Analysis
-
max time kernel
145s -
max time network
147s -
platform
windows10_x64 -
resource
win10v20201028 -
submitted
13-01-2021 07:15
Static task
static1
Behavioral task
behavioral1
Sample
d6fc664bb8081dbf36630f415ec96dcf.exe
Resource
win7v20201028
windows7_x64
0 signatures
0 seconds
General
-
Target
d6fc664bb8081dbf36630f415ec96dcf.exe
-
Size
979KB
-
MD5
d6fc664bb8081dbf36630f415ec96dcf
-
SHA1
d6252d55da7f1036fe33049dbb65b1b68c477599
-
SHA256
d236ee873e8191d24434226bc7b80f0542db7ed43323181b5ee8bc3a3de052cc
-
SHA512
e8a5d33a45c73a0e7fe1d9afe158921af332055399b69893d9d1727375da259429eb2805b424a992618077f1d4bf0c9ff782b81025f2ca5021826bc49bd30a39
Malware Config
Extracted
Family
lokibot
C2
http://azme-contractors.com/chief/kev/fre.php
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php
Signatures
-
Suspicious use of SetThreadContext 1 IoCs
Processes:
d6fc664bb8081dbf36630f415ec96dcf.exedescription pid process target process PID 744 set thread context of 3164 744 d6fc664bb8081dbf36630f415ec96dcf.exe d6fc664bb8081dbf36630f415ec96dcf.exe -
Suspicious behavior: RenamesItself 1 IoCs
Processes:
d6fc664bb8081dbf36630f415ec96dcf.exepid process 3164 d6fc664bb8081dbf36630f415ec96dcf.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
d6fc664bb8081dbf36630f415ec96dcf.exedescription pid process Token: SeDebugPrivilege 3164 d6fc664bb8081dbf36630f415ec96dcf.exe -
Suspicious use of WriteProcessMemory 9 IoCs
Processes:
d6fc664bb8081dbf36630f415ec96dcf.exedescription pid process target process PID 744 wrote to memory of 3164 744 d6fc664bb8081dbf36630f415ec96dcf.exe d6fc664bb8081dbf36630f415ec96dcf.exe PID 744 wrote to memory of 3164 744 d6fc664bb8081dbf36630f415ec96dcf.exe d6fc664bb8081dbf36630f415ec96dcf.exe PID 744 wrote to memory of 3164 744 d6fc664bb8081dbf36630f415ec96dcf.exe d6fc664bb8081dbf36630f415ec96dcf.exe PID 744 wrote to memory of 3164 744 d6fc664bb8081dbf36630f415ec96dcf.exe d6fc664bb8081dbf36630f415ec96dcf.exe PID 744 wrote to memory of 3164 744 d6fc664bb8081dbf36630f415ec96dcf.exe d6fc664bb8081dbf36630f415ec96dcf.exe PID 744 wrote to memory of 3164 744 d6fc664bb8081dbf36630f415ec96dcf.exe d6fc664bb8081dbf36630f415ec96dcf.exe PID 744 wrote to memory of 3164 744 d6fc664bb8081dbf36630f415ec96dcf.exe d6fc664bb8081dbf36630f415ec96dcf.exe PID 744 wrote to memory of 3164 744 d6fc664bb8081dbf36630f415ec96dcf.exe d6fc664bb8081dbf36630f415ec96dcf.exe PID 744 wrote to memory of 3164 744 d6fc664bb8081dbf36630f415ec96dcf.exe d6fc664bb8081dbf36630f415ec96dcf.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\d6fc664bb8081dbf36630f415ec96dcf.exe"C:\Users\Admin\AppData\Local\Temp\d6fc664bb8081dbf36630f415ec96dcf.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:744 -
C:\Users\Admin\AppData\Local\Temp\d6fc664bb8081dbf36630f415ec96dcf.exe"C:\Users\Admin\AppData\Local\Temp\d6fc664bb8081dbf36630f415ec96dcf.exe"2⤵
- Suspicious behavior: RenamesItself
- Suspicious use of AdjustPrivilegeToken
PID:3164
-