to memory of 2228 508 b2956955caf50380360313a33a6fb339.exe 75 PID 508 wrote to memory of 2228 508 b2956955caf50380360313a33a6fb339.exe 75 PID 508 wrote to memory of 2228 508 b2956955caf50380360313a33a6fb339.exe 75 PID 508 wrote to memory of 2228 508 b2956955caf50380360313a33a6fb339.exe 75 PID 508 wrote to memory of 2228 508 b2956955caf50380360313a33a6fb339.exe 75 PID 508 wrote to memory of 2228 508 b2956955caf50380360313a33a6fb339.exe 75 PID 508 wrote to memory of 2228 508 b2956955caf50380360313a33a6fb339.exe 75 PID 508 wrote to memory of 2228 508 b2956955caf50380360313a33a6fb339.exe 75 PID 508 wrote to memory of 2228 508 b2956955caf50380360313a33a6fb339.exe 75 PID 508 wrote to memory of 2228 508 b2956955caf50380360313a33a6fb339.exe 75 PID 508 wrote to memory of 2228 508 b2956955caf50380360313a33a6fb339.exe 75 PID 508 wrote to memory of 2228 508 b2956955caf50380360313a33a6fb339.exe 75 PID 508 wrote to memory of 2228 508 b2956955caf50380360313a33a6fb339.exe 75 PID 508 wrote to memory of 2228 508 b2956955caf50380360313a33a6fb339.exe 75 PID 508 wrote to memory of 2228 508 b2956955caf50380360313a33a6fb339.exe 75 PID 508 wrote to memory of 2228 508 b2956955caf50380360313a33a6fb339.exe 75 PID 508 wrote to memory of 2228 508 b2956955caf50380360313a33a6fb339.exe 75 PID 508 wrote to memory of 2228 508 b2956955caf50380360313a33a6fb339.exe 75 PID 508 wrote to memory of 2228 508 b2956955caf50380360313a33a6fb339.exe 75 PID 508 wrote to memory of 2228 508 b2956955caf50380360313a33a6fb339.exe 75 PID 508 wrote to memory of 2228 508 b2956955caf50380360313a33a6fb339.exe 75 PID 508 wrote to memory of 2228 508 b2956955caf50380360313a33a6fb339.exe 75 PID 508 wrote to memory of 2228 508 b2956955caf50380360313a33a6fb339.exe 75 PID 508 wrote to memory of 2228 508 b2956955caf50380360313a33a6fb339.exe 75 PID 508 wrote to memory of 2228 508 b2956955caf50380360313a33a6fb339.exe 75 PID 508 wrote to memory of 2228 508 b2956955caf50380360313a33a6fb339.exe 75 PID 508 wrote to memory of 2228 508 b2956955caf50380360313a33a6fb339.exe 75 PID 508 wrote to memory of 2228 508 b2956955caf50380360313a33a6fb339.exe 75 PID 508 wrote to memory of 2228 508 b2956955caf50380360313a33a6fb339.exe 75 PID 508 wrote to memory of 2228 508 b2956955caf50380360313a33a6fb339.exe 75 PID 508 wrote to memory of 2228 508 b2956955caf50380360313a33a6fb339.exe 75 PID 508 wrote to memory of 2228 508 b2956955caf50380360313a33a6fb339.exe 75 PID 508 wrote to memory of 2228 508 b2956955caf50380360313a33a6fb339.exe 75 PID 508 wrote to memory of 2228 508 b2956955caf50380360313a33a6fb339.exe 75 PID 508 wrote to memory of 2228 508 b2956955caf50380360313a33a6fb339.exe 75 PID 508 wrote to memory of 2228 508 b2956955caf50380360313a33a6fb339.exe 75 PID 508 wrote to memory of 2228 508 b2956955caf50380360313a33a6fb339.exe 75 PID 508 wrote to memory of 2228 508 b2956955caf50380360313a33a6fb339.exe 75 PID 508 wrote to memory of 2228 508 b2956955caf50380360313a33a6fb339.exe 75 PID 508 wrote to memory of 2228 508 b2956955caf50380360313a33a6fb339.exe 75 PID 508 wrote to memory of 2228 508 b2956955caf50380360313a33a6fb339.exe 75 PID 508 wrote to memory of 2228 508 b2956955caf50380360313a33a6fb339.exe 75 PID 2228 wrote to memory of 2532 2228 extrac32.exe 79 PID 2228 wrote to memory of 2532 2228 extrac32.exe 79 PID 2228 wrote to memory of 2532 2228 extrac32.exe 79 PID 2228 wrote to memory of 2532 2228 extrac32.exe 79 PID 2228 wrote to memory of 2532 2228 extrac32.exe 79 PID 2228 wrote to memory of 2532 2228 extrac32.exe 79 PID 2228 wrote to memory of 2532 2228 extrac32.exe 79 PID 2228 wrote to memory of 2532 2228 extrac32.exe 79 PID 2228 wrote to memory of 2532 2228 extrac32.exe 79 PID 2228 wrote to memory of 1384 2228 extrac32.exe 80 PID 2228 wrote to memory of 1384 2228 extrac32.exe 80 PID 2228 wrote to memory of 1384 2228 extrac32.exe 80 PID 2228 wrote to memory of 1384 2228 extrac32.exe 80 PID 2228 wrote to memory of 1384 2228 extrac32.exe 80 PID 2228 wrote to memory of 1384 2228 extrac32.exe 80 PID 2228 wrote to memory of 1384 2228 extrac32.exe 80 PID 2228 wrote to memory of 1384 2228 extrac32.exe 80 PID 2228 wrote to memory of 1384 2228 extrac32.exe 80 PID 2228 wrote to memory of 188 2228 extrac32.exe 81 PID 2228 wrote to memory of 188 2228 extrac32.exe 81 PID 2228 wrote to memory of 188 2228 extrac32.exe 81 PID 2228 wrote to memory of 188 2228 extrac32.exe 81 PID 2228 wrote to memory of 188 2228 extrac32.exe 81 PID 2228 wrote to memory of 188 2228 extrac32.exe 81 PID 2228 wrote to memory of 188 2228 extrac32.exe 81 PID 2228 wrote to memory of 188 2228 extrac32.exe 81 PID 2228 wrote to memory of 188 2228 extrac32.exe 81 PID 2228 wrote to memory of 196 2228 extrac32.exe 82 PID 2228 wrote to memory of 196 2228 extrac32.exe 82 PID 2228 wrote to memory of 196 2228 extrac32.exe 82 PID 2228 wrote to memory of 196 2228 extrac32.exe 82 PID 2228 wrote to memory of 196 2228 extrac32.exe 82 PID 2228 wrote to memory of 196 2228 extrac32.exe 82 PID 2228 wrote to memory of 196 2228 extrac32.exe 82 PID 2228 wrote to memory of 196 2228 extrac32.exe 82 PID 2228 wrote to memory of 196 2228 extrac32.exe 82 PID 2228 wrote to memory of 3240 2228 extrac32.exe 83 PID 2228 wrote to memory of 3240 2228 extrac32.exe 83 PID 2228 wrote to memory of 3240 2228 extrac32.exe 83 PID 2228 wrote to memory of 3240 2228 extrac32.exe 83 PID 2228 wrote to memory of 3240 2228 extrac32.exe 83 PID 2228 wrote to memory of 3240 2228 extrac32.exe 83 PID 2228 wrote to memory of 3240 2228 extrac32.exe 83 PID 2228 wrote to memory of 3240 2228 extrac32.exe 83 PID 2228 wrote to memory of 3240 2228 extrac32.exe 83 PID 2228 wrote to memory of 3584 2228 extrac32.exe 84 PID 2228 wrote to memory of 3584 2228 extrac32.exe 84 PID 2228 wrote to memory of 3584 2228 extrac32.exe 84 PID 2228 wrote to memory of 3584 2228 extrac32.exe 84 PID 2228 wrote to memory of 3584 2228 extrac32.exe 84 PID 2228 wrote to memory of 3584 2228 extrac32.exe 84 PID 2228 wrote to memory of 3584 2228 extrac32.exe 84 PID 2228 wrote to memory of 3584 2228 extrac32.exe 84 PID 2228 wrote to memory of 3584 2228 extrac32.exe 84 PID 2228 wrote to memory of 3584 2228 extrac32.exe 84 PID 2228 wrote to memory of 3584 2228 extrac32.exe 84 PID 2228 wrote to memory of 3584 2228 extrac32.exe 84 PID 2228 wrote to memory of 3584 2228 extrac32.exe 84 PID 2228 wrote to memory of 3584 2228 extrac32.exe 84 PID 2228 wrote to memory of 3584 2228 extrac32.exe 84 PID 2228 wrote to memory of 3584 2228 extrac32.exe 84 PID 2228 wrote to memory of 3584 2228 extrac32.exe 84 PID 2228 wrote to memory of 3584 2228 extrac32.exe 84 PID 2228 wrote to memory of 3584 2228 extrac32.exe 84 PID 2228 wrote to memory of 3584 2228 extrac32.exe 84 PID 2228 wrote to memory of 3584 2228 extrac32.exe 84 PID 2228 wrote to memory of 3584 2228 extrac32.exe 84 PID 2228 wrote to memory of 3584 2228 extrac32.exe 84 PID 2228 wrote to memory of 3584 2228 extrac32.exe 84 PID 2228 wrote to memory of 3584 2228 extrac32.exe 84 PID 2228 wrote to memory of 3584 2228 extrac32.exe 84 PID 2228 wrote to memory of 3584 2228 extrac32.exe 84 PID 2228 wrote to memory of 3584 2228 extrac32.exe 84 PID 2228 wrote to memory of 3584 2228 extrac32.exe 84 PID 2228 wrote to memory of 3584 2228 extrac32.exe 84 PID 2228 wrote to memory of 3584 2228 extrac32.exe 84 PID 2228 wrote to memory of 3584 2228 extrac32.exe 84 PID 2228 wrote to memory of 3584 2228 extrac32.exe 84 PID 2228 wrote to memory of 3584 2228 extrac32.exe 84 PID 2228 wrote to memory of 3584 2228 extrac32.exe 84 PID 2228 wrote to memory of 3584 2228 extrac32.exe 84 PID 2228 wrote to memory of 3584 2228 extrac32.exe 84 PID 2228 wrote to memory of 3584 2228 extrac32.exe 84 PID 2228 wrote to memory of 3584 2228 extrac32.exe 84 PID 2228 wrote to memory of 3584 2228 extrac32.exe 84 PID 2228 wrote to memory of 3584 2228 extrac32.exe 84 PID 2228 wrote to memory of 3584 2228 extrac32.exe 84 PID 2228 wrote to memory of 3584 2228 extrac32.exe 84 PID 2228 wrote to memory of 3584 2228 extrac32.exe 84 PID 2228 wrote to memory of 3584 2228 extrac32.exe 84 PID 2228 wrote to memory of 3584 2228 extrac32.exe 84 PID 2228 wrote to memory of 3584 2228 extrac32.exe 84 PID 2228 wrote to memory of 3584 2228 extrac32.exe 84 PID 2228 wrote to memory of 3584 2228 extrac32.exe 84 PID 2228 wrote to memory of 3584 2228 extrac32.exe 84 PID 2228 wrote to memory of 3584 2228 extrac32.exe 84 PID 2228 wrote to memory of 3584 2228 extrac32.exe 84 PID 2228 wrote to memory of 3584 2228 extrac32.exe 84 PID 2228 wrote to memory of 3584 2228 extrac32.exe 84 PID 2228 wrote to memory of 3584 2228 extrac32.exe 84 PID 2228 wrote to memory of 3584 2228 extrac32.exe 84 PID 2228 wrote to memory of 3584 2228 extrac32.exe 84 PID 2228 wrote to memory of 3584 2228 extrac32.exe 84 PID 2228 wrote to memory of 3584 2228 extrac32.exe 84 PID 2228 wrote to memory of 3584 2228 extrac32.exe 84 PID 2228 wrote to memory of 3584 2228 extrac32.exe 84 PID 2228 wrote to memory of 3584 2228 extrac32.exe 84 PID 2228 wrote to memory of 3584 2228 extrac32.exe 84 PID 2228 wrote to memory of 3584 2228 extrac32.exe 84 PID 2228 wrote to memory of 3584 2228 extrac32.exe 84 PID 2228 wrote to memory of 3584 2228 extrac32.exe 84 PID 2228 wrote to memory of 3584 2228 extrac32.exe 84 PID 2228 wrote to memory of 3584 2228 extrac32.exe 84 PID 2228 wrote to memory of 3584 2228 extrac32.exe 84 PID 2228 wrote to memory of 3584 2228 extrac32.exe 84 PID 2228 wrote to memory of 3584 2228 extrac32.exe 84 PID 2228 wrote to memory of 3584 2228 extrac32.exe 84 PID 2228 wrote to memory of 3584 2228 extrac32.exe 84 PID 2228 wrote to memory of 3584 2228 extrac32.exe 84 PID 2228 wrote to memory of 3584 2228 extrac32.exe 84 PID 2228 wrote to memory of 3584 2228 extrac32.exe 84 PID 2228 wrote to memory of 3584 2228 extrac32.exe 84 PID 2228 wrote to memory of 3584 2228 extrac32.exe 84 PID 2228 wrote to memory of 3584 2228 extrac32.exe 84 PID 2228 wrote to memory of 3584 2228 extrac32.exe 84 PID 2228 wrote to memory of 3584 2228 extrac32.exe 84 PID 2228 wrote to memory of 3584 2228 extrac32.exe 84 PID 2228 wrote to memory of 3584 2228 extrac32.exe 84 PID 2228 wrote to memory of 3584 2228 extrac32.exe 84 PID 2228 wrote to memory of 3584 2228 extrac32.exe 84
Processes
-
C:\Users\Admin\AppData\Local\Temp\b2956955caf50380360313a33a6fb339.exe"C:\Users\Admin\AppData\Local\Temp\b2956955caf50380360313a33a6fb339.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:508 -
C:\Windows\SysWOW64\extrac32.exe"C:\Windows\system32\extrac32.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:2228 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe"3⤵PID:2532
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe"3⤵PID:1384
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe"3⤵PID:188
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe"3⤵PID:196
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe"3⤵PID:3240
-
-
C:\Windows\SysWOW64\notepad.exe"C:\Windows\system32\notepad.exe"3⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:3584
-
-