Analysis
-
max time kernel
71s -
max time network
151s -
platform
windows10_x64 -
resource
win10v20201028 -
submitted
14-01-2021 06:57
Static task
static1
Behavioral task
behavioral1
Sample
Nuevo orden.PDF.bat.exe
Resource
win7v20201028
windows7_x64
0 signatures
0 seconds
General
-
Target
Nuevo orden.PDF.bat.exe
-
Size
881KB
-
MD5
abb865db5097adc68c8c9915c39e6534
-
SHA1
3aec309c3c66ddcb76c2d6f9bd779b07c4022223
-
SHA256
644fe9320e421d92bf74b5ab972f3fcef4e07fc0ff9cc21cdc3d569b49201ad5
-
SHA512
0b90671f6f74b2068183fd99dcd8b53c709aa9452e2b4c271442d39d334ca65c970d965fcce748be6eba77c4037c5af6dcc2f841fbd846c53facfb5cc2c3e46d
Malware Config
Extracted
Family
lokibot
C2
http://51.195.53.221/p.php/dklX59XNxRkB6
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php
Signatures
-
Suspicious use of SetThreadContext 1 IoCs
Processes:
Nuevo orden.PDF.bat.exedescription pid process target process PID 3304 set thread context of 3576 3304 Nuevo orden.PDF.bat.exe Nuevo orden.PDF.bat.exe -
Suspicious behavior: RenamesItself 1 IoCs
Processes:
Nuevo orden.PDF.bat.exepid process 3576 Nuevo orden.PDF.bat.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
Nuevo orden.PDF.bat.exedescription pid process Token: SeDebugPrivilege 3576 Nuevo orden.PDF.bat.exe -
Suspicious use of WriteProcessMemory 9 IoCs
Processes:
Nuevo orden.PDF.bat.exedescription pid process target process PID 3304 wrote to memory of 3576 3304 Nuevo orden.PDF.bat.exe Nuevo orden.PDF.bat.exe PID 3304 wrote to memory of 3576 3304 Nuevo orden.PDF.bat.exe Nuevo orden.PDF.bat.exe PID 3304 wrote to memory of 3576 3304 Nuevo orden.PDF.bat.exe Nuevo orden.PDF.bat.exe PID 3304 wrote to memory of 3576 3304 Nuevo orden.PDF.bat.exe Nuevo orden.PDF.bat.exe PID 3304 wrote to memory of 3576 3304 Nuevo orden.PDF.bat.exe Nuevo orden.PDF.bat.exe PID 3304 wrote to memory of 3576 3304 Nuevo orden.PDF.bat.exe Nuevo orden.PDF.bat.exe PID 3304 wrote to memory of 3576 3304 Nuevo orden.PDF.bat.exe Nuevo orden.PDF.bat.exe PID 3304 wrote to memory of 3576 3304 Nuevo orden.PDF.bat.exe Nuevo orden.PDF.bat.exe PID 3304 wrote to memory of 3576 3304 Nuevo orden.PDF.bat.exe Nuevo orden.PDF.bat.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Nuevo orden.PDF.bat.exe"C:\Users\Admin\AppData\Local\Temp\Nuevo orden.PDF.bat.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Nuevo orden.PDF.bat.exe"C:\Users\Admin\AppData\Local\Temp\Nuevo orden.PDF.bat.exe"2⤵
- Suspicious behavior: RenamesItself
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/3304-2-0x0000000073300000-0x00000000739EE000-memory.dmpFilesize
6.9MB
-
memory/3304-3-0x0000000000150000-0x0000000000151000-memory.dmpFilesize
4KB
-
memory/3304-5-0x0000000004F60000-0x0000000004F61000-memory.dmpFilesize
4KB
-
memory/3304-6-0x0000000004B00000-0x0000000004B01000-memory.dmpFilesize
4KB
-
memory/3304-7-0x0000000004BA0000-0x0000000004BA1000-memory.dmpFilesize
4KB
-
memory/3304-8-0x0000000004A60000-0x0000000004A61000-memory.dmpFilesize
4KB
-
memory/3304-9-0x0000000004A70000-0x0000000004A82000-memory.dmpFilesize
72KB
-
memory/3304-10-0x0000000005760000-0x00000000057B7000-memory.dmpFilesize
348KB
-
memory/3576-12-0x00000000004139DE-mapping.dmp
-
memory/3576-11-0x0000000000400000-0x00000000004A2000-memory.dmpFilesize
648KB
-
memory/3576-13-0x0000000000400000-0x00000000004A2000-memory.dmpFilesize
648KB