Analysis
-
max time kernel
109s -
max time network
115s -
platform
windows10_x64 -
resource
win10v20201028 -
submitted
14-01-2021 06:55
Static task
static1
Behavioral task
behavioral1
Sample
PROFORMA INVOICE.exe
Resource
win7v20201028
General
-
Target
PROFORMA INVOICE.exe
-
Size
604KB
-
MD5
d0e73d5b3842e748007e2989563777df
-
SHA1
95541e45052ff878d1f03d75c95c0167769e4654
-
SHA256
c7c001f29eb88786385f54395ecc75b780e9b54dd2eae54bcce61656a784e04d
-
SHA512
7ea6d9a05232af13927912ada4b1cef23d461dcfbed644d7241675768b896aa99609d0b235e09ca455611ad149a739a64887cfaecd6b0528a6dfdf0eba9c1de8
Malware Config
Extracted
lokibot
http://habibmentro.com/hybrid/five/fre.php
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php
Signatures
-
Suspicious use of SetThreadContext 1 IoCs
Processes:
PROFORMA INVOICE.exedescription pid process target process PID 744 set thread context of 64 744 PROFORMA INVOICE.exe PROFORMA INVOICE.exe -
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 3 IoCs
Processes:
PROFORMA INVOICE.exepid process 744 PROFORMA INVOICE.exe 744 PROFORMA INVOICE.exe 744 PROFORMA INVOICE.exe -
Suspicious behavior: RenamesItself 1 IoCs
Processes:
PROFORMA INVOICE.exepid process 64 PROFORMA INVOICE.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
PROFORMA INVOICE.exePROFORMA INVOICE.exedescription pid process Token: SeDebugPrivilege 744 PROFORMA INVOICE.exe Token: SeDebugPrivilege 64 PROFORMA INVOICE.exe -
Suspicious use of WriteProcessMemory 15 IoCs
Processes:
PROFORMA INVOICE.exedescription pid process target process PID 744 wrote to memory of 2764 744 PROFORMA INVOICE.exe schtasks.exe PID 744 wrote to memory of 2764 744 PROFORMA INVOICE.exe schtasks.exe PID 744 wrote to memory of 2764 744 PROFORMA INVOICE.exe schtasks.exe PID 744 wrote to memory of 1504 744 PROFORMA INVOICE.exe PROFORMA INVOICE.exe PID 744 wrote to memory of 1504 744 PROFORMA INVOICE.exe PROFORMA INVOICE.exe PID 744 wrote to memory of 1504 744 PROFORMA INVOICE.exe PROFORMA INVOICE.exe PID 744 wrote to memory of 64 744 PROFORMA INVOICE.exe PROFORMA INVOICE.exe PID 744 wrote to memory of 64 744 PROFORMA INVOICE.exe PROFORMA INVOICE.exe PID 744 wrote to memory of 64 744 PROFORMA INVOICE.exe PROFORMA INVOICE.exe PID 744 wrote to memory of 64 744 PROFORMA INVOICE.exe PROFORMA INVOICE.exe PID 744 wrote to memory of 64 744 PROFORMA INVOICE.exe PROFORMA INVOICE.exe PID 744 wrote to memory of 64 744 PROFORMA INVOICE.exe PROFORMA INVOICE.exe PID 744 wrote to memory of 64 744 PROFORMA INVOICE.exe PROFORMA INVOICE.exe PID 744 wrote to memory of 64 744 PROFORMA INVOICE.exe PROFORMA INVOICE.exe PID 744 wrote to memory of 64 744 PROFORMA INVOICE.exe PROFORMA INVOICE.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\PROFORMA INVOICE.exe"C:\Users\Admin\AppData\Local\Temp\PROFORMA INVOICE.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\BRtRZimUlc" /XML "C:\Users\Admin\AppData\Local\Temp\tmpB3F4.tmp"2⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Local\Temp\PROFORMA INVOICE.exe"{path}"2⤵
-
C:\Users\Admin\AppData\Local\Temp\PROFORMA INVOICE.exe"{path}"2⤵
- Suspicious behavior: RenamesItself
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\tmpB3F4.tmpMD5
ad8c37c82f41cbe392ca53ae7611833d
SHA1d3742ae9287f97c515abd6665c2a5afa6dcc939e
SHA2564169edb1febc2e08da0927d7fe0dc88afe9d2866bc3dd292b93797b09be63efa
SHA5123ae9816054bfb0b2d933cd442e91f7285022cd22e0c272f118b0899706c9ee400d64ac116370dfbfb373282d3bf66f4eac8a770b70fc28ec8261631310ac00cd
-
memory/64-4-0x0000000000400000-0x00000000004A2000-memory.dmpFilesize
648KB
-
memory/64-5-0x00000000004139DE-mapping.dmp
-
memory/64-6-0x0000000000400000-0x00000000004A2000-memory.dmpFilesize
648KB
-
memory/2764-2-0x0000000000000000-mapping.dmp