Analysis
-
max time kernel
152s -
max time network
151s -
platform
windows10_x64 -
resource
win10v20201028 -
submitted
12-01-2021 17:50
Static task
static1
Behavioral task
behavioral1
Sample
6f11b6baad406aa223f72545d807e8f9.exe
Resource
win7v20201028
windows7_x64
0 signatures
0 seconds
General
-
Target
6f11b6baad406aa223f72545d807e8f9.exe
-
Size
896KB
-
MD5
6f11b6baad406aa223f72545d807e8f9
-
SHA1
2536e4e60bf71286db7f8a0c16fcbb68ca6944d1
-
SHA256
bc4bab61ab8b90451441bacba2edad8c1acd2a93c0318f4f4aa303627c4e7e3a
-
SHA512
28c0cfbdd1bf5aaf30a63d4f7e5a06e28a9f66356d2ddee297a50cda56a9f895e2036d36efe90d7a9e0cecbe49a518f030d4906b7f3616acfe82ab6b30c4b91b
Malware Config
Extracted
Family
lokibot
C2
https://worldpackmx.com/wfretyuil/Panel/five/fre.php
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php
Signatures
-
Suspicious use of SetThreadContext 1 IoCs
Processes:
6f11b6baad406aa223f72545d807e8f9.exedescription pid process target process PID 640 set thread context of 936 640 6f11b6baad406aa223f72545d807e8f9.exe 6f11b6baad406aa223f72545d807e8f9.exe -
Suspicious behavior: RenamesItself 1 IoCs
Processes:
6f11b6baad406aa223f72545d807e8f9.exepid process 936 6f11b6baad406aa223f72545d807e8f9.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
6f11b6baad406aa223f72545d807e8f9.exedescription pid process Token: SeDebugPrivilege 936 6f11b6baad406aa223f72545d807e8f9.exe -
Suspicious use of WriteProcessMemory 9 IoCs
Processes:
6f11b6baad406aa223f72545d807e8f9.exedescription pid process target process PID 640 wrote to memory of 936 640 6f11b6baad406aa223f72545d807e8f9.exe 6f11b6baad406aa223f72545d807e8f9.exe PID 640 wrote to memory of 936 640 6f11b6baad406aa223f72545d807e8f9.exe 6f11b6baad406aa223f72545d807e8f9.exe PID 640 wrote to memory of 936 640 6f11b6baad406aa223f72545d807e8f9.exe 6f11b6baad406aa223f72545d807e8f9.exe PID 640 wrote to memory of 936 640 6f11b6baad406aa223f72545d807e8f9.exe 6f11b6baad406aa223f72545d807e8f9.exe PID 640 wrote to memory of 936 640 6f11b6baad406aa223f72545d807e8f9.exe 6f11b6baad406aa223f72545d807e8f9.exe PID 640 wrote to memory of 936 640 6f11b6baad406aa223f72545d807e8f9.exe 6f11b6baad406aa223f72545d807e8f9.exe PID 640 wrote to memory of 936 640 6f11b6baad406aa223f72545d807e8f9.exe 6f11b6baad406aa223f72545d807e8f9.exe PID 640 wrote to memory of 936 640 6f11b6baad406aa223f72545d807e8f9.exe 6f11b6baad406aa223f72545d807e8f9.exe PID 640 wrote to memory of 936 640 6f11b6baad406aa223f72545d807e8f9.exe 6f11b6baad406aa223f72545d807e8f9.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\6f11b6baad406aa223f72545d807e8f9.exe"C:\Users\Admin\AppData\Local\Temp\6f11b6baad406aa223f72545d807e8f9.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\6f11b6baad406aa223f72545d807e8f9.exe"C:\Users\Admin\AppData\Local\Temp\6f11b6baad406aa223f72545d807e8f9.exe"2⤵
- Suspicious behavior: RenamesItself
- Suspicious use of AdjustPrivilegeToken