Analysis
-
max time kernel
122s -
max time network
126s -
platform
windows10_x64 -
resource
win10v20201028 -
submitted
13-01-2021 07:30
Static task
static1
Behavioral task
behavioral1
Sample
Documentos de pago.PDF.bat.exe
Resource
win7v20201028
windows7_x64
0 signatures
0 seconds
General
-
Target
Documentos de pago.PDF.bat.exe
-
Size
785KB
-
MD5
3f09920e886cc97941e5f583df1f748e
-
SHA1
ce884a421722073936438dfea755547674c6b003
-
SHA256
a34d721f2e55cfaf7913b4a5805cc1be6becb6f4bb61875b8d7f7d60c23b3e29
-
SHA512
e9d151593b3f4d32c60fe7308a01d7c26756d10ecd805d7aa6cd64ef623a7864e0254dcfeea22a0b55ead122c1b36b9a6315185362142b53e9ccd68efef8fab1
Malware Config
Extracted
Family
lokibot
C2
http://51.195.53.221/p.php/qElaNgWyezEFV
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php
Signatures
-
Suspicious use of SetThreadContext 1 IoCs
Processes:
Documentos de pago.PDF.bat.exedescription pid process target process PID 732 set thread context of 2212 732 Documentos de pago.PDF.bat.exe Documentos de pago.PDF.bat.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
Documentos de pago.PDF.bat.exepid process 732 Documentos de pago.PDF.bat.exe 732 Documentos de pago.PDF.bat.exe -
Suspicious behavior: RenamesItself 1 IoCs
Processes:
Documentos de pago.PDF.bat.exepid process 2212 Documentos de pago.PDF.bat.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
Documentos de pago.PDF.bat.exeDocumentos de pago.PDF.bat.exedescription pid process Token: SeDebugPrivilege 732 Documentos de pago.PDF.bat.exe Token: SeDebugPrivilege 2212 Documentos de pago.PDF.bat.exe -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
Documentos de pago.PDF.bat.exedescription pid process target process PID 732 wrote to memory of 2336 732 Documentos de pago.PDF.bat.exe Documentos de pago.PDF.bat.exe PID 732 wrote to memory of 2336 732 Documentos de pago.PDF.bat.exe Documentos de pago.PDF.bat.exe PID 732 wrote to memory of 2336 732 Documentos de pago.PDF.bat.exe Documentos de pago.PDF.bat.exe PID 732 wrote to memory of 2212 732 Documentos de pago.PDF.bat.exe Documentos de pago.PDF.bat.exe PID 732 wrote to memory of 2212 732 Documentos de pago.PDF.bat.exe Documentos de pago.PDF.bat.exe PID 732 wrote to memory of 2212 732 Documentos de pago.PDF.bat.exe Documentos de pago.PDF.bat.exe PID 732 wrote to memory of 2212 732 Documentos de pago.PDF.bat.exe Documentos de pago.PDF.bat.exe PID 732 wrote to memory of 2212 732 Documentos de pago.PDF.bat.exe Documentos de pago.PDF.bat.exe PID 732 wrote to memory of 2212 732 Documentos de pago.PDF.bat.exe Documentos de pago.PDF.bat.exe PID 732 wrote to memory of 2212 732 Documentos de pago.PDF.bat.exe Documentos de pago.PDF.bat.exe PID 732 wrote to memory of 2212 732 Documentos de pago.PDF.bat.exe Documentos de pago.PDF.bat.exe PID 732 wrote to memory of 2212 732 Documentos de pago.PDF.bat.exe Documentos de pago.PDF.bat.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Documentos de pago.PDF.bat.exe"C:\Users\Admin\AppData\Local\Temp\Documentos de pago.PDF.bat.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:732 -
C:\Users\Admin\AppData\Local\Temp\Documentos de pago.PDF.bat.exe"C:\Users\Admin\AppData\Local\Temp\Documentos de pago.PDF.bat.exe"2⤵PID:2336
-
C:\Users\Admin\AppData\Local\Temp\Documentos de pago.PDF.bat.exe"C:\Users\Admin\AppData\Local\Temp\Documentos de pago.PDF.bat.exe"2⤵
- Suspicious behavior: RenamesItself
- Suspicious use of AdjustPrivilegeToken
PID:2212
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/732-2-0x00000000730E0000-0x00000000737CE000-memory.dmpFilesize
6.9MB
-
memory/732-3-0x0000000000790000-0x0000000000791000-memory.dmpFilesize
4KB
-
memory/732-5-0x0000000007580000-0x0000000007581000-memory.dmpFilesize
4KB
-
memory/732-6-0x0000000007B20000-0x0000000007B21000-memory.dmpFilesize
4KB
-
memory/732-7-0x00000000076C0000-0x00000000076C1000-memory.dmpFilesize
4KB
-
memory/732-8-0x0000000007540000-0x0000000007541000-memory.dmpFilesize
4KB
-
memory/732-9-0x0000000007820000-0x0000000007821000-memory.dmpFilesize
4KB
-
memory/732-10-0x0000000004B40000-0x0000000004B52000-memory.dmpFilesize
72KB
-
memory/732-11-0x00000000054C0000-0x0000000005519000-memory.dmpFilesize
356KB
-
memory/2212-12-0x0000000000400000-0x00000000004A2000-memory.dmpFilesize
648KB
-
memory/2212-13-0x00000000004139DE-mapping.dmp
-
memory/2212-14-0x0000000000400000-0x00000000004A2000-memory.dmpFilesize
648KB