Analysis
-
max time kernel
150s -
max time network
151s -
platform
windows7_x64 -
resource
win7v20201028 -
submitted
15-01-2021 06:43
Static task
static1
Behavioral task
behavioral1
Sample
c31ead8d90b9c54c190ca138cd2676be.exe
Resource
win7v20201028
windows7_x64
0 signatures
0 seconds
General
-
Target
c31ead8d90b9c54c190ca138cd2676be.exe
-
Size
811KB
-
MD5
c31ead8d90b9c54c190ca138cd2676be
-
SHA1
59ee610052c95f4ba5215cdbf0ea4bad33d28815
-
SHA256
e665d8433c9e96b567470eb29b4f2857911001759b66cafb40c1123befdaf458
-
SHA512
b1e84eaf7d03810d3adfb6814ca4a4894aa8516ab80b13d7868bd56682382b2960848aa9f8d2f1b252de2658a29be1e991b3e3642fd9ff01e695a8f1146fbd72
Malware Config
Extracted
Family
lokibot
C2
http://blueriiver-eu.com/chief/offor/fre.php
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php
Signatures
-
Suspicious use of SetThreadContext 1 IoCs
Processes:
c31ead8d90b9c54c190ca138cd2676be.exedescription pid process target process PID 1748 set thread context of 848 1748 c31ead8d90b9c54c190ca138cd2676be.exe c31ead8d90b9c54c190ca138cd2676be.exe -
Suspicious behavior: RenamesItself 1 IoCs
Processes:
c31ead8d90b9c54c190ca138cd2676be.exepid process 848 c31ead8d90b9c54c190ca138cd2676be.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
c31ead8d90b9c54c190ca138cd2676be.exedescription pid process Token: SeDebugPrivilege 848 c31ead8d90b9c54c190ca138cd2676be.exe -
Suspicious use of WriteProcessMemory 10 IoCs
Processes:
c31ead8d90b9c54c190ca138cd2676be.exedescription pid process target process PID 1748 wrote to memory of 848 1748 c31ead8d90b9c54c190ca138cd2676be.exe c31ead8d90b9c54c190ca138cd2676be.exe PID 1748 wrote to memory of 848 1748 c31ead8d90b9c54c190ca138cd2676be.exe c31ead8d90b9c54c190ca138cd2676be.exe PID 1748 wrote to memory of 848 1748 c31ead8d90b9c54c190ca138cd2676be.exe c31ead8d90b9c54c190ca138cd2676be.exe PID 1748 wrote to memory of 848 1748 c31ead8d90b9c54c190ca138cd2676be.exe c31ead8d90b9c54c190ca138cd2676be.exe PID 1748 wrote to memory of 848 1748 c31ead8d90b9c54c190ca138cd2676be.exe c31ead8d90b9c54c190ca138cd2676be.exe PID 1748 wrote to memory of 848 1748 c31ead8d90b9c54c190ca138cd2676be.exe c31ead8d90b9c54c190ca138cd2676be.exe PID 1748 wrote to memory of 848 1748 c31ead8d90b9c54c190ca138cd2676be.exe c31ead8d90b9c54c190ca138cd2676be.exe PID 1748 wrote to memory of 848 1748 c31ead8d90b9c54c190ca138cd2676be.exe c31ead8d90b9c54c190ca138cd2676be.exe PID 1748 wrote to memory of 848 1748 c31ead8d90b9c54c190ca138cd2676be.exe c31ead8d90b9c54c190ca138cd2676be.exe PID 1748 wrote to memory of 848 1748 c31ead8d90b9c54c190ca138cd2676be.exe c31ead8d90b9c54c190ca138cd2676be.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\c31ead8d90b9c54c190ca138cd2676be.exe"C:\Users\Admin\AppData\Local\Temp\c31ead8d90b9c54c190ca138cd2676be.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\c31ead8d90b9c54c190ca138cd2676be.exe"C:\Users\Admin\AppData\Local\Temp\c31ead8d90b9c54c190ca138cd2676be.exe"2⤵
- Suspicious behavior: RenamesItself
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/848-7-0x0000000000400000-0x00000000004A2000-memory.dmpFilesize
648KB
-
memory/848-8-0x00000000004139DE-mapping.dmp
-
memory/848-9-0x0000000000400000-0x00000000004A2000-memory.dmpFilesize
648KB
-
memory/1164-10-0x000007FEF7040000-0x000007FEF72BA000-memory.dmpFilesize
2.5MB
-
memory/1748-2-0x00000000740C0000-0x00000000747AE000-memory.dmpFilesize
6.9MB
-
memory/1748-3-0x0000000000260000-0x0000000000261000-memory.dmpFilesize
4KB
-
memory/1748-5-0x0000000000560000-0x0000000000572000-memory.dmpFilesize
72KB
-
memory/1748-6-0x00000000053F0000-0x0000000005443000-memory.dmpFilesize
332KB